# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 19.09.2020 13:01:42.221 Process: id = "1" image_name = "zhang.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhang.exe" page_root = "0x3a87c000" os_pid = "0xa9c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xbb4 [0044.751] GetVersion () returned 0x1db10106 [0044.759] GetModuleHandleA (lpModuleName=0x7294f824) returned 0x76d30000 [0044.769] GetProcAddress (hModule=0x76d30000, lpProcName="IsTNT") returned 0x0 [0044.769] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x240000 [0044.770] VirtualAlloc (lpAddress=0x0, dwSize=0x400000, flAllocationType=0x2000, flProtect=0x4) returned 0x2e80000 [0044.772] VirtualAlloc (lpAddress=0x2e80000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x2e80000 [0044.775] GetCurrentThreadId () returned 0xbb4 [0044.775] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe\" " [0044.775] GetEnvironmentStringsW () returned 0x16147a8* [0044.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0044.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x570) returned 0x2407d0 [0044.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x2407d0, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0044.775] FreeEnvironmentStringsW (penv=0x16147a8) returned 1 [0044.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x480) returned 0x240d48 [0044.776] GetStartupInfoA (in: lpStartupInfo=0x18f9b8 | out: lpStartupInfo=0x18f9b8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0044.776] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0044.776] GetFileType (hFile=0x0) returned 0x0 [0044.776] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0044.776] GetFileType (hFile=0x0) returned 0x0 [0044.776] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0044.776] GetFileType (hFile=0x0) returned 0x0 [0044.776] SetHandleCount (uNumber=0x20) returned 0x20 [0044.776] GetACP () returned 0x4e4 [0044.776] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f9e0 | out: lpCPInfo=0x18f9e0) returned 1 [0044.777] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x72a4c528, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhang.exe")) returned 0x2f [0044.780] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2407d0 | out: hHeap=0x240000) returned 1 [0044.780] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76d30000 [0044.781] GetProcAddress (hModule=0x76d30000, lpProcName="IsProcessorFeaturePresent") returned 0x76d45235 [0044.781] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0044.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x800) returned 0x2411d0 [0044.784] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x7c [0044.784] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x80 [0044.786] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0044.786] GetModuleFileNameA (in: hModule=0x72940000, lpFilename=0x72a4e6c8, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0044.786] GetVersion () returned 0x1db10106 [0044.787] lstrcmpiW (lpString1=0x72959810, lpString2=0x72959814) returned -1 [0044.866] GetUserDefaultLCID () returned 0x409 [0044.866] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="A", cchCount1=-1, lpString2="B", cchCount2=-1) returned 1 [0044.866] GetSystemMetrics (nIndex=5) returned 1 [0044.866] GetSystemMetrics (nIndex=6) returned 1 [0044.866] GetSystemMetrics (nIndex=11) returned 32 [0044.866] GetSystemMetrics (nIndex=12) returned 32 [0044.866] GetSystemMetrics (nIndex=34) returned 132 [0044.866] GetSystemMetrics (nIndex=35) returned 38 [0044.866] GetSystemMetrics (nIndex=0) returned 1440 [0044.867] GetSystemMetrics (nIndex=1) returned 900 [0044.867] GetSystemMetrics (nIndex=32) returned 8 [0044.867] GetSystemMetrics (nIndex=33) returned 8 [0044.867] GetSystemMetrics (nIndex=42) returned 0 [0044.867] GetStockObject (i=15) returned 0x188000b [0044.867] GetStockObject (i=7) returned 0x1b00017 [0044.867] GetStockObject (i=6) returned 0x1b00018 [0044.867] GetStockObject (i=8) returned 0x1b00016 [0044.867] GetStockObject (i=4) returned 0x1900011 [0044.867] GetStockObject (i=2) returned 0x1900012 [0044.867] GetStockObject (i=0) returned 0x1900010 [0044.867] GetStockObject (i=5) returned 0x1900015 [0044.867] GetStockObject (i=13) returned 0x18a002e [0044.867] GetDC (hWnd=0x0) returned 0xe010735 [0044.867] GetTextExtentPointA (in: hdc=0xe010735, lpString="0", c=1, lpsz=0x18f9dc | out: lpsz=0x18f9dc) returned 1 [0044.871] GetDeviceCaps (hdc=0xe010735, index=14) returned 1 [0044.871] GetDeviceCaps (hdc=0xe010735, index=12) returned 32 [0044.871] GetDeviceCaps (hdc=0xe010735, index=88) returned 96 [0044.871] GetDeviceCaps (hdc=0xe010735, index=90) returned 96 [0044.871] GetDeviceCaps (hdc=0xe010735, index=38) returned 32409 [0044.871] ReleaseDC (hWnd=0x0, hDC=0xe010735) returned 1 [0044.871] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0x3b0000 [0044.873] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x72a4e7d0 | out: ppMalloc=0x72a4e7d0*=0x767666bc) returned 0x0 [0044.873] GetCurrentThreadId () returned 0xbb4 [0045.076] LoadLibraryA (lpLibFileName="MSVBVM60.DLL") returned 0x72940000 [0045.076] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarTstGt") returned 0x72a49841 [0045.076] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarSub") returned 0x72a477ea [0045.076] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrI2") returned 0x72a20507 [0045.076] GetProcAddress (hModule=0x72940000, lpProcName="__vbaR8ForNextCheck") returned 0x72a49530 [0045.076] GetProcAddress (hModule=0x72940000, lpProcName="_CIcos") returned 0x72a39386 [0045.076] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fptan") returned 0x72a309f9 [0045.077] GetProcAddress (hModule=0x72940000, lpProcName="__vbaHresultCheck") returned 0x72a1a266 [0045.077] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrI4") returned 0x72a20537 [0045.077] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarMove") returned 0x72a46aee [0045.077] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarVargNofree") returned 0x72a4728d [0045.077] GetProcAddress (hModule=0x72940000, lpProcName="__vbaAryMove") returned 0x72a0c244 [0045.077] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFreeVar") returned 0x72a46831 [0045.077] GetProcAddress (hModule=0x72940000, lpProcName="__vbaLateIdCall") returned 0x72a48b74 [0045.077] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrVarMove") returned 0x72a21929 [0045.077] GetProcAddress (hModule=0x72940000, lpProcName="__vbaLenBstr") returned 0x72a26a9b [0045.078] GetProcAddress (hModule=0x72940000, lpProcName="__vbaEnd") returned 0x72a0be88 [0045.078] GetProcAddress (hModule=0x72940000, lpProcName="__vbaPut3") returned 0x72a256fa [0045.078] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFreeVarList") returned 0x72a47262 [0045.078] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fdiv_m64") returned 0x72a302ba [0045.078] GetProcAddress (hModule=0x72940000, lpProcName=0x26c) returned 0x72a13118 [0045.078] GetProcAddress (hModule=0x72940000, lpProcName="__vbaNextEachVar") returned 0x72a463bc [0045.079] GetProcAddress (hModule=0x72940000, lpProcName="__vbaRaiseEvent") returned 0x72a48b8f [0045.079] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFreeObjList") returned 0x72a19fc3 [0045.079] GetProcAddress (hModule=0x72940000, lpProcName=0x204) returned 0x72a270b7 [0045.080] GetProcAddress (hModule=0x72940000, lpProcName=0x205) returned 0x72a27569 [0045.080] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fprem1") returned 0x72a30941 [0045.080] GetProcAddress (hModule=0x72940000, lpProcName="__vbaRecAnsiToUni") returned 0x72a1b797 [0045.080] GetProcAddress (hModule=0x72940000, lpProcName=0x206) returned 0x72a275a0 [0045.080] GetProcAddress (hModule=0x72940000, lpProcName=0x272) returned 0x72a19cca [0045.080] GetProcAddress (hModule=0x72940000, lpProcName="__vbaResume") returned 0x72a249e1 [0045.080] GetProcAddress (hModule=0x72940000, lpProcName="__vbaCopyBytes") returned 0x72a1a0f3 [0045.080] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarCmpNe") returned 0x72a49957 [0045.080] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrCat") returned 0x72a26a76 [0045.080] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarTextTstEq") returned 0x72a4988c [0045.081] GetProcAddress (hModule=0x72940000, lpProcName="__vbaLsetFixstr") returned 0x72a276e5 [0045.081] GetProcAddress (hModule=0x72940000, lpProcName="__vbaRecDestruct") returned 0x72a1b704 [0045.081] GetProcAddress (hModule=0x72940000, lpProcName="__vbaSetSystemError") returned 0x72a0c33a [0045.081] GetProcAddress (hModule=0x72940000, lpProcName="__vbaNameFile") returned 0x72a16402 [0045.081] GetProcAddress (hModule=0x72940000, lpProcName="__vbaHresultCheckObj") returned 0x72a1a274 [0045.081] GetProcAddress (hModule=0x72940000, lpProcName="__vbaLenVar") returned 0x72a26aab [0045.081] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fdiv_m32") returned 0x72a3026e [0045.081] GetProcAddress (hModule=0x72940000, lpProcName="__vbaAryVar") returned 0x72a43940 [0045.081] GetProcAddress (hModule=0x72940000, lpProcName=0x29a) returned 0x72a1db35 [0045.081] GetProcAddress (hModule=0x72940000, lpProcName=0x29b) returned 0x72a1db60 [0045.082] GetProcAddress (hModule=0x72940000, lpProcName="__vbaAryDestruct") returned 0x72a1c1fe [0045.082] GetProcAddress (hModule=0x72940000, lpProcName="__vbaCyErrVar") returned 0x72a24e36 [0045.082] GetProcAddress (hModule=0x72940000, lpProcName="__vbaLateMemSt") returned 0x72a48c75 [0045.082] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarPow") returned 0x72a47704 [0045.082] GetProcAddress (hModule=0x72940000, lpProcName="__vbaExitProc") returned 0x72a24a48 [0045.082] GetProcAddress (hModule=0x72940000, lpProcName=0x251) returned 0x72a1cd05 [0045.082] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarForInit") returned 0x72a493cc [0045.082] GetProcAddress (hModule=0x72940000, lpProcName=0x252) returned 0x72a1cd3a [0045.082] GetProcAddress (hModule=0x72940000, lpProcName=0x12d) returned 0x72a35e23 [0045.082] GetProcAddress (hModule=0x72940000, lpProcName=0x253) returned 0x72a1d132 [0045.082] GetProcAddress (hModule=0x72940000, lpProcName="__vbaOnError") returned 0x72a2499d [0045.082] GetProcAddress (hModule=0x72940000, lpProcName="__vbaObjSet") returned 0x72a19ff1 [0045.083] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fdiv_m16i") returned 0x72a30306 [0045.083] GetProcAddress (hModule=0x72940000, lpProcName="__vbaObjSetAddref") returned 0x72a1a008 [0045.083] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fdivr_m16i") returned 0x72a30406 [0045.083] GetProcAddress (hModule=0x72940000, lpProcName=0x256) returned 0x72a0e0f7 [0045.083] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarIndexLoad") returned 0x72a1c43b [0045.083] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrFixstr") returned 0x72a29652 [0045.083] GetProcAddress (hModule=0x72940000, lpProcName="__vbaBoolVar") returned 0x72a20d73 [0045.083] GetProcAddress (hModule=0x72940000, lpProcName=0x133) returned 0x72a35f5a [0045.083] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrTextCmp") returned 0x72a295a8 [0045.083] GetProcAddress (hModule=0x72940000, lpProcName="__vbaBoolVarNull") returned 0x72a47185 [0045.083] GetProcAddress (hModule=0x72940000, lpProcName="__vbaRefVarAry") returned 0x72a1c417 [0045.083] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarTstLt") returned 0x72a49873 [0045.084] GetProcAddress (hModule=0x72940000, lpProcName="_CIsin") returned 0x72a394ee [0045.084] GetProcAddress (hModule=0x72940000, lpProcName=0x2c5) returned 0x72a38299 [0045.084] GetProcAddress (hModule=0x72940000, lpProcName=0x277) returned 0x72a26fe2 [0045.084] GetProcAddress (hModule=0x72940000, lpProcName="__vbaErase") returned 0x72a1c0fd [0045.084] GetProcAddress (hModule=0x72940000, lpProcName=0x278) returned 0x72a2702f [0045.084] GetProcAddress (hModule=0x72940000, lpProcName=0x20d) returned 0x72a27db9 [0045.084] GetProcAddress (hModule=0x72940000, lpProcName="__vbaChkstk") returned 0x72a362ea [0045.084] GetProcAddress (hModule=0x72940000, lpProcName=0x20e) returned 0x72a27dfb [0045.084] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFileClose") returned 0x72a1417d [0045.084] GetProcAddress (hModule=0x72940000, lpProcName="EVENT_SINK_AddRef") returned 0x72a09b74 [0045.085] GetProcAddress (hModule=0x72940000, lpProcName=0x20f) returned 0x72a27f8a [0045.085] GetProcAddress (hModule=0x72940000, lpProcName=0x210) returned 0x72a27faa [0045.085] GetProcAddress (hModule=0x72940000, lpProcName=0x211) returned 0x72a15d41 [0045.085] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrCmp") returned 0x72a29596 [0045.085] GetProcAddress (hModule=0x72940000, lpProcName="__vbaCyI2") returned 0x72a2199f [0045.085] GetProcAddress (hModule=0x72940000, lpProcName="__vbaPutOwner3") returned 0x72a2576c [0045.085] GetProcAddress (hModule=0x72940000, lpProcName="__vbaAryConstruct2") returned 0x72a1c6ae [0045.085] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarTstEq") returned 0x72a497f6 [0045.085] GetProcAddress (hModule=0x72940000, lpProcName=0x230) returned 0x72a1c9b4 [0045.085] GetProcAddress (hModule=0x72940000, lpProcName="__vbaObjVar") returned 0x72a1a1a9 [0045.085] GetProcAddress (hModule=0x72940000, lpProcName="DllFunctionCall") returned 0x7294a0fd [0045.086] GetProcAddress (hModule=0x72940000, lpProcName=0x233) returned 0x72a1cb05 [0045.086] GetProcAddress (hModule=0x72940000, lpProcName=0x29e) returned 0x72a1de02 [0045.086] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarOr") returned 0x72a495b2 [0045.086] GetProcAddress (hModule=0x72940000, lpProcName=0x234) returned 0x72a201fa [0045.086] GetProcAddress (hModule=0x72940000, lpProcName="__vbaRedimPreserve") returned 0x72a1c339 [0045.086] GetProcAddress (hModule=0x72940000, lpProcName="__vbaLbound") returned 0x72a1c628 [0045.086] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fpatan") returned 0x72a309f6 [0045.086] GetProcAddress (hModule=0x72940000, lpProcName="__vbaLateIdCallLd") returned 0x72a48b25 [0045.086] GetProcAddress (hModule=0x72940000, lpProcName="__vbaRedim") returned 0x72a1c30a [0045.086] GetProcAddress (hModule=0x72940000, lpProcName="__vbaRecUniToAnsi") returned 0x72a1b75d [0045.087] GetProcAddress (hModule=0x72940000, lpProcName="EVENT_SINK_Release") returned 0x72a09b87 [0045.087] GetProcAddress (hModule=0x72940000, lpProcName="__vbaNew") returned 0x72a1a204 [0045.087] GetProcAddress (hModule=0x72940000, lpProcName=0x258) returned 0x72a0ce69 [0045.087] GetProcAddress (hModule=0x72940000, lpProcName=0x259) returned 0x72a43a13 [0045.087] GetProcAddress (hModule=0x72940000, lpProcName="_CIsqrt") returned 0x72a39593 [0045.087] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarAnd") returned 0x72a49589 [0045.087] GetProcAddress (hModule=0x72940000, lpProcName="EVENT_SINK_QueryInterface") returned 0x72a09a85 [0045.087] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarMul") returned 0x72a47660 [0045.087] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStr2Vec") returned 0x72a43a40 [0045.087] GetProcAddress (hModule=0x72940000, lpProcName="__vbaExceptHandler") returned 0x72a247df [0045.088] GetProcAddress (hModule=0x72940000, lpProcName=0x2c7) returned 0x72a37ddb [0045.088] GetProcAddress (hModule=0x72940000, lpProcName="__vbaPrintFile") returned 0x72a150a3 [0045.088] GetProcAddress (hModule=0x72940000, lpProcName=0x2c8) returned 0x72a389c4 [0045.088] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrToUnicode") returned 0x72a0bf1d [0045.088] GetProcAddress (hModule=0x72940000, lpProcName=0x2c9) returned 0x72a38971 [0045.088] GetProcAddress (hModule=0x72940000, lpProcName=0x25e) returned 0x72a27e26 [0045.088] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fprem") returned 0x72a30689 [0045.088] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fdivr_m64") returned 0x72a303ba [0045.088] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarDiv") returned 0x72a47689 [0045.088] GetProcAddress (hModule=0x72940000, lpProcName=0x25f) returned 0x72a27f4d [0045.089] GetProcAddress (hModule=0x72940000, lpProcName=0x260) returned 0x72a20f56 [0045.089] GetProcAddress (hModule=0x72940000, lpProcName=0x213) returned 0x72a15c89 [0045.089] GetProcAddress (hModule=0x72940000, lpProcName=0x2cc) returned 0x72a197d1 [0045.089] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFPException") returned 0x72a47513 [0045.089] GetProcAddress (hModule=0x72940000, lpProcName=0x214) returned 0x72a15c9a [0045.089] GetProcAddress (hModule=0x72940000, lpProcName=0x2cd) returned 0x72a28fe9 [0045.089] GetProcAddress (hModule=0x72940000, lpProcName="__vbaInStrVar") returned 0x72a2738d [0045.089] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrCompVar") returned 0x72a27b3e [0045.089] GetProcAddress (hModule=0x72940000, lpProcName="__vbaGetOwner3") returned 0x72a25750 [0045.090] GetProcAddress (hModule=0x72940000, lpProcName="__vbaUbound") returned 0x72a1c65a [0045.090] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrVarVal") returned 0x72a21948 [0045.090] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarCat") returned 0x72a2697d [0045.090] GetProcAddress (hModule=0x72940000, lpProcName=0x217) returned 0x72a1c85d [0045.090] GetProcAddress (hModule=0x72940000, lpProcName="__vbaI2Var") returned 0x72a24e21 [0045.090] GetProcAddress (hModule=0x72940000, lpProcName=0x219) returned 0x72a20ebe [0045.090] GetProcAddress (hModule=0x72940000, lpProcName=0x284) returned 0x72a1de99 [0045.090] GetProcAddress (hModule=0x72940000, lpProcName=0x285) returned 0x72a153f7 [0045.090] GetProcAddress (hModule=0x72940000, lpProcName="_CIlog") returned 0x72a3942b [0045.090] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFileOpen") returned 0x72a13d10 [0045.090] GetProcAddress (hModule=0x72940000, lpProcName="__vbaR8Str") returned 0x72a210ea [0045.091] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarLateMemCallLdRf") returned 0x72a48da8 [0045.091] GetProcAddress (hModule=0x72940000, lpProcName=0x288) returned 0x72a14275 [0045.091] GetProcAddress (hModule=0x72940000, lpProcName=0x23a) returned 0x72a25618 [0045.091] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVar2Vec") returned 0x72a43aec [0045.091] GetProcAddress (hModule=0x72940000, lpProcName="__vbaInStr") returned 0x7294a296 [0045.091] GetProcAddress (hModule=0x72940000, lpProcName="__vbaNew2") returned 0x72a1a237 [0045.091] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fdiv_m32i") returned 0x72a3033a [0045.091] GetProcAddress (hModule=0x72940000, lpProcName=0x23c) returned 0x72a21290 [0045.091] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fdivr_m32i") returned 0x72a3043a [0045.091] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarSetObj") returned 0x72a1a01f [0045.092] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrCopy") returned 0x72a26c4a [0045.092] GetProcAddress (hModule=0x72940000, lpProcName=0x2a9) returned 0x72a1dae3 [0045.092] GetProcAddress (hModule=0x72940000, lpProcName="__vbaI4Str") returned 0x72a2105e [0045.092] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarNot") returned 0x72a49564 [0045.092] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFreeStrList") returned 0x72a26c01 [0045.092] GetProcAddress (hModule=0x72940000, lpProcName=0x240) returned 0x72a15f0d [0045.092] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fdivr_m32") returned 0x72a3036e [0045.092] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fdiv_r") returned 0x72a2fda9 [0045.092] GetProcAddress (hModule=0x72940000, lpProcName=0x242) returned 0x72a161f8 [0045.093] GetProcAddress (hModule=0x72940000, lpProcName=0x2ad) returned 0x72a1ef7d [0045.093] GetProcAddress (hModule=0x72940000, lpProcName=0x64) returned 0x729435a4 [0045.093] GetProcAddress (hModule=0x72940000, lpProcName=0x243) returned 0x72a16224 [0045.093] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarTstNe") returned 0x72a4980f [0045.093] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarSetVar") returned 0x72a1a0c7 [0045.093] GetProcAddress (hModule=0x72940000, lpProcName="__vbaI4Var") returned 0x72a24e2f [0045.093] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarCmpEq") returned 0x72a49922 [0045.093] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarAdd") returned 0x72a477c1 [0045.093] GetProcAddress (hModule=0x72940000, lpProcName="__vbaLateMemCall") returned 0x72a48cb8 [0045.093] GetProcAddress (hModule=0x72940000, lpProcName="__vbaAryLock") returned 0x72a1c6d9 [0045.094] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrToAnsi") returned 0x7294a3d7 [0045.094] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrComp") returned 0x72a27be9 [0045.094] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarDup") returned 0x72a46df6 [0045.094] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFpI2") returned 0x72a47559 [0045.094] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarLateMemCallLd") returned 0x72a48d8c [0045.094] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFpI4") returned 0x72a47570 [0045.095] GetProcAddress (hModule=0x72940000, lpProcName=0x268) returned 0x72a26d9a [0045.095] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarCopy") returned 0x72a46bb8 [0045.095] GetProcAddress (hModule=0x72940000, lpProcName="__vbaRecDestructAnsi") returned 0x72a1b7d1 [0045.095] GetProcAddress (hModule=0x72940000, lpProcName=0x269) returned 0x72a26dad [0045.095] GetProcAddress (hModule=0x72940000, lpProcName="__vbaLateMemCallLd") returned 0x72a48c4d [0045.095] GetProcAddress (hModule=0x72940000, lpProcName="__vbaR8IntI2") returned 0x72a297f3 [0045.095] GetProcAddress (hModule=0x72940000, lpProcName="_CIatan") returned 0x72a392c0 [0045.095] GetProcAddress (hModule=0x72940000, lpProcName="__vbaI2ErrVar") returned 0x72a24e1a [0045.095] GetProcAddress (hModule=0x72940000, lpProcName="__vbaAryCopy") returned 0x72a0c20d [0045.095] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrMove") returned 0x72a26c30 [0045.095] GetProcAddress (hModule=0x72940000, lpProcName=0x26a) returned 0x72a26e9e [0045.095] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrVarCopy") returned 0x72a20646 [0045.096] GetProcAddress (hModule=0x72940000, lpProcName="__vbaForEachVar") returned 0x72a46315 [0045.096] GetProcAddress (hModule=0x72940000, lpProcName="__vbaR8IntI4") returned 0x72a2980a [0045.096] GetProcAddress (hModule=0x72940000, lpProcName=0x26b) returned 0x72a26eb1 [0045.096] GetProcAddress (hModule=0x72940000, lpProcName="_allmul") returned 0x72a2eeed [0045.096] GetProcAddress (hModule=0x72940000, lpProcName="_CItan") returned 0x72a39644 [0045.096] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFPInt") returned 0x72a29821 [0045.096] GetProcAddress (hModule=0x72940000, lpProcName="__vbaAryUnlock") returned 0x72a1c6fc [0045.096] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarForNext") returned 0x72a493fa [0045.096] GetProcAddress (hModule=0x72940000, lpProcName="_CIexp") returned 0x72a2dd11 [0045.096] GetProcAddress (hModule=0x72940000, lpProcName="__vbaMidStmtBstr") returned 0x72a27c22 [0045.097] GetProcAddress (hModule=0x72940000, lpProcName="__vbaI4ErrVar") returned 0x72a24e28 [0045.097] GetProcAddress (hModule=0x72940000, lpProcName=0x244) returned 0x72a1624d [0045.097] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFreeObj") returned 0x72a19faf [0045.097] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFreeStr") returned 0x72a26bec [0045.097] GetProcAddress (hModule=0x72940000, lpProcName=0x245) returned 0x72a1325a [0045.097] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0045.097] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0045.097] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0045.098] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x104) returned 0x3b07d0 [0045.098] GetCurrentThreadId () returned 0xbb4 [0045.098] GetCurrentThreadId () returned 0xbb4 [0045.098] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xec8) returned 0x3b08e0 [0045.098] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe\" " [0045.098] lstrlenA (lpString="") returned 0 [0045.098] lstrcpyA (in: lpString1=0x18feac, lpString2="" | out: lpString1="") returned="" [0045.098] SetErrorMode (uMode=0x8001) returned 0x0 [0045.098] GetModuleFileNameA (in: hModule=0x72940000, lpFilename=0x18fb68, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0045.099] GetUserDefaultLCID () returned 0x409 [0045.099] lstrcpyA (in: lpString1=0x18f868, lpString2="*" | out: lpString1="*") returned="*" [0045.099] LoadStringA (in: hInstance=0x72940000, uID=0x7d1, lpBuffer=0x18fc6c, cchBufferMax=8 | out: lpBuffer="409") returned 0x3 [0045.099] GetSystemDefaultLCID () returned 0x409 [0045.099] GetUserDefaultLCID () returned 0x409 [0045.099] GetLocaleInfoA (in: Locale=0x400, LCType=0xe, lpLCData=0x18fc76, cchData=2 | out: lpLCData=".") returned 2 [0045.099] GetStockObject (i=13) returned 0x18a002e [0045.099] GetObjectA (in: h=0x18a002e, c=60, pv=0x18fc3c | out: pv=0x18fc3c) returned 60 [0045.099] GetLocaleInfoA (in: Locale=0x409, LCType=0x80000003, lpLCData=0x18fc38, cchData=4 | out: lpLCData="ENU") returned 4 [0045.099] lstrcpyA (in: lpString1=0x18fc68, lpString2="EN" | out: lpString1="EN") returned="EN" [0045.099] lstrlenA (lpString="{xx}") returned 4 [0045.099] lstrlenA (lpString="VB98.CHM") returned 8 [0045.099] lstrcpyA (in: lpString1=0x72a4eae8, lpString2="VB98.CHM" | out: lpString1="VB98.CHM") returned="VB98.CHM" [0045.099] GetLocaleInfoA (in: Locale=0x409, LCType=0x80000003, lpLCData=0x18fc38, cchData=4 | out: lpLCData="ENU") returned 4 [0045.099] lstrcpyA (in: lpString1=0x18fc68, lpString2="EN" | out: lpString1="EN") returned="EN" [0045.099] lstrlenA (lpString="{xx}") returned 4 [0045.099] lstrlenA (lpString="VBENLR98.CHM") returned 12 [0045.102] lstrcpyA (in: lpString1=0x72a4ebf0, lpString2="VBENLR98.CHM" | out: lpString1="VBENLR98.CHM") returned="VBENLR98.CHM" [0045.102] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18fd90, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhang.exe")) returned 0x2f [0045.102] GetModuleFileNameA (in: hModule=0x72940000, lpFilename=0x18fc8c, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0045.102] lstrcpynA (in: lpString1=0x18fb70, lpString2="C:\\Windows\\system32\\MSVBVM60.DLL", iMaxLength=260 | out: lpString1="C:\\Windows\\system32\\MSVBVM60.DLL") returned="C:\\Windows\\system32\\MSVBVM60.DLL" [0045.103] lstrlenA (lpString="C:\\Windows\\system32\\MSVBVM60.DLL") returned 32 [0045.103] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x21) returned 0x3b17b0 [0045.103] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x21) returned 0x3b17e0 [0045.103] lstrcpyA (in: lpString1=0x3b17b0, lpString2="C:\\Windows\\system32\\MSVBVM60.DLL" | out: lpString1="C:\\Windows\\system32\\MSVBVM60.DLL") returned="C:\\Windows\\system32\\MSVBVM60.DLL" [0045.103] LCMapStringA (in: Locale=0x409, dwMapFlags=0x200, lpSrcStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe", cchSrc=-1, lpDestStr=0x18fb50, cchDest=260 | out: lpDestStr="C:\\USERS\\5P5NRGJN0JS HALPMCXZ\\DESKTOP\\ZHANG.EXE") returned 48 [0045.104] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x18fc54, dwRevision=0x1 | out: pSecurityDescriptor=0x18fc54) returned 1 [0045.104] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x18fc54, bDaclPresent=1, pDacl=0x0, bDaclDefaulted=0 | out: pSecurityDescriptor=0x18fc54) returned 1 [0045.104] CreateSemaphoreA (lpSemaphoreAttributes=0x18fc68, lInitialCount=0, lMaximumCount=2147483647, lpName="C:?USERS?5P5NRGJN0JS HALPMCXZ?DESKTOP?ZHANG.EXE") returned 0x90 [0045.104] GetLastError () returned 0x0 [0045.104] GetVersionExA (in: lpVersionInformation=0x18fbcc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x18fbcc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0045.104] OleInitialize (pvReserved=0x0) returned 0x0 [0045.835] OaBuildVersion () returned 0x321396 [0045.835] LoadLibraryA (lpLibFileName="OLEAUT32.DLL") returned 0x76e40000 [0045.836] GetLastError () returned 0x0 [0045.836] GetProcAddress (hModule=0x76e40000, lpProcName="OleLoadPictureEx") returned 0x76ea70a1 [0045.836] RegisterClipboardFormatA (lpszFormat="Link") returned 0xc168 [0045.836] RegisterClipboardFormatA (lpszFormat="Rich Text Format") returned 0xc0b1 [0045.836] GetClassInfoA (in: hInstance=0x72940000, lpClassName="VBFocusRT6", lpWndClass=0x18fc34 | out: lpWndClass=0x18fc34) returned 0 [0045.836] RegisterClassA (lpWndClass=0x18fc34) returned 0xc16a [0045.836] GetClassInfoA (in: hInstance=0x72940000, lpClassName="VBBubbleRT6", lpWndClass=0x18fc34 | out: lpWndClass=0x18fc34) returned 0 [0045.836] RegisterClassA (lpWndClass=0x18fc34) returned 0xc121 [0045.837] HeapCreate (flOptions=0x0, dwInitialSize=0x400, dwMaximumSize=0x0) returned 0x3680000 [0045.837] GetUserDefaultLCID () returned 0x409 [0045.837] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a4) returned 0x3b1810 [0045.837] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a4) returned 0x3b1bc0 [0045.837] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xd4) returned 0x3b1f70 [0045.838] GetSystemInfo (in: lpSystemInfo=0x18fbf4 | out: lpSystemInfo=0x18fbf4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0045.838] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x210000 [0045.838] VirtualAlloc (lpAddress=0x210000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0045.838] VirtualAlloc (lpAddress=0x210000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0045.839] VirtualAlloc (lpAddress=0x210000, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0045.839] VirtualAlloc (lpAddress=0x210000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0045.839] VirtualAlloc (lpAddress=0x210000, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0045.839] VirtualAlloc (lpAddress=0x210000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0045.839] VirtualProtect (in: lpAddress=0x210000, dwSize=0x6000, flNewProtect=0x20, lpflOldProtect=0x18fc50 | out: lpflOldProtect=0x18fc50*=0x4) returned 1 [0045.841] GetCurrentProcess () returned 0xffffffff [0045.841] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x210000, dwSize=0x6000) returned 1 [0045.841] GlobalAddAtomA (lpString="VBDisabled") returned 0xc157 [0045.841] GetVersion () returned 0x1db10106 [0045.841] GetModuleHandleA (lpModuleName=0x7295a0cc) returned 0x76e40000 [0045.841] GetProcAddress (hModule=0x76e40000, lpProcName="DispCallFunc") returned 0x76e53dcf [0045.841] GetProcAddress (hModule=0x76e40000, lpProcName="LoadTypeLibEx") returned 0x76e507b7 [0045.842] GetProcAddress (hModule=0x76e40000, lpProcName="UnRegisterTypeLib") returned 0x76e71ca9 [0045.842] GetProcAddress (hModule=0x76e40000, lpProcName="CreateTypeLib2") returned 0x76e58e70 [0045.842] GetProcAddress (hModule=0x76e40000, lpProcName="VarDateFromUdate") returned 0x76e57684 [0045.842] GetProcAddress (hModule=0x76e40000, lpProcName="VarUdateFromDate") returned 0x76e5cc98 [0045.842] GetProcAddress (hModule=0x76e40000, lpProcName="GetAltMonthNames") returned 0x76e8903a [0045.842] GetProcAddress (hModule=0x76e40000, lpProcName="VarNumFromParseNum") returned 0x76e56231 [0045.842] GetProcAddress (hModule=0x76e40000, lpProcName="VarParseNumFromStr") returned 0x76e55fea [0045.843] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecFromR4") returned 0x76e63f94 [0045.844] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecFromR8") returned 0x76e64e9e [0045.844] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecFromDate") returned 0x76e8db72 [0045.844] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecFromI4") returned 0x76e72a8c [0045.844] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecFromCy") returned 0x76e8d737 [0045.844] GetProcAddress (hModule=0x76e40000, lpProcName="VarR4FromDec") returned 0x76e8e015 [0045.844] GetProcAddress (hModule=0x76e40000, lpProcName="GetRecordInfoFromTypeInfo") returned 0x76e8cc3d [0045.845] GetProcAddress (hModule=0x76e40000, lpProcName="GetRecordInfoFromGuids") returned 0x76e8d1c4 [0045.845] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayGetRecordInfo") returned 0x76e8d48c [0045.845] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArraySetRecordInfo") returned 0x76e8d4c6 [0045.845] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayGetIID") returned 0x76e8d509 [0045.845] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArraySetIID") returned 0x76e5e7bb [0045.845] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayCopyData") returned 0x76e5e496 [0045.846] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayAllocDescriptorEx") returned 0x76e5ddf1 [0045.846] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayCreateEx") returned 0x76e8d53f [0045.846] GetProcAddress (hModule=0x76e40000, lpProcName="VarFormat") returned 0x76e92055 [0045.846] GetProcAddress (hModule=0x76e40000, lpProcName="VarFormatDateTime") returned 0x76e920ea [0045.846] GetProcAddress (hModule=0x76e40000, lpProcName="VarFormatNumber") returned 0x76e92151 [0045.846] GetProcAddress (hModule=0x76e40000, lpProcName="VarFormatPercent") returned 0x76e921f5 [0045.846] GetProcAddress (hModule=0x76e40000, lpProcName="VarFormatCurrency") returned 0x76e92288 [0045.846] GetProcAddress (hModule=0x76e40000, lpProcName="VarWeekdayName") returned 0x76e92335 [0045.847] GetProcAddress (hModule=0x76e40000, lpProcName="VarMonthName") returned 0x76e923d5 [0045.847] GetProcAddress (hModule=0x76e40000, lpProcName="VarAdd") returned 0x76e65934 [0045.847] GetProcAddress (hModule=0x76e40000, lpProcName="VarAnd") returned 0x76e65a98 [0045.847] GetProcAddress (hModule=0x76e40000, lpProcName="VarCat") returned 0x76e659b4 [0045.847] GetProcAddress (hModule=0x76e40000, lpProcName="VarDiv") returned 0x76ebe405 [0045.847] GetProcAddress (hModule=0x76e40000, lpProcName="VarEqv") returned 0x76ebef07 [0045.847] GetProcAddress (hModule=0x76e40000, lpProcName="VarIdiv") returned 0x76ebf00a [0045.847] GetProcAddress (hModule=0x76e40000, lpProcName="VarImp") returned 0x76ebef47 [0045.848] GetProcAddress (hModule=0x76e40000, lpProcName="VarMod") returned 0x76ebf15e [0045.848] GetProcAddress (hModule=0x76e40000, lpProcName="VarMul") returned 0x76ebdbd4 [0045.848] GetProcAddress (hModule=0x76e40000, lpProcName="VarOr") returned 0x76ebecfa [0045.848] GetProcAddress (hModule=0x76e40000, lpProcName="VarPow") returned 0x76ebea66 [0045.848] GetProcAddress (hModule=0x76e40000, lpProcName="VarSub") returned 0x76ebd332 [0045.848] GetProcAddress (hModule=0x76e40000, lpProcName="VarXor") returned 0x76ebee2e [0045.848] GetProcAddress (hModule=0x76e40000, lpProcName="VarAbs") returned 0x76ebca11 [0045.848] GetProcAddress (hModule=0x76e40000, lpProcName="VarFix") returned 0x76ebcc5f [0045.849] GetProcAddress (hModule=0x76e40000, lpProcName="VarInt") returned 0x76ebcde7 [0045.849] GetProcAddress (hModule=0x76e40000, lpProcName="VarNeg") returned 0x76ebc802 [0045.849] GetProcAddress (hModule=0x76e40000, lpProcName="VarNot") returned 0x76ebec66 [0045.849] GetProcAddress (hModule=0x76e40000, lpProcName="VarRound") returned 0x76ebd155 [0045.849] GetProcAddress (hModule=0x76e40000, lpProcName="VarCmp") returned 0x76e5b0dc [0045.849] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecAdd") returned 0x76e75f3e [0045.849] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecCmp") returned 0x76e64fd0 [0045.849] GetProcAddress (hModule=0x76e40000, lpProcName="VarBstrCat") returned 0x76e60d2c [0045.849] GetProcAddress (hModule=0x76e40000, lpProcName="VarCyMulI4") returned 0x76e759ed [0045.849] GetProcAddress (hModule=0x76e40000, lpProcName="VarBstrCmp") returned 0x76e4f8b8 [0045.849] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x76620000 [0045.849] GetProcAddress (hModule=0x76620000, lpProcName="CoCreateInstanceEx") returned 0x76669d4e [0045.850] GetProcAddress (hModule=0x76620000, lpProcName="CLSIDFromProgIDEx") returned 0x76630782 [0045.850] GetSystemMetrics (nIndex=42) returned 0 [0045.850] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x72a4e688 | out: ppMalloc=0x72a4e688*=0x767666bc) returned 0x0 [0045.850] IMalloc:Alloc (This=0x767666bc, cb=0x4) returned 0x1618c90 [0045.850] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18f968, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhang.exe")) returned 0x2f [0046.199] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe", lpString2=".cfg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe.cfg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe.cfg" [0046.199] SetLastError (dwErrCode=0x0) [0046.199] SearchPathA (in: lpPath=0x0, lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe.cfg", lpExtension=0x0, nBufferLength=0x103, lpBuffer=0x18f864, lpFilePart=0x18f838 | out: lpBuffer="|ú\x18", lpFilePart=0x18f838) returned 0x0 [0046.200] SetLastError (dwErrCode=0x2) [0046.200] GetLastError () returned 0x2 [0046.200] lstrcmpiA (lpString1="zhang", lpString2="MTX") returned 1 [0046.200] lstrcmpiA (lpString1="zhang", lpString2="DLLHOST") returned 1 [0046.200] lstrcmpiA (lpString1="zhang", lpString2="INETINFO") returned 1 [0046.200] lstrcmpiA (lpString1="zhang", lpString2="W3WP") returned 1 [0046.200] lstrcmpiA (lpString1="zhang", lpString2="ASPNET_WP") returned 1 [0046.200] lstrcmpiA (lpString1="zhang", lpString2="DLLHST3G") returned 1 [0046.200] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18f95c, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhang.exe")) returned 0x2f [0046.200] lstrcmpiA (lpString1="zhang", lpString2="IEXPLORE") returned 1 [0046.200] LoadLibraryA (lpLibFileName="SXS.DLL") returned 0x75620000 [0046.687] GetLastError () returned 0x0 [0046.687] GetProcAddress (hModule=0x75620000, lpProcName="SxsOleAut32MapIIDOrCLSIDToTypeLibrary") returned 0x75667685 [0046.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18feac, cbMultiByte=-1, lpWideCharStr=0x18fea8, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0046.687] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1c) returned 0x3b2050 [0046.688] CoRegisterMessageFilter (in: lpMessageFilter=0x3b2054, lplpMessageFilter=0x3b205c | out: lplpMessageFilter=0x3b205c*=0x0) returned 0x0 [0046.688] IUnknown:AddRef (This=0x3b2054) returned 0x2 [0046.688] GetClassInfoExA (in: hInstance=0x72940000, lpszClass="ThunderRT6Main", lpwcx=0x18fe78 | out: lpwcx=0x18fe78) returned 0 [0046.688] LoadIconA (hInstance=0x400000, lpIconName=0x1) returned 0x900ad [0046.689] GetModuleHandleA (lpModuleName="USER32") returned 0x77130000 [0046.690] GetProcAddress (hModule=0x77130000, lpProcName="GetSystemMetrics") returned 0x77147d2f [0046.690] GetProcAddress (hModule=0x77130000, lpProcName="MonitorFromWindow") returned 0x77153150 [0046.690] GetProcAddress (hModule=0x77130000, lpProcName="MonitorFromRect") returned 0x7716e7a0 [0046.690] GetProcAddress (hModule=0x77130000, lpProcName="MonitorFromPoint") returned 0x77155281 [0046.690] GetProcAddress (hModule=0x77130000, lpProcName="EnumDisplayMonitors") returned 0x7715451a [0046.690] GetProcAddress (hModule=0x77130000, lpProcName="GetMonitorInfoA") returned 0x77154413 [0046.690] GetSystemMetrics (nIndex=0) returned 1440 [0046.690] GetSystemMetrics (nIndex=78) returned 1440 [0046.690] GetSystemMetrics (nIndex=1) returned 900 [0046.690] GetSystemMetrics (nIndex=79) returned 900 [0046.690] GetSystemMetrics (nIndex=50) returned 16 [0046.690] GetSystemMetrics (nIndex=49) returned 16 [0046.691] LoadImageA (hInst=0x400000, name=0x1, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x70231 [0046.691] RegisterClassExA (param_1=0x18fe78) returned 0x8ec162 [0046.691] CreateWindowExA (dwExStyle=0x80, lpClassName="ThunderRT6Main", lpWindowName=0x0, dwStyle=0x80090000, X=-2147483648, Y=-2147483648, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x72940000, lpParam=0x0) returned 0x6011a [0046.691] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0x81, wParam=0x0, lParam=0x18fa5c) returned 0x1 [0046.692] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0x83, wParam=0x0, lParam=0x18fa48) returned 0x0 [0046.693] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0x1, wParam=0x0, lParam=0x18fa5c) returned 0x0 [0046.693] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0046.693] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0046.693] MonitorFromWindow (hwnd=0x6011a, dwFlags=0x2) returned 0x10001 [0046.693] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0x18fe80 | out: lpmi=0x18fe80) returned 1 [0046.693] SetWindowPos (hWnd=0x6011a, hWndInsertAfter=0x0, X=720, Y=450, cx=0, cy=0, uFlags=0x1d) returned 1 [0046.693] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0x46, wParam=0x0, lParam=0x18fe20) returned 0x0 [0046.694] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0x47, wParam=0x0, lParam=0x18fe20) returned 0x0 [0046.694] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0x3, wParam=0x0, lParam=0x1c202d0) returned 0x0 [0046.694] ShowWindow (hWnd=0x6011a, nCmdShow=4) returned 0 [0046.694] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0046.695] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0x46, wParam=0x0, lParam=0x18fe34) returned 0x0 [0046.695] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0x47, wParam=0x0, lParam=0x18fe34) returned 0x0 [0046.695] GetWindowThreadProcessId (in: hWnd=0x6011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xbb4 [0046.695] VirtualQuery (in: lpAddress=0x18fea8, lpBuffer=0x18fe8c, dwLength=0x1c | out: lpBuffer=0x18fe8c*(BaseAddress=0x18f000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0046.696] GetUserDefaultLCID () returned 0x409 [0046.696] IsValidCodePage (CodePage=0x3a4) returned 1 [0046.698] IsValidCodePage (CodePage=0x3b5) returned 1 [0046.699] IsValidCodePage (CodePage=0x3b6) returned 1 [0046.701] IsValidCodePage (CodePage=0x3a8) returned 1 [0046.706] GetUserDefaultLangID () returned 0x409 [0046.706] GetSystemDefaultLangID () returned 0x1610409 [0046.706] GetSystemMetrics (nIndex=42) returned 0 [0046.706] IMalloc:Alloc (This=0x767666bc, cb=0xa8) returned 0x161d3b0 [0046.706] IMalloc:GetSize (This=0x767666bc, pv=0x161d3b0) returned 0xa8 [0046.706] IMalloc:Alloc (This=0x767666bc, cb=0xc) returned 0x161caf0 [0046.706] GetCurrentThreadId () returned 0xbb4 [0046.706] IMalloc:Alloc (This=0x767666bc, cb=0x3c) returned 0x1618ca0 [0046.706] IMalloc:Alloc (This=0x767666bc, cb=0x1c) returned 0x1619468 [0046.709] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\VBA\\Monitors", phkResult=0x18fe74 | out: phkResult=0x18fe74*=0x0) returned 0x2 [0046.709] IMalloc:Alloc (This=0x767666bc, cb=0x1c) returned 0x1619490 [0046.709] GetCurrentThreadId () returned 0xbb4 [0046.709] SetWindowsHookExA (idHook=-1, lpfn=0x729a1e09, hmod=0x0, dwThreadId=0xbb4) returned 0x14022d [0046.709] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x14) returned 0x3b2078 [0046.709] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x80) returned 0x3b2098 [0046.709] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3b2120 [0046.709] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x2c) returned 0x3b2138 [0046.710] GetClassInfoA (in: hInstance=0x72940000, lpClassName="VBMsoStdCompMgr", lpWndClass=0x18fdcc | out: lpWndClass=0x18fdcc) returned 0 [0046.710] RegisterClassA (lpWndClass=0x18fdcc) returned 0x98c163 [0046.710] CreateWindowExA (dwExStyle=0x0, lpClassName="VBMsoStdCompMgr", lpWindowName=0x0, dwStyle=0x80000000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x72940000, lpParam=0x0) returned 0x50116 [0046.710] NtdllDefWindowProc_A (hWnd=0x50116, Msg=0x81, wParam=0x0, lParam=0x18fa08) returned 0x1 [0046.710] NtdllDefWindowProc_A (hWnd=0x50116, Msg=0x83, wParam=0x0, lParam=0x18f9f4) returned 0x0 [0046.710] NtdllDefWindowProc_A (hWnd=0x50116, Msg=0x1, wParam=0x0, lParam=0x18fa08) returned 0x0 [0046.710] NtdllDefWindowProc_A (hWnd=0x50116, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0046.710] NtdllDefWindowProc_A (hWnd=0x50116, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0046.710] SetWindowLongA (hWnd=0x50116, nIndex=0, dwNewLong=3874972) returned 0 [0046.710] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x38) returned 0x3b2170 [0046.710] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x18) returned 0x3b21b0 [0046.710] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3b21d0 [0046.711] RegisterClipboardFormatA (lpszFormat="Object Descriptor") returned 0xc00e [0046.711] RegisterClipboardFormatA (lpszFormat="Link Source Descriptor") returned 0xc00f [0046.711] RegisterClipboardFormatA (lpszFormat="Embed Source") returned 0xc00b [0046.711] RegisterClipboardFormatA (lpszFormat="Embedded Object") returned 0xc00a [0046.711] RegisterClipboardFormatA (lpszFormat="Link Source") returned 0xc00d [0046.711] RegisterClipboardFormatA (lpszFormat="OwnerLink") returned 0xc003 [0046.711] RegisterClipboardFormatA (lpszFormat="FileName") returned 0xc006 [0046.711] CreateCompatibleDC (hdc=0x0) returned 0x1e010257 [0046.711] GetCurrentObject (hdc=0x1e010257, type=0x7) returned 0x185000f [0046.711] CreateWindowExA (dwExStyle=0x0, lpClassName="VBFocusRT6", lpWindowName=0x0, dwStyle=0x40000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x6011a, hMenu=0x0, hInstance=0x72940000, lpParam=0x0) returned 0x50114 [0046.711] NtdllDefWindowProc_A (hWnd=0x50114, Msg=0x81, wParam=0x0, lParam=0x18fa98) returned 0x1 [0046.711] NtdllDefWindowProc_A (hWnd=0x50114, Msg=0x83, wParam=0x0, lParam=0x18fa84) returned 0x0 [0046.711] NtdllDefWindowProc_A (hWnd=0x50114, Msg=0x1, wParam=0x0, lParam=0x18fa98) returned 0x0 [0046.711] NtdllDefWindowProc_A (hWnd=0x50114, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0046.712] NtdllDefWindowProc_A (hWnd=0x50114, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0046.712] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0x210, wParam=0x1, lParam=0x50114) returned 0x0 [0046.712] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x18) returned 0x3b21e8 [0046.712] RtlAllocateHeap (HeapHandle=0x3680000, Flags=0x8, Size=0x114) returned 0x36807d0 [0046.712] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x5c) returned 0x3b2208 [0046.712] GetCurrentThreadId () returned 0xbb4 [0046.712] GetCurrentThreadId () returned 0xbb4 [0046.712] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x10) returned 0x3b2270 [0046.712] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x30) returned 0x3b2288 [0046.712] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x434) returned 0x3b22c0 [0046.712] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x434) returned 0x3b2700 [0046.712] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3c) returned 0x3b2b40 [0046.712] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3b2b88 [0046.712] lstrlenA (lpString="VB") returned 2 [0046.712] lstrlenA (lpString=0x72956af8) returned 10 [0046.713] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0x3b2ca8 [0046.713] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x16c) returned 0x3b2cc0 [0046.713] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x68) returned 0x3b2e38 [0046.713] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2c8) returned 0x3b2ea8 [0046.713] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0x3b3178 [0046.713] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3b31a8 [0046.713] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0x3b31c8 [0046.713] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3b31f8 [0046.714] lstrlenA (lpString="VB") returned 2 [0046.714] lstrlenA (lpString="Label") returned 5 [0046.714] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x9) returned 0x3b3318 [0046.714] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x34) returned 0x3b3330 [0046.714] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xf0) returned 0x3b3370 [0046.714] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x48) returned 0x3b3468 [0046.714] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1f4) returned 0x3b34b8 [0046.714] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3b36b8 [0046.714] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3b36d8 [0046.714] lstrlenA (lpString="VB") returned 2 [0046.714] lstrlenA (lpString="TextBox") returned 7 [0046.714] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xb) returned 0x3b37f8 [0046.714] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x38) returned 0x3b3810 [0046.714] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x120) returned 0x3b3850 [0046.714] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x60) returned 0x3b3978 [0046.714] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x250) returned 0x3b39e0 [0046.714] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3b3c38 [0046.715] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3b3c58 [0046.715] lstrlenA (lpString="VB") returned 2 [0046.715] lstrlenA (lpString="Frame") returned 5 [0046.715] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x9) returned 0x3b3d78 [0046.715] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x24) returned 0x3b3d90 [0046.715] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xb0) returned 0x3b3dc0 [0046.715] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x34) returned 0x3b3e78 [0046.715] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x184) returned 0x3b3eb8 [0046.715] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3b4048 [0046.715] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3b4068 [0046.715] lstrlenA (lpString="VB") returned 2 [0046.715] lstrlenA (lpString="CommandButton") returned 13 [0046.715] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x11) returned 0x3b4188 [0046.742] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x28) returned 0x3b41a8 [0046.742] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xd4) returned 0x3b41d8 [0046.742] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x44) returned 0x3b42b8 [0046.742] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c8) returned 0x3b4308 [0046.743] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3b44d8 [0046.743] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3b44f8 [0046.743] lstrlenA (lpString="VB") returned 2 [0046.743] lstrlenA (lpString="ListBox") returned 7 [0046.743] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xb) returned 0x3b4618 [0046.743] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x108) returned 0x3b4630 [0046.743] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x54) returned 0x3b4740 [0046.743] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x230) returned 0x3b47a0 [0046.743] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3b3178, Size=0x50) returned 0x3b49d8 [0046.744] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3b3178 [0046.744] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3b31c8, Size=0x50) returned 0x3b4a30 [0046.744] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3b4a88 [0046.744] lstrlenA (lpString="VB") returned 2 [0046.744] lstrlenA (lpString="Timer") returned 5 [0046.744] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x9) returned 0x3b31c8 [0046.744] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xc) returned 0x3b31e0 [0046.744] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x30) returned 0x3b4ba8 [0046.744] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3b3198 [0046.744] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x9c) returned 0x3b4be0 [0046.745] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3b4c88 [0046.745] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3b4ca8 [0046.745] lstrlenA (lpString="VB") returned 2 [0046.745] lstrlenA (lpString="Printer") returned 7 [0046.745] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xb) returned 0x3b4dc8 [0046.745] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xdc) returned 0x3b4de0 [0046.745] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3b4ec8 [0046.745] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3b4ee8 [0046.746] lstrlenA (lpString="VB") returned 2 [0046.746] lstrlenA (lpString="Form") returned 4 [0046.746] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0x3b5008 [0046.746] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x184) returned 0x3b5018 [0046.746] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x7c) returned 0x3b51a8 [0046.746] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2f8) returned 0x3b5230 [0046.746] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3b5530 [0046.747] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3b5550 [0046.747] lstrlenA (lpString="VB") returned 2 [0046.747] lstrlenA (lpString="Screen") returned 6 [0046.747] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa) returned 0x3b5670 [0046.747] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x2c) returned 0x3b5688 [0046.747] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa0) returned 0x3b56c0 [0046.748] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3b5768 [0046.748] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3b5788 [0046.748] lstrlenA (lpString="VB") returned 2 [0046.748] lstrlenA (lpString="Clipboard") returned 9 [0046.748] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xd) returned 0x3b58a8 [0046.748] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1c) returned 0x3b58c0 [0046.748] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x68) returned 0x3b58e8 [0046.748] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3b49d8, Size=0x78) returned 0x3b5958 [0046.748] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3b49d8 [0046.749] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3b4a30, Size=0x78) returned 0x3b59d8 [0046.749] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3b5a58 [0046.749] lstrlenA (lpString="VB") returned 2 [0046.749] lstrlenA (lpString="FileListBox") returned 11 [0046.749] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xf) returned 0x3b49f8 [0046.749] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x28) returned 0x3b4a10 [0046.749] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xec) returned 0x3b5b78 [0046.749] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x58) returned 0x3b5c70 [0046.749] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1f8) returned 0x3b5cd0 [0046.749] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3b4a40 [0046.749] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3b5ed0 [0046.750] lstrlenA (lpString="VB") returned 2 [0046.750] lstrlenA (lpString="MDIForm") returned 7 [0046.750] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xb) returned 0x3b4a60 [0046.750] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x184) returned 0x3b5ff0 [0046.750] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x7c) returned 0x3b6180 [0046.750] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2f8) returned 0x3b6208 [0046.750] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3b6508 [0046.751] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3c0d90 [0046.751] lstrlenA (lpString="VB") returned 2 [0046.751] lstrlenA (lpString="App") returned 3 [0046.751] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7) returned 0x3b4a78 [0046.751] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x84) returned 0x3c0eb0 [0046.752] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x148) returned 0x3c0f40 [0046.752] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3c1090 [0046.752] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3c10b0 [0046.752] lstrlenA (lpString="VB") returned 2 [0046.752] lstrlenA (lpString="Image") returned 5 [0046.752] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x9) returned 0x3c11d0 [0046.752] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x24) returned 0x3c11e8 [0046.752] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x98) returned 0x3c1218 [0046.752] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x34) returned 0x3c12b8 [0046.753] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x154) returned 0x3c12f8 [0046.753] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3c1470 [0046.753] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3c2058 [0046.753] lstrlenA (lpString="VB") returned 2 [0046.753] lstrlenA (lpString="UserControl") returned 11 [0046.753] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xf) returned 0x3c2178 [0046.753] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e4) returned 0x3c2190 [0046.753] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xb0) returned 0x3c2380 [0046.753] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a4) returned 0x3c2438 [0046.754] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3b5958, Size=0xa0) returned 0x3c27e8 [0046.754] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3c1490 [0046.754] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3b59d8, Size=0xa0) returned 0x3c2890 [0046.754] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3c2938 [0046.754] lstrlenA (lpString="VB") returned 2 [0046.754] lstrlenA (lpString="PropertyPage") returned 12 [0046.754] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3c2a70 [0046.754] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x190) returned 0x3c2e58 [0046.754] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x88) returned 0x3b5958 [0046.754] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x310) returned 0x3c2ff0 [0046.755] lstrcmpiA (lpString1="VB.MDIForm", lpString2="VB.PropertyPage") returned -1 [0046.755] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3c14b0 [0046.755] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3c3320 [0046.755] lstrlenA (lpString="VB") returned 2 [0046.755] lstrlenA (lpString="UserDocument") returned 12 [0046.755] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3c2a88 [0046.755] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1c8) returned 0x3c5308 [0046.755] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xa8) returned 0x3c54d8 [0046.755] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x370) returned 0x3c5588 [0046.755] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3c14d0 [0046.756] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x20) returned 0x3b59e8 [0046.781] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x170) returned 0x3c5900 [0046.783] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3c3448 [0046.796] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x12c) returned 0x3c5a78 [0046.796] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x24) returned 0x3b5a10 [0046.796] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3c14f0 [0046.852] RtlAllocateHeap (HeapHandle=0x3680000, Flags=0x8, Size=0x30) returned 0x36808f0 [0046.855] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xa0) returned 0x3c5bb0 [0046.855] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x28) returned 0x3c5c58 [0046.855] GetCurrentThreadId () returned 0xbb4 [0046.856] GetCurrentThreadId () returned 0xbb4 [0046.856] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x10) returned 0x3c2aa0 [0046.857] RtlAllocateHeap (HeapHandle=0x3680000, Flags=0x8, Size=0x30) returned 0x3680928 [0046.857] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xa0) returned 0x3c5c88 [0046.857] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x28) returned 0x3c5d30 [0046.857] GetCurrentThreadId () returned 0xbb4 [0046.858] GetCurrentThreadId () returned 0xbb4 [0046.858] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x10) returned 0x3c2ab8 [0046.858] RtlAllocateHeap (HeapHandle=0x3680000, Flags=0x8, Size=0x30) returned 0x3680960 [0046.858] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xa0) returned 0x3c5d60 [0046.858] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x28) returned 0x3c5e08 [0046.858] GetCurrentThreadId () returned 0xbb4 [0046.858] GetCurrentThreadId () returned 0xbb4 [0046.858] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x10) returned 0x3c2ad0 [0046.858] RtlAllocateHeap (HeapHandle=0x3680000, Flags=0x8, Size=0x30) returned 0x3680998 [0046.859] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xa0) returned 0x3c5e38 [0046.859] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x28) returned 0x3c5ee0 [0046.859] GetCurrentThreadId () returned 0xbb4 [0046.859] GetCurrentThreadId () returned 0xbb4 [0046.859] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x10) returned 0x3c2ae8 [0046.859] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3c3570 [0046.859] lstrlenA (lpString="VB") returned 2 [0046.859] lstrlenA (lpString="CheckBox") returned 8 [0046.859] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0x3c2b00 [0046.859] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x28) returned 0x3c5f10 [0046.859] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xec) returned 0x3c5f40 [0046.860] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x48) returned 0x3c6038 [0046.860] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1f8) returned 0x3c6088 [0046.860] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3c1510 [0046.860] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3c3698 [0046.861] lstrlenA (lpString="VB") returned 2 [0046.861] lstrlenA (lpString="OptionButton") returned 12 [0046.861] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3c2b18 [0046.861] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x28) returned 0x3c6288 [0046.861] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xd4) returned 0x3c62b8 [0046.861] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4c) returned 0x3c6398 [0046.861] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c8) returned 0x3c63f0 [0046.861] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c27e8, Size=0xc8) returned 0x3c65c0 [0046.861] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3c1530 [0046.861] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c2890, Size=0xc8) returned 0x3c6690 [0046.862] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3c37c0 [0046.862] lstrlenA (lpString="VB") returned 2 [0046.862] lstrlenA (lpString="ComboBox") returned 8 [0046.862] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc) returned 0x3c2b30 [0046.862] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x108) returned 0x3c27e8 [0046.862] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4c) returned 0x3c6760 [0046.862] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x230) returned 0x3c67b8 [0046.862] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3c1550 [0046.862] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3c38e8 [0046.863] lstrlenA (lpString="VB") returned 2 [0046.863] lstrlenA (lpString="HScrollBar") returned 10 [0046.863] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0x3c2b48 [0046.863] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x24) returned 0x3c28f8 [0046.863] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x90) returned 0x3c69f0 [0046.863] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x28) returned 0x3c6a88 [0046.863] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x144) returned 0x3c6ab8 [0046.863] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3c1570 [0046.864] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3c3a10 [0046.864] lstrlenA (lpString="VB") returned 2 [0046.864] lstrlenA (lpString="VScrollBar") returned 10 [0046.864] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0x3c2b60 [0046.864] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x24) returned 0x3c6c08 [0046.864] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x90) returned 0x3c6c38 [0046.864] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x28) returned 0x3c6cd0 [0046.864] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x144) returned 0x3c6d00 [0046.864] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3c1590 [0046.864] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3c3b38 [0046.864] lstrlenA (lpString="VB") returned 2 [0046.865] lstrlenA (lpString="DriveListBox") returned 12 [0046.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3c2b78 [0046.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x28) returned 0x3c6e50 [0046.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xc0) returned 0x3c6e80 [0046.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x40) returned 0x3c6f48 [0046.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1a0) returned 0x3c6f90 [0046.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3c15b0 [0046.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3c3c60 [0046.865] lstrlenA (lpString="VB") returned 2 [0046.865] lstrlenA (lpString="DirListBox") returned 10 [0046.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xe) returned 0x3c2b90 [0046.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x28) returned 0x3c7138 [0046.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xc8) returned 0x3c7168 [0046.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x50) returned 0x3c7238 [0046.865] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1b0) returned 0x3c7290 [0046.866] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c65c0, Size=0xf0) returned 0x3c7448 [0046.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3c15d0 [0046.866] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c6690, Size=0xf0) returned 0x3c7540 [0046.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3c3d88 [0046.866] lstrlenA (lpString="VB") returned 2 [0046.866] lstrlenA (lpString="Menu") returned 4 [0046.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0x3c2928 [0046.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x38) returned 0x3c65c0 [0046.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3b5a40 [0046.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xb8) returned 0x3c6600 [0046.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3c15f0 [0046.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3c3eb0 [0046.866] lstrlenA (lpString="VB") returned 2 [0046.866] lstrlenA (lpString="Shape") returned 5 [0046.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x9) returned 0x3c2ba8 [0046.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1c) returned 0x3c66c0 [0046.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x68) returned 0x3c66e8 [0046.866] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xfc) returned 0x3c7638 [0046.867] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3c1610 [0046.867] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3c3fd8 [0046.867] lstrlenA (lpString="VB") returned 2 [0046.867] lstrlenA (lpString="Line") returned 4 [0046.867] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0x3c7740 [0046.867] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x18) returned 0x3c1630 [0046.867] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x50) returned 0x3c7750 [0046.867] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xd0) returned 0x3c77a8 [0046.867] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3c1650 [0046.867] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3c4100 [0046.868] lstrlenA (lpString="VB") returned 2 [0046.868] lstrlenA (lpString="Data") returned 4 [0046.868] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x8) returned 0x3c7880 [0046.868] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xd8) returned 0x3c7890 [0046.868] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3c) returned 0x3c7970 [0046.868] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1d8) returned 0x3c79b8 [0046.868] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3c1670 [0046.868] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x114) returned 0x3c4228 [0046.868] lstrlenA (lpString="VB") returned 2 [0046.868] lstrlenA (lpString="OLE") returned 3 [0046.868] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7) returned 0x3c7b98 [0046.868] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x17c) returned 0x3c7ba8 [0046.868] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x40) returned 0x3c7d30 [0046.868] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x2f0) returned 0x3c7d78 [0046.869] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c7448, Size=0x118) returned 0x3c8070 [0046.869] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3c1690 [0046.869] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c7540, Size=0x118) returned 0x3c8190 [0046.882] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161d460 [0046.882] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161d4d0 [0046.882] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161d540 [0046.882] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161d5b0 [0046.882] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161d620 [0046.882] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161d690 [0046.882] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161d700 [0046.882] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161d770 [0046.882] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161d7e0 [0046.882] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161d850 [0046.882] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161d8c0 [0046.882] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161d930 [0046.882] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161d9a0 [0046.882] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161da10 [0046.882] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161da98 [0046.882] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161db08 [0046.883] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161db78 [0046.883] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161dbe8 [0046.883] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161dc58 [0046.883] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161dcc8 [0046.883] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161dd38 [0046.883] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161dda8 [0046.883] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x161de18 [0046.883] IMalloc:Alloc (This=0x767666bc, cb=0xc) returned 0x161cb08 [0046.883] IMalloc:Alloc (This=0x767666bc, cb=0x1e4) returned 0x161ea80 [0046.883] IMalloc:GetSize (This=0x767666bc, pv=0x161ea80) returned 0x1e4 [0046.883] IMalloc:Alloc (This=0x767666bc, cb=0x20) returned 0x1619670 [0046.884] GetCurrentThreadId () returned 0xbb4 [0046.884] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x54) returned 0x3c7448 [0046.884] GetCurrentThreadId () returned 0xbb4 [0046.884] IMalloc:Alloc (This=0x767666bc, cb=0x1c) returned 0x1619698 [0046.884] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x104) returned 0x3c74a8 [0046.885] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x6f8) returned 0x3c82b0 [0046.885] VirtualProtect (in: lpAddress=0x210000, dwSize=0x6000, flNewProtect=0x4, lpflOldProtect=0x18fdf8 | out: lpflOldProtect=0x18fdf8*=0x20) returned 1 [0046.885] GetCurrentProcess () returned 0xffffffff [0046.885] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x210000, dwSize=0x6000) returned 1 [0046.885] VirtualAlloc (lpAddress=0x210000, dwSize=0x7000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0046.885] VirtualAlloc (lpAddress=0x210000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0046.886] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xd4) returned 0x3c89b0 [0046.886] VirtualAlloc (lpAddress=0x210000, dwSize=0x9000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0046.886] VirtualAlloc (lpAddress=0x210000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0046.886] VirtualProtect (in: lpAddress=0x210000, dwSize=0xa000, flNewProtect=0x20, lpflOldProtect=0x18fdf8 | out: lpflOldProtect=0x18fdf8*=0x4) returned 1 [0046.906] GetCurrentProcess () returned 0xffffffff [0046.906] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x210000, dwSize=0xa000) returned 1 [0046.906] GetCurrentThreadId () returned 0xbb4 [0046.906] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x23ec) returned 0x3c8a90 [0046.922] GetCurrentThreadId () returned 0xbb4 [0046.922] SetWindowTextA (hWnd=0x6011a, lpString="xydo") returned 1 [0046.922] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0xc, wParam=0x0, lParam=0x18fd6c) returned 0x1 [0046.922] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\VBA\\Monitors", phkResult=0x18fd54 | out: phkResult=0x18fd54*=0x0) returned 0x2 [0046.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP", cchWideChar=5, lpMultiByteStr=0x18f9b4, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TEMP", lpUsedDefaultChar=0x0) returned 5 [0046.995] CompareStringA (Locale=0x0, dwCmpFlags=0x0, lpString1="", cchCount1=1, lpString2="", cchCount2=1) returned 2 [0046.995] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchCount1=4, lpString2="TEMP", cchCount2=4) returned 1 [0046.995] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchCount1=4, lpString2="TEMP", cchCount2=4) returned 2 [0046.995] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2e807a5, cbMultiByte=37, lpWideCharStr=0x161ec74, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 37 [0046.995] SysReAllocStringLen (in: pbstr=0x18fa44*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", psz=0x0, len=0x24 | out: pbstr=0x18fa44*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 1 [0046.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x18f48c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 37 [0046.995] GetFullPathNameA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", nBufferLength=0x104, lpBuffer=0x18f6c8, lpFilePart=0x18f484 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpFilePart=0x18f484*="Temp") returned 0x24 [0046.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x18f914, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 37 [0046.996] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpFindFileData=0x18f464 | out: lpFindFileData=0x18f464*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x197ccc20, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x197ccc20, ftLastWriteTime.dwHighDateTime=0x1d68e85, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x161ecc0, dwReserved1=0x1600000, cFileName="Temp", cAlternateFileName="")) returned 0x161ed20 [0046.996] FileTimeToLocalFileTime (in: lpFileTime=0x18f468, lpLocalFileTime=0x18f438 | out: lpLocalFileTime=0x18f438) returned 1 [0046.996] FileTimeToSystemTime (in: lpFileTime=0x18f438, lpSystemTime=0x18f440 | out: lpSystemTime=0x18f440) returned 1 [0046.998] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="OS=Windows_NT", cchCount1=2, lpString2="TZ", cchCount2=2) returned 1 [0046.998] GetTimeZoneInformation (in: lpTimeZoneInformation=0x72a50f68 | out: lpTimeZoneInformation=0x72a50f68) returned 0x1 [0047.002] FileTimeToLocalFileTime (in: lpFileTime=0x18f470, lpLocalFileTime=0x18f438 | out: lpLocalFileTime=0x18f438) returned 1 [0047.002] FileTimeToSystemTime (in: lpFileTime=0x18f438, lpSystemTime=0x18f440 | out: lpSystemTime=0x18f440) returned 1 [0047.002] FileTimeToLocalFileTime (in: lpFileTime=0x18f478, lpLocalFileTime=0x18f438 | out: lpLocalFileTime=0x18f438) returned 1 [0047.002] FileTimeToSystemTime (in: lpFileTime=0x18f438, lpSystemTime=0x18f440 | out: lpSystemTime=0x18f440) returned 1 [0047.002] FindNextFileA (in: hFindFile=0x161ed20, lpFindFileData=0x18f464 | out: lpFindFileData=0x18f464*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x197ccc20, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x197ccc20, ftLastWriteTime.dwHighDateTime=0x1d68e85, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x161ecc0, dwReserved1=0x1600000, cFileName="Temp", cAlternateFileName="")) returned 0 [0047.003] GetLastError () returned 0x12 [0047.003] GetLastError () returned 0x12 [0047.003] SetLastError (dwErrCode=0x12) [0047.003] FindClose (in: hFindFile=0x161ed20 | out: hFindFile=0x161ed20) returned 1 [0047.003] GetLastError () returned 0x12 [0047.003] SetLastError (dwErrCode=0x12) [0047.035] VarBstrCmp (bstrLeft="", bstrRight="", lcid=0x0, dwFlags=0x30001) returned 0x1 [0047.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP", cchWideChar=5, lpMultiByteStr=0x18f9b4, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TEMP", lpUsedDefaultChar=0x0) returned 5 [0047.035] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchCount1=4, lpString2="TEMP", cchCount2=4) returned 1 [0047.035] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchCount1=4, lpString2="TEMP", cchCount2=4) returned 2 [0047.035] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2e807a5, cbMultiByte=37, lpWideCharStr=0x161f284, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 37 [0047.035] SysReAllocStringLen (in: pbstr=0x18fa44*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", psz=0x0, len=0x24 | out: pbstr=0x18fa44*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 1 [0047.036] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0047.056] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0047.056] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0047.056] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x0 [0047.056] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0047.057] VarBstrCmp (bstrLeft="C:\\Users\\5P5NRG~1\\AppData\\Local", bstrRight="", lcid=0x0, dwFlags=0x30001) returned 0x2 [0047.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\", cchWideChar=-1, lpMultiByteStr=0x18f3c4, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\", lpUsedDefaultChar=0x0) returned 33 [0047.057] GetFullPathNameA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\", nBufferLength=0x104, lpBuffer=0x18f600, lpFilePart=0x18f3bc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\", lpFilePart=0x18f3bc*=0x0) returned 0x20 [0047.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\", cchWideChar=-1, lpMultiByteStr=0x18f84c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\", lpUsedDefaultChar=0x0) returned 33 [0047.057] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\*.*", lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x161f2d0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x161ed20 [0047.057] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f370 | out: lpLocalFileTime=0x18f370) returned 1 [0047.057] FileTimeToSystemTime (in: lpFileTime=0x18f370, lpSystemTime=0x18f378 | out: lpSystemTime=0x18f378) returned 1 [0047.057] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f370 | out: lpLocalFileTime=0x18f370) returned 1 [0047.057] FileTimeToSystemTime (in: lpFileTime=0x18f370, lpSystemTime=0x18f378 | out: lpSystemTime=0x18f378) returned 1 [0047.058] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f370 | out: lpLocalFileTime=0x18f370) returned 1 [0047.058] FileTimeToSystemTime (in: lpFileTime=0x18f370, lpSystemTime=0x18f378 | out: lpSystemTime=0x18f378) returned 1 [0047.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f728, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0047.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f728, cbMultiByte=-1, lpWideCharStr=0x161cb24, cchWideChar=2 | out: lpWideCharStr=".") returned 2 [0047.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x18f86c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 37 [0047.058] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp"), lpSecurityAttributes=0x0) returned 0 [0047.058] GetLastError () returned 0xb7 [0047.058] GetLastError () returned 0xb7 [0047.058] SetLastError (dwErrCode=0xb7) [0047.058] GetLastError () returned 0xb7 [0047.058] SetLastError (dwErrCode=0xb7) [0047.058] GetLastError () returned 0xb7 [0047.058] SetLastError (dwErrCode=0xb7) [0047.058] GetLastError () returned 0xb7 [0047.059] SetLastError (dwErrCode=0xb7) [0047.059] GetLastError () returned 0xb7 [0047.059] SetLastError (dwErrCode=0xb7) [0047.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0047.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x161cb24, cchWideChar=5 | out: lpWideCharStr="xyno") returned 5 [0047.073] RaiseException (dwExceptionCode=0xc000008f, dwExceptionFlags=0x1, nNumberOfArguments=0x2, lpArguments=0x18f828) [0047.089] RtlUnwind (TargetFrame=0x18fa28, TargetIp=0x72a43caf, ExceptionRecord=0x0, ReturnValue=0x0) [0047.090] SysStringLen (param_1=" ") returned 0xff [0047.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=255, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 255 [0047.090] SysStringLen (param_1=" ") returned 0xff [0047.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=256, lpMultiByteStr=0x161f4f4, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 256 [0047.090] SetErrorMode (uMode=0x8001) returned 0x8001 [0047.090] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77710000 [0047.090] SetErrorMode (uMode=0x8001) returned 0x8001 [0047.091] GetProcAddress (hModule=0x77710000, lpProcName="GetUserNameA") returned 0x7773a4b4 [0047.091] GetUserNameA (in: lpBuffer=0x161f4f4, pcbBuffer=0x18fa24 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18fa24) returned 1 [0047.095] GetLastError () returned 0x0 [0047.095] SysStringByteLen (bstr="瀵丵䝲湊樰⁓䅈偌捭穸 †††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††† ") returned 0xff [0047.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x161f4f4, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0047.095] SysStringByteLen (bstr="瀵丵䝲湊樰⁓䅈偌捭穸 †††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††† ") returned 0xff [0047.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x161f4f4, cbMultiByte=256, lpWideCharStr=0x161f2dc, cchWideChar=511 | out: lpWideCharStr="5p5NrGJn0jS HALPmcxz") returned 256 [0047.095] CharLowerBuffW (in: lpsz="5p5NrGJn0jS HALPmcxz", cchLength=0x15 | out: lpsz="5p5nrgjn0js halpmcxz") returned 0x15 [0047.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18f98c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0047.096] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0047.096] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0047.096] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0047.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2e8077c, cbMultiByte=3, lpWideCharStr=0x161fc84, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0047.096] SysReAllocStringLen (in: pbstr=0x18fa1c*="C:", psz=0x0, len=0x2 | out: pbstr=0x18fa1c*="C:") returned 1 [0047.096] VarCat (in: pvarLeft=0x18fce0, pvarRight=0x18fc30, pvarResult=0x18fcd0 | out: pvarResult=0x18fcd0) returned 0x0 [0047.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x18f48c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData", lpUsedDefaultChar=0x0) returned 15 [0047.096] GetFullPathNameA (in: lpFileName="C:\\ProgramData", nBufferLength=0x104, lpBuffer=0x18f6c8, lpFilePart=0x18f484 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x18f484*="ProgramData") returned 0xe [0047.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x18f914, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData", lpUsedDefaultChar=0x0) returned 15 [0047.097] FindClose (in: hFindFile=0x161ed20 | out: hFindFile=0x161ed20) returned 1 [0047.097] FindFirstFileA (in: lpFileName="C:\\ProgramData", lpFindFileData=0x18f464 | out: lpFindFileData=0x18f464*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x161ed20 [0047.097] FileTimeToLocalFileTime (in: lpFileTime=0x18f468, lpLocalFileTime=0x18f438 | out: lpLocalFileTime=0x18f438) returned 1 [0047.097] FileTimeToSystemTime (in: lpFileTime=0x18f438, lpSystemTime=0x18f440 | out: lpSystemTime=0x18f440) returned 1 [0047.097] FileTimeToLocalFileTime (in: lpFileTime=0x18f470, lpLocalFileTime=0x18f438 | out: lpLocalFileTime=0x18f438) returned 1 [0047.098] FileTimeToSystemTime (in: lpFileTime=0x18f438, lpSystemTime=0x18f440 | out: lpSystemTime=0x18f440) returned 1 [0047.098] FileTimeToLocalFileTime (in: lpFileTime=0x18f478, lpLocalFileTime=0x18f438 | out: lpLocalFileTime=0x18f438) returned 1 [0047.098] FileTimeToSystemTime (in: lpFileTime=0x18f438, lpSystemTime=0x18f440 | out: lpSystemTime=0x18f440) returned 1 [0047.098] FindNextFileA (in: hFindFile=0x161ed20, lpFindFileData=0x18f464 | out: lpFindFileData=0x18f464*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0047.098] GetLastError () returned 0x12 [0047.098] GetLastError () returned 0x12 [0047.099] SetLastError (dwErrCode=0x12) [0047.099] FindClose (in: hFindFile=0x161ed20 | out: hFindFile=0x161ed20) returned 1 [0047.099] GetLastError () returned 0x12 [0047.099] SetLastError (dwErrCode=0x12) [0047.099] VarBstrCmp (bstrLeft="", bstrRight="", lcid=0x0, dwFlags=0x30001) returned 0x1 [0047.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18f98c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0047.100] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0047.100] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0047.100] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0047.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2e8077c, cbMultiByte=3, lpWideCharStr=0x161fc84, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0047.100] SysReAllocStringLen (in: pbstr=0x18fa1c*="C:", psz=0x0, len=0x2 | out: pbstr=0x18fa1c*="C:") returned 1 [0047.100] VarCat (in: pvarLeft=0x18fce0, pvarRight=0x18fc30, pvarResult=0x18fcd0 | out: pvarResult=0x18fcd0) returned 0x0 [0047.100] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0047.100] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0047.101] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0047.101] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x0 [0047.101] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0047.101] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0047.101] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0047.101] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0047.102] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0047.102] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0047.102] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x0 [0047.102] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0047.102] VarBstrCmp (bstrLeft="C:", bstrRight="", lcid=0x0, dwFlags=0x30001) returned 0x2 [0047.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\", cchWideChar=-1, lpMultiByteStr=0x18f3c4, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\", lpUsedDefaultChar=0x0) returned 4 [0047.103] GetFullPathNameA (in: lpFileName="C:\\", nBufferLength=0x104, lpBuffer=0x18f600, lpFilePart=0x18f3bc | out: lpBuffer="C:\\", lpFilePart=0x18f3bc*=0x0) returned 0x3 [0047.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\", cchWideChar=-1, lpMultiByteStr=0x18f84c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\", lpUsedDefaultChar=0x0) returned 4 [0047.103] FindFirstFileA (in: lpFileName="C:\\*.*", lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77cd6ab7, dwReserved1=0x161ed20, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x161ed20 [0047.103] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f370 | out: lpLocalFileTime=0x18f370) returned 1 [0047.103] FileTimeToSystemTime (in: lpFileTime=0x18f370, lpSystemTime=0x18f378 | out: lpSystemTime=0x18f378) returned 1 [0047.103] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f370 | out: lpLocalFileTime=0x18f370) returned 1 [0047.103] FileTimeToSystemTime (in: lpFileTime=0x18f370, lpSystemTime=0x18f378 | out: lpSystemTime=0x18f378) returned 1 [0047.104] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f370 | out: lpLocalFileTime=0x18f370) returned 1 [0047.104] FileTimeToSystemTime (in: lpFileTime=0x18f370, lpSystemTime=0x18f378 | out: lpSystemTime=0x18f378) returned 1 [0047.108] FindNextFileA (in: hFindFile=0x161ed20, lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x161ed20, dwReserved1=0x520024, cFileName="Boot", cAlternateFileName="")) returned 1 [0047.108] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.108] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.108] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.108] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.108] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.108] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.108] FindNextFileA (in: hFindFile=0x161ed20, lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x161ed20, dwReserved1=0x520024, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0047.109] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.109] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.109] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.109] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.109] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.109] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.109] FindNextFileA (in: hFindFile=0x161ed20, lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x161ed20, dwReserved1=0x520024, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0047.109] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.109] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.109] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.109] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.110] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.110] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.110] FindNextFileA (in: hFindFile=0x161ed20, lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x161ed20, dwReserved1=0x520024, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0047.110] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.110] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.110] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.110] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.110] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.110] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.110] FindNextFileA (in: hFindFile=0x161ed20, lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x520024, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0047.110] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.110] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.111] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.111] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.111] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.111] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.111] FindNextFileA (in: hFindFile=0x161ed20, lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x520024, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0047.111] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.111] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.116] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.116] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.117] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.117] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.117] FindNextFileA (in: hFindFile=0x161ed20, lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x520024, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0047.117] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.117] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.117] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.117] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.117] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.117] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.117] FindNextFileA (in: hFindFile=0x161ed20, lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xaece4da0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x520024, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0047.117] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.117] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.117] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.118] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.118] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.118] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.118] FindNextFileA (in: hFindFile=0x161ed20, lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x520024, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0047.118] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.118] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.118] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.118] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.118] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0047.119] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0047.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f728, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0047.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f728, cbMultiByte=-1, lpWideCharStr=0x161fc84, cchWideChar=9 | out: lpWideCharStr="PerfLogs") returned 9 [0047.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x18f86c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData", lpUsedDefaultChar=0x0) returned 15 [0047.119] CreateDirectoryA (lpPathName="C:\\ProgramData" (normalized: "c:\\programdata"), lpSecurityAttributes=0x0) returned 0 [0047.120] GetLastError () returned 0xb7 [0047.120] GetLastError () returned 0xb7 [0047.120] SetLastError (dwErrCode=0xb7) [0047.120] GetLastError () returned 0xb7 [0047.120] SetLastError (dwErrCode=0xb7) [0047.120] GetLastError () returned 0xb7 [0047.120] SetLastError (dwErrCode=0xb7) [0047.120] GetLastError () returned 0xb7 [0047.120] SetLastError (dwErrCode=0xb7) [0047.121] GetLastError () returned 0xb7 [0047.121] SetLastError (dwErrCode=0xb7) [0047.121] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0047.121] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x161fc84, cchWideChar=5 | out: lpWideCharStr="xyno") returned 5 [0047.121] RaiseException (dwExceptionCode=0xc000008f, dwExceptionFlags=0x1, nNumberOfArguments=0x2, lpArguments=0x18f828) [0047.121] RtlUnwind (TargetFrame=0x18fa28, TargetIp=0x72a43caf, ExceptionRecord=0x0, ReturnValue=0x0) [0047.122] SetErrorMode (uMode=0x8001) returned 0x8001 [0047.122] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0047.122] SetErrorMode (uMode=0x8001) returned 0x8001 [0047.123] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersionExW") returned 0x76d41ae5 [0047.123] GetVersionExW (in: lpVersionInformation=0x18f918*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x18f918*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0047.123] GetLastError () returned 0x0 [0047.125] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xfc) returned 0x3cae88 [0047.125] GetVersionExA (in: lpVersionInformation=0x18f8c4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x118f918, dwMinorVersion=0x18f814, dwBuildNumber=0x76d41ae5, dwPlatformId=0x18fd3c, szCSDVersion="Í\x1eËwWS\x13") | out: lpVersionInformation=0x18f8c4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0047.125] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0047.125] GetCurrentThreadId () returned 0xbb4 [0047.126] GetCurrentThreadId () returned 0xbb4 [0047.126] GetCurrentThreadId () returned 0xbb4 [0047.126] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x5) returned 0x3c75b8 [0047.126] SetWindowTextA (hWnd=0x6011a, lpString="xydo") returned 1 [0047.126] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0xc, wParam=0x0, lParam=0x3c75b8) returned 0x1 [0047.126] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1) returned 0x3c75c8 [0047.126] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x5) returned 0x3c75d8 [0047.127] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x5) returned 0x3c75e8 [0047.127] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x15) returned 0x3c16b0 [0047.129] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18f8b0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhang.exe")) returned 0x2f [0047.129] lstrcpynA (in: lpString1=0x18f79c, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" [0047.129] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe") returned 47 [0047.129] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0x3c75f8 [0047.129] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0x3caf90 [0047.129] lstrcpyA (in: lpString1=0x3c75f8, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" [0047.132] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0x3cafe0 [0047.132] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3caf90 | out: hHeap=0x3b0000) returned 1 [0047.132] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c75f8 | out: hHeap=0x3b0000) returned 1 [0047.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3cafe0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0047.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3cafe0, cbMultiByte=-1, lpWideCharStr=0x161eccc, cchWideChar=38 | out: lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 38 [0047.132] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cafe0 | out: hHeap=0x3b0000) returned 1 [0047.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18f98c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0047.132] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0047.132] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0047.132] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0047.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2e8077c, cbMultiByte=3, lpWideCharStr=0x161fb6c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0047.132] SysReAllocStringLen (in: pbstr=0x18fa1c*="C:", psz=0x0, len=0x2 | out: pbstr=0x18fa1c*="C:") returned 1 [0047.132] VarCat (in: pvarLeft=0x18fce0, pvarRight=0x18fc30, pvarResult=0x18fcd0 | out: pvarResult=0x18fcd0) returned 0x0 [0047.132] VarCmp (pvarLeft=0x18fcc0, pvarRight=0x18fcd0, lcid=0x0, dwFlags=0x30001) returned 0x2 [0047.132] VarNot (in: pvarIn=0x18fcb0, pvarResult=0x18fca0 | out: pvarResult=0x18fca0) returned 0x0 [0047.133] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18f8b0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhang.exe")) returned 0x2f [0047.133] lstrcpynA (in: lpString1=0x18f79c, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" [0047.133] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe") returned 47 [0047.133] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0x3caf90 [0047.133] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0x3c75f8 [0047.133] lstrcpyA (in: lpString1=0x3caf90, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" [0047.135] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0x3cafe0 [0047.135] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c75f8 | out: hHeap=0x3b0000) returned 1 [0047.135] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3caf90 | out: hHeap=0x3b0000) returned 1 [0047.135] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3cafe0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0047.135] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3cafe0, cbMultiByte=-1, lpWideCharStr=0x161eccc, cchWideChar=38 | out: lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 38 [0047.135] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cafe0 | out: hHeap=0x3b0000) returned 1 [0047.135] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18f8b0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhang.exe")) returned 0x2f [0047.135] lstrcpynA (in: lpString1=0x18f79c, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" [0047.135] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe") returned 47 [0047.135] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0x3caf90 [0047.135] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0x3c75f8 [0047.135] lstrcpyA (in: lpString1=0x3caf90, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" [0047.137] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0x3cb7c8 [0047.137] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c75f8 | out: hHeap=0x3b0000) returned 1 [0047.137] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3caf90 | out: hHeap=0x3b0000) returned 1 [0047.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3cb7c8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0047.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3cb7c8, cbMultiByte=-1, lpWideCharStr=0x161fc84, cchWideChar=6 | out: lpWideCharStr="zhang") returned 6 [0047.137] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb7c8 | out: hHeap=0x3b0000) returned 1 [0047.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18f98c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0047.138] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0047.138] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0047.138] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0047.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2e8077c, cbMultiByte=3, lpWideCharStr=0x161fcac, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0047.139] SysReAllocStringLen (in: pbstr=0x18fa1c*="C:", psz=0x0, len=0x2 | out: pbstr=0x18fa1c*="C:") returned 1 [0047.139] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18f8b0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhang.exe")) returned 0x2f [0047.139] lstrcpynA (in: lpString1=0x18f79c, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" [0047.139] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe") returned 47 [0047.139] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0x3caf90 [0047.139] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0x3c75f8 [0047.139] lstrcpyA (in: lpString1=0x3caf90, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" [0047.141] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0x3cb7c8 [0047.141] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c75f8 | out: hHeap=0x3b0000) returned 1 [0047.141] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3caf90 | out: hHeap=0x3b0000) returned 1 [0047.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3cb7c8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0047.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3cb7c8, cbMultiByte=-1, lpWideCharStr=0x161cb3c, cchWideChar=6 | out: lpWideCharStr="zhang") returned 6 [0047.141] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb7c8 | out: hHeap=0x3b0000) returned 1 [0047.141] VarCat (in: pvarLeft=0x18fce0, pvarRight=0x18fc30, pvarResult=0x18fcd0 | out: pvarResult=0x18fcd0) returned 0x0 [0047.141] VarCat (in: pvarLeft=0x18fcd0, pvarRight=0x18fcc0, pvarResult=0x18fcb0 | out: pvarResult=0x18fcb0) returned 0x0 [0047.141] VarCat (in: pvarLeft=0x18fcb0, pvarRight=0x18fc20, pvarResult=0x18fca0 | out: pvarResult=0x18fca0) returned 0x0 [0047.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\zhang.exe", cchWideChar=-1, lpMultiByteStr=0x18f6f4, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\zhang.exe", lpUsedDefaultChar=0x0) returned 25 [0047.142] GetFullPathNameA (in: lpFileName="C:\\ProgramData\\zhang.exe", nBufferLength=0x104, lpBuffer=0x18f934, lpFilePart=0x18f6ec | out: lpBuffer="C:\\ProgramData\\zhang.exe", lpFilePart=0x18f6ec*="zhang.exe") returned 0x18 [0047.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe", cchWideChar=-1, lpMultiByteStr=0x18f6f4, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe", lpUsedDefaultChar=0x0) returned 48 [0047.142] GetFullPathNameA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe", nBufferLength=0x104, lpBuffer=0x18f82c, lpFilePart=0x18f6ec | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe", lpFilePart=0x18f6ec*="zhang.exe") returned 0x2f [0047.142] IMalloc:Alloc (This=0x767666bc, cb=0xfe00) returned 0x1624840 [0047.143] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhang.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x18f7ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0047.143] GetFileType (hFile=0xdc) returned 0x1 [0047.143] CreateFileA (lpFileName="C:\\ProgramData\\zhang.exe" (normalized: "c:\\programdata\\zhang.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f7ec, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0047.147] GetFileType (hFile=0xe0) returned 0x1 [0047.147] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.153] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.155] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.155] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.158] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.158] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.160] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.160] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.161] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.162] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.173] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.173] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.174] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.174] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.176] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.176] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.180] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.181] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.182] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.183] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.184] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.184] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.186] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.186] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.187] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.188] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.190] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.191] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.192] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.192] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.193] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.194] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.195] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.211] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.217] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.217] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.223] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.224] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.225] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.225] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.227] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.227] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.229] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.230] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.231] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.231] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.234] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.235] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.236] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.237] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.239] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.239] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.240] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.241] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.242] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.242] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.243] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.244] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.246] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.246] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.248] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.248] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.249] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.250] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.251] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.260] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.264] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.265] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.266] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.266] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.267] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.268] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.269] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.270] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.272] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.272] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.274] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.274] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.275] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.276] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.277] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.281] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.284] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.284] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.293] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.293] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.295] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.295] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.297] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.299] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.301] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.302] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.303] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.304] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.306] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.306] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.309] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.319] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.324] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.325] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.326] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.326] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.328] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.328] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.329] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.330] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.332] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.332] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.334] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.334] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.335] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.336] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.337] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.338] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.341] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.341] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.343] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.343] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.344] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.344] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.346] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.347] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.349] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.349] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.351] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.351] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.353] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.353] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.354] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.364] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.369] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.369] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.371] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.371] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.373] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.373] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.374] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.376] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.378] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.378] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.379] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.380] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.381] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.381] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.382] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.383] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.385] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.386] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.387] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.387] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.389] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.389] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.390] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.391] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.393] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.393] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.395] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.395] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.396] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.397] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.398] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.410] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.415] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.416] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.417] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.417] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.419] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.420] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.421] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.422] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.423] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.424] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.425] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.426] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.427] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.427] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.428] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.429] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.431] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.431] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.433] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.433] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.435] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.435] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.436] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.437] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.439] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.440] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.441] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.441] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.443] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.443] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.444] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.454] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.459] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.459] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.460] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.460] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.461] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.462] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.463] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.464] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.466] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.466] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.467] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.468] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.469] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.469] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.471] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.472] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.474] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.475] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.476] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.476] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.478] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.478] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.480] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.513] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.515] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.515] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.516] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.517] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.518] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.518] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.519] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.529] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.534] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xfe00, lpOverlapped=0x0) returned 1 [0047.534] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xfe00, lpOverlapped=0x0) returned 1 [0047.536] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0xa200, lpOverlapped=0x0) returned 1 [0047.536] WriteFile (in: hFile=0xe0, lpBuffer=0x1624840*, nNumberOfBytesToWrite=0xa200, lpNumberOfBytesWritten=0x18f3d8, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesWritten=0x18f3d8*=0xa200, lpOverlapped=0x0) returned 1 [0047.537] ReadFile (in: hFile=0xdc, lpBuffer=0x1624840, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1624840*, lpNumberOfBytesRead=0x18f7e0*=0x0, lpOverlapped=0x0) returned 1 [0047.537] CloseHandle (hObject=0xe0) returned 1 [0047.715] CloseHandle (hObject=0xdc) returned 1 [0047.715] IMalloc:Free (This=0x767666bc, pv=0x1624840) [0047.715] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhang.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0047.716] CreateFileA (lpFileName="C:\\ProgramData\\zhang.exe" (normalized: "c:\\programdata\\zhang.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0047.716] GetFileTime (in: hFile=0xdc, lpCreationTime=0x18f7f4, lpLastAccessTime=0x18f7fc, lpLastWriteTime=0x18f804 | out: lpCreationTime=0x18f7f4*(dwLowDateTime=0x2a26500, dwHighDateTime=0x1d68e85), lpLastAccessTime=0x18f7fc*(dwLowDateTime=0x2a26500, dwHighDateTime=0x1d68e85), lpLastWriteTime=0x18f804*(dwLowDateTime=0x79d1fc00, dwHighDateTime=0x1d68e79)) returned 1 [0047.716] SetFileTime (hFile=0xe0, lpCreationTime=0x18f7f4, lpLastAccessTime=0x18f7fc, lpLastWriteTime=0x18f804) returned 1 [0047.716] CloseHandle (hObject=0xdc) returned 1 [0047.716] CloseHandle (hObject=0xe0) returned 1 [0047.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18f98c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0047.717] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0047.717] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0047.717] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0047.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2e8077c, cbMultiByte=3, lpWideCharStr=0x161fb6c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0047.718] SysReAllocStringLen (in: pbstr=0x18fa1c*="C:", psz=0x0, len=0x2 | out: pbstr=0x18fa1c*="C:") returned 1 [0047.718] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18f8b0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zhang.exe")) returned 0x2f [0047.718] lstrcpynA (in: lpString1=0x18f79c, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" [0047.718] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe") returned 47 [0047.718] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0x3caf90 [0047.718] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0x3c75f8 [0047.718] lstrcpyA (in: lpString1=0x3caf90, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zhang.exe" [0047.718] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6) returned 0x3cb7c8 [0047.718] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c75f8 | out: hHeap=0x3b0000) returned 1 [0047.718] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3caf90 | out: hHeap=0x3b0000) returned 1 [0047.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3cb7c8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0047.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3cb7c8, cbMultiByte=-1, lpWideCharStr=0x161cb24, cchWideChar=6 | out: lpWideCharStr="zhang") returned 6 [0047.719] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb7c8 | out: hHeap=0x3b0000) returned 1 [0047.719] VarCat (in: pvarLeft=0x18fce0, pvarRight=0x18fc30, pvarResult=0x18fcd0 | out: pvarResult=0x18fcd0) returned 0x0 [0047.719] VarCat (in: pvarLeft=0x18fcd0, pvarRight=0x18fcc0, pvarResult=0x18fcb0 | out: pvarResult=0x18fcb0) returned 0x0 [0047.719] VarCat (in: pvarLeft=0x18fcb0, pvarRight=0x18fc20, pvarResult=0x18fca0 | out: pvarResult=0x18fca0) returned 0x0 [0047.719] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\ProgramData\\zhang.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18f9f0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fa34 | out: lpCommandLine="C:\\ProgramData\\zhang.exe", lpProcessInformation=0x18fa34*(hProcess=0xdc, hThread=0xe0, dwProcessId=0xa90, dwThreadId=0xa94)) returned 1 [0048.352] GetLastError () returned 0x715 [0048.352] WaitForInputIdle (hProcess=0xdc, dwMilliseconds=0x2710) returned 0x0 [0054.474] CloseHandle (hObject=0xe0) returned 1 [0054.474] CloseHandle (hObject=0xdc) returned 1 [0054.475] GetCurrentThreadId () returned 0xbb4 [0054.475] GetCurrentThreadId () returned 0xbb4 [0054.475] lstrcmpiA (lpString1="MSWinsockLib.Winsock", lpString2="MSWinsockLib.Winsock") returned 0 [0054.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0054.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x161fc84, cchWideChar=5 | out: lpWideCharStr="xyno") returned 5 [0054.476] RaiseException (dwExceptionCode=0xc000008f, dwExceptionFlags=0x1, nNumberOfArguments=0x2, lpArguments=0x18fa18) [0054.477] RtlUnwind (TargetFrame=0x18fe70, TargetIp=0x72a43bb5, ExceptionRecord=0x0, ReturnValue=0x0) [0054.477] GetCurrentThreadId () returned 0xbb4 [0054.477] GetCurrentThreadId () returned 0xbb4 [0054.477] lstrcmpiA (lpString1="MSWinsockLib.Winsock", lpString2="MSWinsockLib.Winsock") returned 0 [0054.478] GetCurrentThreadId () returned 0xbb4 [0054.478] GetCurrentThreadId () returned 0xbb4 [0054.478] GetCurrentThreadId () returned 0xbb4 [0054.478] GetCurrentThreadId () returned 0xbb4 [0054.478] GetCurrentThreadId () returned 0xbb4 [0054.478] PostMessageA (hWnd=0x6011a, Msg=0x0, wParam=0x0, lParam=0x0) returned 1 [0054.481] FreeLibrary (hLibModule=0x77710000) returned 1 [0054.482] FreeLibrary (hLibModule=0x76d30000) returned 1 [0054.485] FindClose (in: hFindFile=0x161ed20 | out: hFindFile=0x161ed20) returned 1 [0054.485] GetCurrentThreadId () returned 0xbb4 [0054.486] SendMessageA (hWnd=0x6011a, Msg=0x1050, wParam=0x0, lParam=0x0) returned 0x0 [0054.486] GetCurrentThreadId () returned 0xbb4 [0054.486] GetCurrentThreadId () returned 0xbb4 [0054.486] GetCurrentThreadId () returned 0xbb4 [0054.486] GetCurrentThreadId () returned 0xbb4 [0054.486] GetCurrentThreadId () returned 0xbb4 [0054.486] GetCurrentThreadId () returned 0xbb4 [0054.486] GetCurrentThreadId () returned 0xbb4 [0054.487] GetCurrentThreadId () returned 0xbb4 [0054.487] GetCurrentThreadId () returned 0xbb4 [0054.487] GetCurrentThreadId () returned 0xbb4 [0054.487] GetCurrentThreadId () returned 0xbb4 [0054.487] GetCurrentThreadId () returned 0xbb4 [0054.487] GetCurrentThreadId () returned 0xbb4 [0054.488] lstrcpyA (in: lpString1=0x18fa58, lpString2="" | out: lpString1="") returned="" [0054.488] lstrlenA (lpString="") returned 0 [0054.488] lstrcpyA (in: lpString1=0x18f850, lpString2="" | out: lpString1="") returned="" [0054.488] lstrcpynA (in: lpString1=0x18f428, lpString2="", iMaxLength=260 | out: lpString1="") returned="" [0054.488] lstrlenA (lpString="") returned 0 [0054.488] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1) returned 0x3caf90 [0054.488] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1) returned 0x3cafa0 [0054.488] lstrcpyA (in: lpString1=0x3caf90, lpString2="" | out: lpString1="") returned="" [0054.488] lstrlenA (lpString="") returned 0 [0054.488] lstrlenA (lpString=".HLP") returned 4 [0054.488] lstrcpyA (in: lpString1=0x18f544, lpString2="" | out: lpString1="") returned="" [0054.488] lstrcatA (in: lpString1="", lpString2=".HLP" | out: lpString1=".HLP") returned=".HLP" [0054.489] lstrcpynA (in: lpString1=0x18f308, lpString2=".HLP", iMaxLength=260 | out: lpString1=".HLP") returned=".HLP" [0054.489] lstrlenA (lpString=".HLP") returned 4 [0054.489] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3caf90, Size=0x5) returned 0x3caf90 [0054.489] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3cafa0, Size=0x5) returned 0x3cafa0 [0054.489] lstrcpyA (in: lpString1=0x3caf90, lpString2=".HLP" | out: lpString1=".HLP") returned=".HLP" [0054.489] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows", ulOptions=0x0, samDesired=0x20019, phkResult=0x18f3f8 | out: phkResult=0x18f3f8*=0xb4) returned 0x0 [0054.490] RegOpenKeyExA (in: hKey=0xb4, lpSubKey="HTML Help", ulOptions=0x0, samDesired=0x20019, phkResult=0x18f3fc | out: phkResult=0x18f3fc*=0xdc) returned 0x0 [0054.490] RegQueryValueExA (in: hKey=0xdc, lpValueName=".HLP", lpReserved=0x0, lpType=0x0, lpData=0x3cb7c8, lpcbData=0x18f3f4*=0x104 | out: lpType=0x0, lpData=0x3cb7c8*=0xc4, lpcbData=0x18f3f4*=0x104) returned 0x2 [0054.490] RegCloseKey (hKey=0xdc) returned 0x0 [0054.490] RegCloseKey (hKey=0xb4) returned 0x0 [0054.490] GetPrivateProfileStringA (in: lpAppName="FILES", lpKeyName=".HLP", lpDefault="", lpReturnedString=0x3cb7c8, nSize=0x104, lpFileName="WINHELP.INI" | out: lpReturnedString="") returned 0x0 [0054.491] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb7c8 | out: hHeap=0x3b0000) returned 1 [0054.491] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cafb0 | out: hHeap=0x3b0000) returned 1 [0054.491] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x105) returned 0x3cb7c8 [0054.491] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x5) returned 0x3cafb0 [0054.491] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows", ulOptions=0x0, samDesired=0x20019, phkResult=0x18f3f8 | out: phkResult=0x18f3f8*=0xb4) returned 0x0 [0054.491] RegOpenKeyExA (in: hKey=0xb4, lpSubKey="Help", ulOptions=0x0, samDesired=0x20019, phkResult=0x18f3fc | out: phkResult=0x18f3fc*=0x0) returned 0x2 [0054.491] RegCloseKey (hKey=0xb4) returned 0x0 [0054.491] GetPrivateProfileStringA (in: lpAppName="FILES", lpKeyName=".HLP", lpDefault="", lpReturnedString=0x3cb7c8, nSize=0x104, lpFileName="WINHELP.INI" | out: lpReturnedString="") returned 0x0 [0054.492] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb7c8 | out: hHeap=0x3b0000) returned 1 [0054.492] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cafb0 | out: hHeap=0x3b0000) returned 1 [0054.492] lstrcpynA (in: lpString1=0x18f2fc, lpString2="C:\\Windows\\system32", iMaxLength=260 | out: lpString1="C:\\Windows\\system32") returned="C:\\Windows\\system32" [0054.492] lstrlenA (lpString="C:\\Windows\\system32") returned 19 [0054.492] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3caf90, Size=0x14) returned 0x3c75f8 [0054.492] lstrlenA (lpString="C:\\Windows\\system32") returned 19 [0054.492] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3cafa0, Size=0x14) returned 0x3cafa0 [0054.492] lstrcpyA (in: lpString1=0x3c75f8, lpString2="C:\\Windows\\system32" | out: lpString1="C:\\Windows\\system32") returned="C:\\Windows\\system32" [0054.492] lstrcpynA (in: lpString1=0x18f304, lpString2=".HLP", iMaxLength=260 | out: lpString1=".HLP") returned=".HLP" [0054.492] lstrlenA (lpString=".HLP") returned 4 [0054.492] lstrlenA (lpString="C:\\Windows\\system32") returned 19 [0054.492] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c75f8, Size=0x19) returned 0x3c75f8 [0054.492] lstrlenA (lpString="C:\\Windows\\system32") returned 19 [0054.492] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3cafa0, Size=0x19) returned 0x3cafa0 [0054.492] lstrcatA (in: lpString1="C:\\Windows\\system32", lpString2="\\" | out: lpString1="C:\\Windows\\system32\\") returned="C:\\Windows\\system32\\" [0054.492] lstrcatA (in: lpString1="C:\\Windows\\system32\\", lpString2=".HLP" | out: lpString1="C:\\Windows\\system32\\.HLP") returned="C:\\Windows\\system32\\.HLP" [0054.492] lstrlenA (lpString="C:\\Windows\\system32\\.HLP") returned 24 [0054.492] CharToOemBuffA (in: lpszSrc="C:\\Windows\\system32\\.HLP", lpszDst=0x18f308, cchDstLength=0x19 | out: lpszDst="C:\\Windows\\system32\\.HLP") returned 1 [0054.493] GetFileAttributesA (lpFileName="C:\\Windows\\system32\\.HLP" (normalized: "c:\\windows\\system32\\.hlp")) returned 0xffffffff [0054.493] GetLastError () returned 0x2 [0054.493] GetLastError () returned 0x2 [0054.493] SetLastError (dwErrCode=0x2) [0054.493] GetLastError () returned 0x2 [0054.493] SetLastError (dwErrCode=0x2) [0054.493] GetFileAttributesA (lpFileName="C:\\Windows\\system32\\.HLP" (normalized: "c:\\windows\\system32\\.hlp")) returned 0xffffffff [0054.493] GetLastError () returned 0x2 [0054.493] GetLastError () returned 0x2 [0054.493] SetLastError (dwErrCode=0x2) [0054.493] GetLastError () returned 0x2 [0054.493] SetLastError (dwErrCode=0x2) [0054.493] GetWindowsDirectoryA (in: lpBuffer=0x18f424, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0054.493] lstrlenA (lpString="C:\\Windows") returned 10 [0054.493] lstrlenA (lpString="C:\\Windows") returned 10 [0054.493] lstrlenA (lpString="C:\\Windows\\") returned 11 [0054.494] lstrcpynA (in: lpString1=0x18f308, lpString2="C:\\Windows\\Help", iMaxLength=260 | out: lpString1="C:\\Windows\\Help") returned="C:\\Windows\\Help" [0054.494] lstrlenA (lpString="C:\\Windows\\Help") returned 15 [0054.494] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c75f8, Size=0x10) returned 0x3c75f8 [0054.494] lstrlenA (lpString="C:\\Windows\\Help") returned 15 [0054.494] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3cafa0, Size=0x10) returned 0x3cafa0 [0054.494] lstrcpyA (in: lpString1=0x3c75f8, lpString2="C:\\Windows\\Help" | out: lpString1="C:\\Windows\\Help") returned="C:\\Windows\\Help" [0054.494] lstrcpynA (in: lpString1=0x18f304, lpString2=".HLP", iMaxLength=260 | out: lpString1=".HLP") returned=".HLP" [0054.494] lstrlenA (lpString=".HLP") returned 4 [0054.494] lstrlenA (lpString="C:\\Windows\\Help") returned 15 [0054.494] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c75f8, Size=0x15) returned 0x3c75f8 [0054.494] lstrlenA (lpString="C:\\Windows\\Help") returned 15 [0054.494] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3cafa0, Size=0x15) returned 0x3cafa0 [0054.494] lstrcatA (in: lpString1="C:\\Windows\\Help", lpString2="\\" | out: lpString1="C:\\Windows\\Help\\") returned="C:\\Windows\\Help\\" [0054.494] lstrcatA (in: lpString1="C:\\Windows\\Help\\", lpString2=".HLP" | out: lpString1="C:\\Windows\\Help\\.HLP") returned="C:\\Windows\\Help\\.HLP" [0054.494] lstrlenA (lpString="C:\\Windows\\Help\\.HLP") returned 20 [0054.494] CharToOemBuffA (in: lpszSrc="C:\\Windows\\Help\\.HLP", lpszDst=0x18f308, cchDstLength=0x15 | out: lpszDst="C:\\Windows\\Help\\.HLP") returned 1 [0054.494] GetFileAttributesA (lpFileName="C:\\Windows\\Help\\.HLP" (normalized: "c:\\windows\\help\\.hlp")) returned 0xffffffff [0054.496] GetLastError () returned 0x2 [0054.496] GetLastError () returned 0x2 [0054.496] SetLastError (dwErrCode=0x2) [0054.496] GetLastError () returned 0x2 [0054.496] SetLastError (dwErrCode=0x2) [0054.496] GetFileAttributesA (lpFileName="C:\\Windows\\Help\\.HLP" (normalized: "c:\\windows\\help\\.hlp")) returned 0xffffffff [0054.497] GetLastError () returned 0x2 [0054.497] GetLastError () returned 0x2 [0054.497] SetLastError (dwErrCode=0x2) [0054.497] GetLastError () returned 0x2 [0054.497] SetLastError (dwErrCode=0x2) [0054.497] lstrlenA (lpString="") returned 0 [0054.497] lstrcpyA (in: lpString1=0x18f318, lpString2="" | out: lpString1="") returned="" [0054.497] lstrlenA (lpString=".HLP") returned 4 [0054.497] lstrlenA (lpString="") returned 0 [0054.497] lstrcpynA (in: lpString1=0x18f428, lpString2="", iMaxLength=260 | out: lpString1="") returned="" [0054.497] lstrlenA (lpString="") returned 0 [0054.497] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c75f8, Size=0x1) returned 0x3c75f8 [0054.497] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3cafa0, Size=0x1) returned 0x3cafa0 [0054.497] lstrcpyA (in: lpString1=0x3c75f8, lpString2="" | out: lpString1="") returned="" [0054.497] lstrcpyA (in: lpString1=0x18fa58, lpString2="" | out: lpString1="") returned="" [0054.497] lstrlenA (lpString="") returned 0 [0054.497] lstrlenA (lpString="") returned 0 [0054.497] lstrcatA (in: lpString1="", lpString2="" | out: lpString1="") returned="" [0054.498] GetDesktopWindow () returned 0x10010 [0054.498] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cafa0 | out: hHeap=0x3b0000) returned 1 [0054.498] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c75f8 | out: hHeap=0x3b0000) returned 1 [0054.507] CoFreeUnusedLibraries () [0054.508] GetCurrentThreadId () returned 0xbb4 [0054.508] DestroyWindow (hWnd=0x6011a) returned 1 [0054.508] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0054.508] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0x46, wParam=0x0, lParam=0x18fce8) returned 0x0 [0054.510] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0x47, wParam=0x0, lParam=0x18fce8) returned 0x0 [0054.510] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0054.510] NtdllDefWindowProc_A (hWnd=0x50114, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0054.510] NtdllDefWindowProc_A (hWnd=0x50114, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0054.511] PostQuitMessage (nExitCode=0) [0054.511] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0054.512] NtdllDefWindowProc_A (hWnd=0x6011a, Msg=0x1050, wParam=0x0, lParam=0x0) returned 0x0 [0054.512] GetCurrentThreadId () returned 0xbb4 [0054.512] GetCurrentThreadId () returned 0xbb4 [0054.512] GetCurrentThreadId () returned 0xbb4 [0054.512] GetCurrentThreadId () returned 0xbb4 [0054.512] lstrcmpiA (lpString1="MSWinsockLib.Winsock", lpString2="MSWinsockLib.Winsock") returned 0 [0054.513] GetCurrentThreadId () returned 0xbb4 [0054.513] GetCurrentThreadId () returned 0xbb4 [0054.513] GetCurrentThreadId () returned 0xbb4 [0054.513] GetCurrentThreadId () returned 0xbb4 [0054.513] GetCurrentThreadId () returned 0xbb4 [0054.513] PostMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 1 [0054.523] GetCurrentThreadId () returned 0xbb4 [0054.524] GetCurrentThreadId () returned 0xbb4 [0054.524] GetCurrentThreadId () returned 0xbb4 [0054.524] GetCurrentThreadId () returned 0xbb4 [0054.524] GetCurrentThreadId () returned 0xbb4 [0054.524] GetCurrentThreadId () returned 0xbb4 [0054.524] GetCurrentThreadId () returned 0xbb4 [0054.524] GetCurrentThreadId () returned 0xbb4 [0054.524] GetCurrentThreadId () returned 0xbb4 [0054.524] GetCurrentThreadId () returned 0xbb4 [0054.525] GetCurrentThreadId () returned 0xbb4 [0054.525] GetCurrentThreadId () returned 0xbb4 [0054.525] GetCurrentThreadId () returned 0xbb4 [0054.525] GetCurrentThreadId () returned 0xbb4 [0054.525] GetCurrentThreadId () returned 0xbb4 [0054.525] GetCurrentThreadId () returned 0xbb4 [0054.525] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c75b8 | out: hHeap=0x3b0000) returned 1 [0054.525] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c75c8 | out: hHeap=0x3b0000) returned 1 [0054.525] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c75d8 | out: hHeap=0x3b0000) returned 1 [0054.525] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c75e8 | out: hHeap=0x3b0000) returned 1 [0054.557] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cae88 | out: hHeap=0x3b0000) returned 1 [0054.557] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c8a90 | out: hHeap=0x3b0000) returned 1 [0054.558] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c74a8 | out: hHeap=0x3b0000) returned 1 [0054.558] GetCurrentThreadId () returned 0xbb4 [0054.558] GetCurrentThreadId () returned 0xbb4 [0054.558] GetCurrentThreadId () returned 0xbb4 [0054.558] lstrcmpiA (lpString1="MSWinsockLib.Winsock", lpString2="MSWinsockLib.Winsock") returned 0 [0054.559] GetCurrentThreadId () returned 0xbb4 [0054.559] GetCurrentThreadId () returned 0xbb4 [0054.559] GetCurrentThreadId () returned 0xbb4 [0054.560] GetCurrentThreadId () returned 0xbb4 [0054.560] GetCurrentThreadId () returned 0xbb4 [0054.560] PostMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 1 [0054.575] GetCurrentThreadId () returned 0xbb4 [0054.575] GetCurrentThreadId () returned 0xbb4 [0054.575] GetCurrentThreadId () returned 0xbb4 [0054.576] GetCurrentThreadId () returned 0xbb4 [0054.576] GetCurrentThreadId () returned 0xbb4 [0054.589] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7448 | out: hHeap=0x3b0000) returned 1 [0054.589] IMalloc:Free (This=0x767666bc, pv=0x1619698) [0054.589] IMalloc:Free (This=0x767666bc, pv=0x1619670) [0054.589] IMalloc:Free (This=0x767666bc, pv=0x161ea80) [0054.589] IMalloc:Free (This=0x767666bc, pv=0x161cb08) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161de18) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161dda8) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161dd38) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161dcc8) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161dc58) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161dbe8) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161db78) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161db08) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161da98) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161da10) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161d9a0) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161d930) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161d8c0) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161d850) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161d7e0) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161d770) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161d700) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161d690) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161d620) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161d5b0) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161d540) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161d4d0) [0054.590] IMalloc:Free (This=0x767666bc, pv=0x161d460) [0054.590] GetCurrentThreadId () returned 0xbb4 [0054.590] GetCurrentThreadId () returned 0xbb4 [0054.591] GetCurrentThreadId () returned 0xbb4 [0054.591] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2ae8 | out: hHeap=0x3b0000) returned 1 [0054.591] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5ee0 | out: hHeap=0x3b0000) returned 1 [0054.591] GetCurrentThreadId () returned 0xbb4 [0054.591] GetCurrentThreadId () returned 0xbb4 [0054.591] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2ad0 | out: hHeap=0x3b0000) returned 1 [0054.591] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5e08 | out: hHeap=0x3b0000) returned 1 [0054.591] GetCurrentThreadId () returned 0xbb4 [0054.591] GetCurrentThreadId () returned 0xbb4 [0054.591] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2ab8 | out: hHeap=0x3b0000) returned 1 [0054.591] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5d30 | out: hHeap=0x3b0000) returned 1 [0054.591] GetCurrentThreadId () returned 0xbb4 [0054.591] GetCurrentThreadId () returned 0xbb4 [0054.591] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2aa0 | out: hHeap=0x3b0000) returned 1 [0054.591] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c58 | out: hHeap=0x3b0000) returned 1 [0054.591] GetCurrentThreadId () returned 0xbb4 [0054.592] GetCurrentThreadId () returned 0xbb4 [0054.592] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b2270 | out: hHeap=0x3b0000) returned 1 [0054.592] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b2208 | out: hHeap=0x3b0000) returned 1 [0054.592] GetCurrentThreadId () returned 0xbb4 [0054.592] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5bb0 | out: hHeap=0x3b0000) returned 1 [0054.592] HeapFree (in: hHeap=0x3680000, dwFlags=0x0, lpMem=0x36808f0 | out: hHeap=0x3680000) returned 1 [0054.592] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c88 | out: hHeap=0x3b0000) returned 1 [0054.592] HeapFree (in: hHeap=0x3680000, dwFlags=0x0, lpMem=0x3680928 | out: hHeap=0x3680000) returned 1 [0054.592] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5d60 | out: hHeap=0x3b0000) returned 1 [0054.592] HeapFree (in: hHeap=0x3680000, dwFlags=0x0, lpMem=0x3680960 | out: hHeap=0x3680000) returned 1 [0054.592] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5e38 | out: hHeap=0x3b0000) returned 1 [0054.592] HeapFree (in: hHeap=0x3680000, dwFlags=0x0, lpMem=0x3680998 | out: hHeap=0x3680000) returned 1 [0054.592] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b2cc0 | out: hHeap=0x3b0000) returned 1 [0054.592] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b2e38 | out: hHeap=0x3b0000) returned 1 [0054.592] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b2ea8 | out: hHeap=0x3b0000) returned 1 [0054.592] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b2ca8 | out: hHeap=0x3b0000) returned 1 [0054.593] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b2b88 | out: hHeap=0x3b0000) returned 1 [0054.593] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b3370 | out: hHeap=0x3b0000) returned 1 [0054.593] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b3468 | out: hHeap=0x3b0000) returned 1 [0054.593] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b3330 | out: hHeap=0x3b0000) returned 1 [0054.593] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b34b8 | out: hHeap=0x3b0000) returned 1 [0054.593] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b3318 | out: hHeap=0x3b0000) returned 1 [0054.593] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b31f8 | out: hHeap=0x3b0000) returned 1 [0054.593] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b3850 | out: hHeap=0x3b0000) returned 1 [0054.593] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b3978 | out: hHeap=0x3b0000) returned 1 [0054.593] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b3810 | out: hHeap=0x3b0000) returned 1 [0054.593] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b39e0 | out: hHeap=0x3b0000) returned 1 [0054.593] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b37f8 | out: hHeap=0x3b0000) returned 1 [0054.593] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b36d8 | out: hHeap=0x3b0000) returned 1 [0054.593] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b3dc0 | out: hHeap=0x3b0000) returned 1 [0054.593] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b3e78 | out: hHeap=0x3b0000) returned 1 [0054.593] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b3d90 | out: hHeap=0x3b0000) returned 1 [0054.593] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b3eb8 | out: hHeap=0x3b0000) returned 1 [0054.593] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b3d78 | out: hHeap=0x3b0000) returned 1 [0054.594] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b3c58 | out: hHeap=0x3b0000) returned 1 [0054.594] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b41d8 | out: hHeap=0x3b0000) returned 1 [0054.594] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b42b8 | out: hHeap=0x3b0000) returned 1 [0054.594] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b41a8 | out: hHeap=0x3b0000) returned 1 [0054.594] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4308 | out: hHeap=0x3b0000) returned 1 [0054.594] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4188 | out: hHeap=0x3b0000) returned 1 [0054.594] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4068 | out: hHeap=0x3b0000) returned 1 [0054.594] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4630 | out: hHeap=0x3b0000) returned 1 [0054.594] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4740 | out: hHeap=0x3b0000) returned 1 [0054.594] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b47a0 | out: hHeap=0x3b0000) returned 1 [0054.594] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4618 | out: hHeap=0x3b0000) returned 1 [0054.594] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b44f8 | out: hHeap=0x3b0000) returned 1 [0054.594] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4ba8 | out: hHeap=0x3b0000) returned 1 [0054.594] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b3198 | out: hHeap=0x3b0000) returned 1 [0054.595] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b31e0 | out: hHeap=0x3b0000) returned 1 [0054.595] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4be0 | out: hHeap=0x3b0000) returned 1 [0054.595] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b31c8 | out: hHeap=0x3b0000) returned 1 [0054.595] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4a88 | out: hHeap=0x3b0000) returned 1 [0054.595] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4de0 | out: hHeap=0x3b0000) returned 1 [0054.595] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4dc8 | out: hHeap=0x3b0000) returned 1 [0054.595] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4ca8 | out: hHeap=0x3b0000) returned 1 [0054.595] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b5018 | out: hHeap=0x3b0000) returned 1 [0054.595] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b51a8 | out: hHeap=0x3b0000) returned 1 [0054.595] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b5230 | out: hHeap=0x3b0000) returned 1 [0054.595] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c82b0 | out: hHeap=0x3b0000) returned 1 [0054.595] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b5008 | out: hHeap=0x3b0000) returned 1 [0054.595] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4ee8 | out: hHeap=0x3b0000) returned 1 [0054.595] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b5688 | out: hHeap=0x3b0000) returned 1 [0054.595] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b56c0 | out: hHeap=0x3b0000) returned 1 [0054.595] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b5670 | out: hHeap=0x3b0000) returned 1 [0054.596] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b5550 | out: hHeap=0x3b0000) returned 1 [0054.596] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b58c0 | out: hHeap=0x3b0000) returned 1 [0054.596] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b58e8 | out: hHeap=0x3b0000) returned 1 [0054.596] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b58a8 | out: hHeap=0x3b0000) returned 1 [0054.596] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b5788 | out: hHeap=0x3b0000) returned 1 [0054.596] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b5b78 | out: hHeap=0x3b0000) returned 1 [0054.596] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b5c70 | out: hHeap=0x3b0000) returned 1 [0054.596] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4a10 | out: hHeap=0x3b0000) returned 1 [0054.596] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b5cd0 | out: hHeap=0x3b0000) returned 1 [0054.596] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b49f8 | out: hHeap=0x3b0000) returned 1 [0054.596] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b5a58 | out: hHeap=0x3b0000) returned 1 [0054.596] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b5ff0 | out: hHeap=0x3b0000) returned 1 [0054.596] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b6180 | out: hHeap=0x3b0000) returned 1 [0054.596] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b6208 | out: hHeap=0x3b0000) returned 1 [0054.596] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4a60 | out: hHeap=0x3b0000) returned 1 [0054.596] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b5ed0 | out: hHeap=0x3b0000) returned 1 [0054.597] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c0eb0 | out: hHeap=0x3b0000) returned 1 [0054.597] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c0f40 | out: hHeap=0x3b0000) returned 1 [0054.597] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4a78 | out: hHeap=0x3b0000) returned 1 [0054.597] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c0d90 | out: hHeap=0x3b0000) returned 1 [0054.597] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1218 | out: hHeap=0x3b0000) returned 1 [0054.597] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c12b8 | out: hHeap=0x3b0000) returned 1 [0054.597] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c11e8 | out: hHeap=0x3b0000) returned 1 [0054.597] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c12f8 | out: hHeap=0x3b0000) returned 1 [0054.597] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c11d0 | out: hHeap=0x3b0000) returned 1 [0054.597] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c10b0 | out: hHeap=0x3b0000) returned 1 [0054.597] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2190 | out: hHeap=0x3b0000) returned 1 [0054.597] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2380 | out: hHeap=0x3b0000) returned 1 [0054.597] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2438 | out: hHeap=0x3b0000) returned 1 [0054.597] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2178 | out: hHeap=0x3b0000) returned 1 [0054.597] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2058 | out: hHeap=0x3b0000) returned 1 [0054.597] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2e58 | out: hHeap=0x3b0000) returned 1 [0054.597] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b5958 | out: hHeap=0x3b0000) returned 1 [0054.597] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2ff0 | out: hHeap=0x3b0000) returned 1 [0054.598] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2a70 | out: hHeap=0x3b0000) returned 1 [0054.598] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2938 | out: hHeap=0x3b0000) returned 1 [0054.598] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5308 | out: hHeap=0x3b0000) returned 1 [0054.598] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c54d8 | out: hHeap=0x3b0000) returned 1 [0054.598] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5588 | out: hHeap=0x3b0000) returned 1 [0054.598] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2a88 | out: hHeap=0x3b0000) returned 1 [0054.598] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3320 | out: hHeap=0x3b0000) returned 1 [0054.598] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5a78 | out: hHeap=0x3b0000) returned 1 [0054.598] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b5a10 | out: hHeap=0x3b0000) returned 1 [0054.598] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5900 | out: hHeap=0x3b0000) returned 1 [0054.598] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3448 | out: hHeap=0x3b0000) returned 1 [0054.598] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5f40 | out: hHeap=0x3b0000) returned 1 [0054.598] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c6038 | out: hHeap=0x3b0000) returned 1 [0054.598] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5f10 | out: hHeap=0x3b0000) returned 1 [0054.598] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c6088 | out: hHeap=0x3b0000) returned 1 [0054.599] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2b00 | out: hHeap=0x3b0000) returned 1 [0054.599] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3570 | out: hHeap=0x3b0000) returned 1 [0054.599] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c62b8 | out: hHeap=0x3b0000) returned 1 [0054.599] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c6398 | out: hHeap=0x3b0000) returned 1 [0054.599] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c6288 | out: hHeap=0x3b0000) returned 1 [0054.599] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c63f0 | out: hHeap=0x3b0000) returned 1 [0054.599] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2b18 | out: hHeap=0x3b0000) returned 1 [0054.599] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3698 | out: hHeap=0x3b0000) returned 1 [0054.600] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c27e8 | out: hHeap=0x3b0000) returned 1 [0054.600] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c6760 | out: hHeap=0x3b0000) returned 1 [0054.600] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c67b8 | out: hHeap=0x3b0000) returned 1 [0054.600] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2b30 | out: hHeap=0x3b0000) returned 1 [0054.600] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c37c0 | out: hHeap=0x3b0000) returned 1 [0054.600] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c69f0 | out: hHeap=0x3b0000) returned 1 [0054.600] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c6a88 | out: hHeap=0x3b0000) returned 1 [0054.600] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c28f8 | out: hHeap=0x3b0000) returned 1 [0054.600] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c6ab8 | out: hHeap=0x3b0000) returned 1 [0054.600] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2b48 | out: hHeap=0x3b0000) returned 1 [0054.600] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c38e8 | out: hHeap=0x3b0000) returned 1 [0054.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c6c38 | out: hHeap=0x3b0000) returned 1 [0054.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c6cd0 | out: hHeap=0x3b0000) returned 1 [0054.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c6c08 | out: hHeap=0x3b0000) returned 1 [0054.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c6d00 | out: hHeap=0x3b0000) returned 1 [0054.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2b60 | out: hHeap=0x3b0000) returned 1 [0054.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3a10 | out: hHeap=0x3b0000) returned 1 [0054.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c6e80 | out: hHeap=0x3b0000) returned 1 [0054.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c6f48 | out: hHeap=0x3b0000) returned 1 [0054.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c6e50 | out: hHeap=0x3b0000) returned 1 [0054.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c6f90 | out: hHeap=0x3b0000) returned 1 [0054.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2b78 | out: hHeap=0x3b0000) returned 1 [0054.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3b38 | out: hHeap=0x3b0000) returned 1 [0054.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7168 | out: hHeap=0x3b0000) returned 1 [0054.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7238 | out: hHeap=0x3b0000) returned 1 [0054.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7138 | out: hHeap=0x3b0000) returned 1 [0054.601] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7290 | out: hHeap=0x3b0000) returned 1 [0054.602] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2b90 | out: hHeap=0x3b0000) returned 1 [0054.602] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3c60 | out: hHeap=0x3b0000) returned 1 [0054.602] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c65c0 | out: hHeap=0x3b0000) returned 1 [0054.602] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b5a40 | out: hHeap=0x3b0000) returned 1 [0054.602] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c6600 | out: hHeap=0x3b0000) returned 1 [0054.602] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2928 | out: hHeap=0x3b0000) returned 1 [0054.602] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3d88 | out: hHeap=0x3b0000) returned 1 [0054.602] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c66e8 | out: hHeap=0x3b0000) returned 1 [0054.602] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c66c0 | out: hHeap=0x3b0000) returned 1 [0054.602] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7638 | out: hHeap=0x3b0000) returned 1 [0054.602] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2ba8 | out: hHeap=0x3b0000) returned 1 [0054.602] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3eb0 | out: hHeap=0x3b0000) returned 1 [0054.602] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7750 | out: hHeap=0x3b0000) returned 1 [0054.603] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1630 | out: hHeap=0x3b0000) returned 1 [0054.603] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c77a8 | out: hHeap=0x3b0000) returned 1 [0054.603] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7740 | out: hHeap=0x3b0000) returned 1 [0054.603] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3fd8 | out: hHeap=0x3b0000) returned 1 [0054.603] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7890 | out: hHeap=0x3b0000) returned 1 [0054.603] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7970 | out: hHeap=0x3b0000) returned 1 [0054.603] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c79b8 | out: hHeap=0x3b0000) returned 1 [0054.603] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7880 | out: hHeap=0x3b0000) returned 1 [0054.603] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4100 | out: hHeap=0x3b0000) returned 1 [0054.603] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7ba8 | out: hHeap=0x3b0000) returned 1 [0054.604] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7d30 | out: hHeap=0x3b0000) returned 1 [0054.604] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7d78 | out: hHeap=0x3b0000) returned 1 [0054.604] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c7b98 | out: hHeap=0x3b0000) returned 1 [0054.604] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4228 | out: hHeap=0x3b0000) returned 1 [0054.604] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b59e8 | out: hHeap=0x3b0000) returned 1 [0054.604] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b2288 | out: hHeap=0x3b0000) returned 1 [0054.604] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c16b0 | out: hHeap=0x3b0000) returned 1 [0054.604] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b22c0 | out: hHeap=0x3b0000) returned 1 [0054.604] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c15b0 | out: hHeap=0x3b0000) returned 1 [0054.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1490 | out: hHeap=0x3b0000) returned 1 [0054.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4a40 | out: hHeap=0x3b0000) returned 1 [0054.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1570 | out: hHeap=0x3b0000) returned 1 [0054.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4ec8 | out: hHeap=0x3b0000) returned 1 [0054.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1590 | out: hHeap=0x3b0000) returned 1 [0054.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b3178 | out: hHeap=0x3b0000) returned 1 [0054.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4048 | out: hHeap=0x3b0000) returned 1 [0054.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1510 | out: hHeap=0x3b0000) returned 1 [0054.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c14d0 | out: hHeap=0x3b0000) returned 1 [0054.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b44d8 | out: hHeap=0x3b0000) returned 1 [0054.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1670 | out: hHeap=0x3b0000) returned 1 [0054.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b6508 | out: hHeap=0x3b0000) returned 1 [0054.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c14b0 | out: hHeap=0x3b0000) returned 1 [0054.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c15f0 | out: hHeap=0x3b0000) returned 1 [0054.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1090 | out: hHeap=0x3b0000) returned 1 [0054.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1470 | out: hHeap=0x3b0000) returned 1 [0054.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b5530 | out: hHeap=0x3b0000) returned 1 [0054.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1530 | out: hHeap=0x3b0000) returned 1 [0054.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1650 | out: hHeap=0x3b0000) returned 1 [0054.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b36b8 | out: hHeap=0x3b0000) returned 1 [0054.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c14f0 | out: hHeap=0x3b0000) returned 1 [0054.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1550 | out: hHeap=0x3b0000) returned 1 [0054.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c15d0 | out: hHeap=0x3b0000) returned 1 [0054.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1690 | out: hHeap=0x3b0000) returned 1 [0054.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b31a8 | out: hHeap=0x3b0000) returned 1 [0054.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b49d8 | out: hHeap=0x3b0000) returned 1 [0054.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b4c88 | out: hHeap=0x3b0000) returned 1 [0054.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b3c38 | out: hHeap=0x3b0000) returned 1 [0054.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b5768 | out: hHeap=0x3b0000) returned 1 [0054.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1610 | out: hHeap=0x3b0000) returned 1 [0054.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b2700 | out: hHeap=0x3b0000) returned 1 [0054.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c8190 | out: hHeap=0x3b0000) returned 1 [0054.606] HeapFree (in: hHeap=0x3680000, dwFlags=0x0, lpMem=0x36807d0 | out: hHeap=0x3680000) returned 1 [0054.606] GetCursorPos (in: lpPoint=0x18fe4c | out: lpPoint=0x18fe4c*(x=718, y=532)) returned 1 [0054.607] GetCapture () returned 0x0 [0054.607] WindowFromPoint (Point=0x2ce) returned 0x100f8 [0054.607] GetWindowThreadProcessId (in: hWnd=0x100f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x458 [0054.607] DestroyWindow (hWnd=0x50114) returned 0 [0054.607] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b21e8 | out: hHeap=0x3b0000) returned 1 [0054.607] DeleteDC (hdc=0x1e010257) returned 1 [0054.608] IMalloc:Free (This=0x767666bc, pv=0x161caf0) [0054.608] IMalloc:Free (This=0x767666bc, pv=0x1619468) [0054.608] IMalloc:Free (This=0x767666bc, pv=0x1618ca0) [0054.608] IMalloc:Free (This=0x767666bc, pv=0x161d3b0) [0054.608] IMalloc:Free (This=0x767666bc, pv=0x1619490) [0054.608] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x18fe8c | out: lplpMessageFilter=0x18fe8c*=0x3b2054) returned 0x0 [0054.608] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b2050 | out: hHeap=0x3b0000) returned 1 [0054.608] UnhookWindowsHookEx (hhk=0x14022d) returned 1 [0054.609] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b21d0 | out: hHeap=0x3b0000) returned 1 [0054.609] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b21b0 | out: hHeap=0x3b0000) returned 1 [0054.609] GetTickCount () returned 0x1147659 [0054.609] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b2120 | out: hHeap=0x3b0000) returned 1 [0054.609] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b2170 | out: hHeap=0x3b0000) returned 1 [0054.609] SetWindowLongA (hWnd=0x50116, nIndex=0, dwNewLong=0) returned 3874972 [0054.609] DestroyWindow (hWnd=0x50116) returned 1 [0054.609] NtdllDefWindowProc_A (hWnd=0x50116, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0054.617] NtdllDefWindowProc_A (hWnd=0x50116, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0054.618] NtdllDefWindowProc_A (hWnd=0x50116, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0054.618] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b2098 | out: hHeap=0x3b0000) returned 1 [0054.618] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b2078 | out: hHeap=0x3b0000) returned 1 [0054.618] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b2138 | out: hHeap=0x3b0000) returned 1 [0054.619] HeapDestroy (hHeap=0x3680000) returned 1 [0054.619] GlobalDeleteAtom (nAtom=0xc157) returned 0x0 [0054.619] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b17e0 | out: hHeap=0x3b0000) returned 1 [0054.619] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b17b0 | out: hHeap=0x3b0000) returned 1 [0054.619] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c8070 | out: hHeap=0x3b0000) returned 1 [0054.620] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b2b40 | out: hHeap=0x3b0000) returned 1 [0054.620] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b1810 | out: hHeap=0x3b0000) returned 1 [0054.620] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b1bc0 | out: hHeap=0x3b0000) returned 1 [0054.620] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b1f70 | out: hHeap=0x3b0000) returned 1 [0054.620] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c89b0 | out: hHeap=0x3b0000) returned 1 [0054.620] VirtualFree (lpAddress=0x210000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.620] IMalloc:Free (This=0x767666bc, pv=0x1618c90) [0054.620] IUnknown:AddRef (This=0x767666bc) returned 0x1 [0054.621] Sleep (dwMilliseconds=0x0) [0054.622] CoFreeUnusedLibraries () [0054.622] OleUninitialize () [0054.623] FreeLibrary (hLibModule=0x76e40000) returned 1 [0054.623] ReleaseSemaphore (in: hSemaphore=0x90, lReleaseCount=1, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0054.623] GetCurrentThreadId () returned 0xbb4 [0054.623] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b08e0 | out: hHeap=0x3b0000) returned 1 [0054.623] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b07d0 | out: hHeap=0x3b0000) returned 1 [0054.623] ExitProcess (uExitCode=0x0) [0054.624] GetCurrentThreadId () returned 0xbb4 [0054.624] GetCurrentThreadId () returned 0xbb4 [0054.625] IUnknown:AddRef (This=0x767666bc) returned 0x1 [0054.625] HeapDestroy (hHeap=0x3b0000) returned 1 [0054.627] CloseHandle (hObject=0x7c) returned 1 [0054.627] CloseHandle (hObject=0x80) returned 1 [0054.628] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x240d48 | out: hHeap=0x240000) returned 1 [0054.629] VirtualFree (lpAddress=0x2e80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.629] HeapDestroy (hHeap=0x240000) returned 1 Process: id = "2" image_name = "zhang.exe" filename = "c:\\programdata\\zhang.exe" page_root = "0x15301000" os_pid = "0xa90" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa9c" cmd_line = "C:\\ProgramData\\zhang.exe" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 2 os_tid = 0xa94 [0048.463] GetVersion () returned 0x1db10106 [0048.471] GetModuleHandleA (lpModuleName=0x7294f824) returned 0x76d30000 [0048.471] GetProcAddress (hModule=0x76d30000, lpProcName="IsTNT") returned 0x0 [0048.471] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2fc0000 [0048.472] VirtualAlloc (lpAddress=0x0, dwSize=0x400000, flAllocationType=0x2000, flProtect=0x4) returned 0x2fd0000 [0048.473] VirtualAlloc (lpAddress=0x2fd0000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x2fd0000 [0048.475] GetCurrentThreadId () returned 0xa94 [0048.475] GetCommandLineA () returned="C:\\ProgramData\\zhang.exe" [0048.475] GetEnvironmentStringsW () returned 0x2d4660* [0048.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0048.475] RtlAllocateHeap (HeapHandle=0x2fc0000, Flags=0x0, Size=0x570) returned 0x2fc07d0 [0048.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x2fc07d0, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0048.475] FreeEnvironmentStringsW (penv=0x2d4660) returned 1 [0048.475] RtlAllocateHeap (HeapHandle=0x2fc0000, Flags=0x0, Size=0x480) returned 0x2fc0d48 [0048.476] GetStartupInfoA (in: lpStartupInfo=0x18f9b8 | out: lpStartupInfo=0x18f9b8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\ProgramData\\zhang.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0048.476] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0048.476] GetFileType (hFile=0x0) returned 0x0 [0048.476] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0048.476] GetFileType (hFile=0x0) returned 0x0 [0048.476] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0048.476] GetFileType (hFile=0x0) returned 0x0 [0048.476] SetHandleCount (uNumber=0x20) returned 0x20 [0048.476] GetACP () returned 0x4e4 [0048.476] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f9e0 | out: lpCPInfo=0x18f9e0) returned 1 [0048.476] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x72a4c528, nSize=0x104 | out: lpFilename="C:\\ProgramData\\zhang.exe" (normalized: "c:\\programdata\\zhang.exe")) returned 0x18 [0048.479] HeapFree (in: hHeap=0x2fc0000, dwFlags=0x0, lpMem=0x2fc07d0 | out: hHeap=0x2fc0000) returned 1 [0048.479] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76d30000 [0048.479] GetProcAddress (hModule=0x76d30000, lpProcName="IsProcessorFeaturePresent") returned 0x76d45235 [0048.479] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0048.479] RtlAllocateHeap (HeapHandle=0x2fc0000, Flags=0x8, Size=0x800) returned 0x2fc11d0 [0048.480] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x7c [0048.480] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x80 [0048.481] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0048.482] GetModuleFileNameA (in: hModule=0x72940000, lpFilename=0x72a4e6c8, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0048.482] GetVersion () returned 0x1db10106 [0048.482] lstrcmpiW (lpString1=0x72959810, lpString2=0x72959814) returned -1 [0048.484] GetUserDefaultLCID () returned 0x409 [0048.484] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="A", cchCount1=-1, lpString2="B", cchCount2=-1) returned 1 [0048.484] GetSystemMetrics (nIndex=5) returned 1 [0048.484] GetSystemMetrics (nIndex=6) returned 1 [0048.484] GetSystemMetrics (nIndex=11) returned 32 [0048.484] GetSystemMetrics (nIndex=12) returned 32 [0048.484] GetSystemMetrics (nIndex=34) returned 132 [0048.484] GetSystemMetrics (nIndex=35) returned 38 [0048.484] GetSystemMetrics (nIndex=0) returned 1440 [0048.484] GetSystemMetrics (nIndex=1) returned 900 [0048.484] GetSystemMetrics (nIndex=32) returned 8 [0048.484] GetSystemMetrics (nIndex=33) returned 8 [0048.484] GetSystemMetrics (nIndex=42) returned 0 [0048.484] GetStockObject (i=15) returned 0x188000b [0048.485] GetStockObject (i=7) returned 0x1b00017 [0048.485] GetStockObject (i=6) returned 0x1b00018 [0048.485] GetStockObject (i=8) returned 0x1b00016 [0048.485] GetStockObject (i=4) returned 0x1900011 [0048.485] GetStockObject (i=2) returned 0x1900012 [0048.485] GetStockObject (i=0) returned 0x1900010 [0048.485] GetStockObject (i=5) returned 0x1900015 [0048.485] GetStockObject (i=13) returned 0x18a002e [0048.485] GetDC (hWnd=0x0) returned 0xe010735 [0048.486] GetTextExtentPointA (in: hdc=0xe010735, lpString="0", c=1, lpsz=0x18f9dc | out: lpsz=0x18f9dc) returned 1 [0048.489] GetDeviceCaps (hdc=0xe010735, index=14) returned 1 [0048.489] GetDeviceCaps (hdc=0xe010735, index=12) returned 32 [0048.489] GetDeviceCaps (hdc=0xe010735, index=88) returned 96 [0048.489] GetDeviceCaps (hdc=0xe010735, index=90) returned 96 [0048.489] GetDeviceCaps (hdc=0xe010735, index=38) returned 32409 [0048.489] ReleaseDC (hWnd=0x0, hDC=0xe010735) returned 1 [0048.489] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0x1660000 [0048.490] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x72a4e7d0 | out: ppMalloc=0x72a4e7d0*=0x767666bc) returned 0x0 [0048.491] GetCurrentThreadId () returned 0xa94 [0048.698] LoadLibraryA (lpLibFileName="MSVBVM60.DLL") returned 0x72940000 [0048.698] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarTstGt") returned 0x72a49841 [0048.698] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarSub") returned 0x72a477ea [0048.698] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrI2") returned 0x72a20507 [0048.699] GetProcAddress (hModule=0x72940000, lpProcName="__vbaR8ForNextCheck") returned 0x72a49530 [0048.699] GetProcAddress (hModule=0x72940000, lpProcName="_CIcos") returned 0x72a39386 [0048.699] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fptan") returned 0x72a309f9 [0048.699] GetProcAddress (hModule=0x72940000, lpProcName="__vbaHresultCheck") returned 0x72a1a266 [0048.699] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrI4") returned 0x72a20537 [0048.700] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarMove") returned 0x72a46aee [0048.700] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarVargNofree") returned 0x72a4728d [0048.700] GetProcAddress (hModule=0x72940000, lpProcName="__vbaAryMove") returned 0x72a0c244 [0048.700] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFreeVar") returned 0x72a46831 [0048.700] GetProcAddress (hModule=0x72940000, lpProcName="__vbaLateIdCall") returned 0x72a48b74 [0048.700] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrVarMove") returned 0x72a21929 [0048.701] GetProcAddress (hModule=0x72940000, lpProcName="__vbaLenBstr") returned 0x72a26a9b [0048.701] GetProcAddress (hModule=0x72940000, lpProcName="__vbaEnd") returned 0x72a0be88 [0048.701] GetProcAddress (hModule=0x72940000, lpProcName="__vbaPut3") returned 0x72a256fa [0048.701] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFreeVarList") returned 0x72a47262 [0048.701] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fdiv_m64") returned 0x72a302ba [0048.702] GetProcAddress (hModule=0x72940000, lpProcName=0x26c) returned 0x72a13118 [0048.702] GetProcAddress (hModule=0x72940000, lpProcName="__vbaNextEachVar") returned 0x72a463bc [0048.702] GetProcAddress (hModule=0x72940000, lpProcName="__vbaRaiseEvent") returned 0x72a48b8f [0048.702] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFreeObjList") returned 0x72a19fc3 [0048.703] GetProcAddress (hModule=0x72940000, lpProcName=0x204) returned 0x72a270b7 [0048.703] GetProcAddress (hModule=0x72940000, lpProcName=0x205) returned 0x72a27569 [0048.703] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fprem1") returned 0x72a30941 [0048.703] GetProcAddress (hModule=0x72940000, lpProcName="__vbaRecAnsiToUni") returned 0x72a1b797 [0048.703] GetProcAddress (hModule=0x72940000, lpProcName=0x206) returned 0x72a275a0 [0048.704] GetProcAddress (hModule=0x72940000, lpProcName=0x272) returned 0x72a19cca [0048.704] GetProcAddress (hModule=0x72940000, lpProcName="__vbaResume") returned 0x72a249e1 [0048.704] GetProcAddress (hModule=0x72940000, lpProcName="__vbaCopyBytes") returned 0x72a1a0f3 [0048.704] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarCmpNe") returned 0x72a49957 [0048.704] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrCat") returned 0x72a26a76 [0048.704] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarTextTstEq") returned 0x72a4988c [0048.705] GetProcAddress (hModule=0x72940000, lpProcName="__vbaLsetFixstr") returned 0x72a276e5 [0048.705] GetProcAddress (hModule=0x72940000, lpProcName="__vbaRecDestruct") returned 0x72a1b704 [0048.705] GetProcAddress (hModule=0x72940000, lpProcName="__vbaSetSystemError") returned 0x72a0c33a [0048.705] GetProcAddress (hModule=0x72940000, lpProcName="__vbaNameFile") returned 0x72a16402 [0048.705] GetProcAddress (hModule=0x72940000, lpProcName="__vbaHresultCheckObj") returned 0x72a1a274 [0048.706] GetProcAddress (hModule=0x72940000, lpProcName="__vbaLenVar") returned 0x72a26aab [0048.706] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fdiv_m32") returned 0x72a3026e [0048.706] GetProcAddress (hModule=0x72940000, lpProcName="__vbaAryVar") returned 0x72a43940 [0048.706] GetProcAddress (hModule=0x72940000, lpProcName=0x29a) returned 0x72a1db35 [0048.707] GetProcAddress (hModule=0x72940000, lpProcName=0x29b) returned 0x72a1db60 [0048.707] GetProcAddress (hModule=0x72940000, lpProcName="__vbaAryDestruct") returned 0x72a1c1fe [0048.707] GetProcAddress (hModule=0x72940000, lpProcName="__vbaCyErrVar") returned 0x72a24e36 [0048.707] GetProcAddress (hModule=0x72940000, lpProcName="__vbaLateMemSt") returned 0x72a48c75 [0048.708] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarPow") returned 0x72a47704 [0048.708] GetProcAddress (hModule=0x72940000, lpProcName="__vbaExitProc") returned 0x72a24a48 [0048.708] GetProcAddress (hModule=0x72940000, lpProcName=0x251) returned 0x72a1cd05 [0048.708] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarForInit") returned 0x72a493cc [0048.709] GetProcAddress (hModule=0x72940000, lpProcName=0x252) returned 0x72a1cd3a [0048.709] GetProcAddress (hModule=0x72940000, lpProcName=0x12d) returned 0x72a35e23 [0048.709] GetProcAddress (hModule=0x72940000, lpProcName=0x253) returned 0x72a1d132 [0048.709] GetProcAddress (hModule=0x72940000, lpProcName="__vbaOnError") returned 0x72a2499d [0048.709] GetProcAddress (hModule=0x72940000, lpProcName="__vbaObjSet") returned 0x72a19ff1 [0048.710] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fdiv_m16i") returned 0x72a30306 [0048.710] GetProcAddress (hModule=0x72940000, lpProcName="__vbaObjSetAddref") returned 0x72a1a008 [0048.710] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fdivr_m16i") returned 0x72a30406 [0048.710] GetProcAddress (hModule=0x72940000, lpProcName=0x256) returned 0x72a0e0f7 [0048.710] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarIndexLoad") returned 0x72a1c43b [0048.710] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrFixstr") returned 0x72a29652 [0048.711] GetProcAddress (hModule=0x72940000, lpProcName="__vbaBoolVar") returned 0x72a20d73 [0048.711] GetProcAddress (hModule=0x72940000, lpProcName=0x133) returned 0x72a35f5a [0048.711] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrTextCmp") returned 0x72a295a8 [0048.711] GetProcAddress (hModule=0x72940000, lpProcName="__vbaBoolVarNull") returned 0x72a47185 [0048.711] GetProcAddress (hModule=0x72940000, lpProcName="__vbaRefVarAry") returned 0x72a1c417 [0048.712] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarTstLt") returned 0x72a49873 [0048.712] GetProcAddress (hModule=0x72940000, lpProcName="_CIsin") returned 0x72a394ee [0048.712] GetProcAddress (hModule=0x72940000, lpProcName=0x2c5) returned 0x72a38299 [0048.712] GetProcAddress (hModule=0x72940000, lpProcName=0x277) returned 0x72a26fe2 [0048.712] GetProcAddress (hModule=0x72940000, lpProcName="__vbaErase") returned 0x72a1c0fd [0048.712] GetProcAddress (hModule=0x72940000, lpProcName=0x278) returned 0x72a2702f [0048.712] GetProcAddress (hModule=0x72940000, lpProcName=0x20d) returned 0x72a27db9 [0048.713] GetProcAddress (hModule=0x72940000, lpProcName="__vbaChkstk") returned 0x72a362ea [0048.713] GetProcAddress (hModule=0x72940000, lpProcName=0x20e) returned 0x72a27dfb [0048.713] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFileClose") returned 0x72a1417d [0048.714] GetProcAddress (hModule=0x72940000, lpProcName="EVENT_SINK_AddRef") returned 0x72a09b74 [0048.714] GetProcAddress (hModule=0x72940000, lpProcName=0x20f) returned 0x72a27f8a [0048.714] GetProcAddress (hModule=0x72940000, lpProcName=0x210) returned 0x72a27faa [0048.714] GetProcAddress (hModule=0x72940000, lpProcName=0x211) returned 0x72a15d41 [0048.714] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrCmp") returned 0x72a29596 [0048.715] GetProcAddress (hModule=0x72940000, lpProcName="__vbaCyI2") returned 0x72a2199f [0048.715] GetProcAddress (hModule=0x72940000, lpProcName="__vbaPutOwner3") returned 0x72a2576c [0048.715] GetProcAddress (hModule=0x72940000, lpProcName="__vbaAryConstruct2") returned 0x72a1c6ae [0048.715] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarTstEq") returned 0x72a497f6 [0048.716] GetProcAddress (hModule=0x72940000, lpProcName=0x230) returned 0x72a1c9b4 [0048.716] GetProcAddress (hModule=0x72940000, lpProcName="__vbaObjVar") returned 0x72a1a1a9 [0048.716] GetProcAddress (hModule=0x72940000, lpProcName="DllFunctionCall") returned 0x7294a0fd [0048.716] GetProcAddress (hModule=0x72940000, lpProcName=0x233) returned 0x72a1cb05 [0048.716] GetProcAddress (hModule=0x72940000, lpProcName=0x29e) returned 0x72a1de02 [0048.717] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarOr") returned 0x72a495b2 [0048.717] GetProcAddress (hModule=0x72940000, lpProcName=0x234) returned 0x72a201fa [0048.717] GetProcAddress (hModule=0x72940000, lpProcName="__vbaRedimPreserve") returned 0x72a1c339 [0048.717] GetProcAddress (hModule=0x72940000, lpProcName="__vbaLbound") returned 0x72a1c628 [0048.717] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fpatan") returned 0x72a309f6 [0048.717] GetProcAddress (hModule=0x72940000, lpProcName="__vbaLateIdCallLd") returned 0x72a48b25 [0048.718] GetProcAddress (hModule=0x72940000, lpProcName="__vbaRedim") returned 0x72a1c30a [0048.718] GetProcAddress (hModule=0x72940000, lpProcName="__vbaRecUniToAnsi") returned 0x72a1b75d [0048.718] GetProcAddress (hModule=0x72940000, lpProcName="EVENT_SINK_Release") returned 0x72a09b87 [0048.718] GetProcAddress (hModule=0x72940000, lpProcName="__vbaNew") returned 0x72a1a204 [0048.719] GetProcAddress (hModule=0x72940000, lpProcName=0x258) returned 0x72a0ce69 [0048.719] GetProcAddress (hModule=0x72940000, lpProcName=0x259) returned 0x72a43a13 [0048.719] GetProcAddress (hModule=0x72940000, lpProcName="_CIsqrt") returned 0x72a39593 [0048.719] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarAnd") returned 0x72a49589 [0048.719] GetProcAddress (hModule=0x72940000, lpProcName="EVENT_SINK_QueryInterface") returned 0x72a09a85 [0048.720] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarMul") returned 0x72a47660 [0048.720] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStr2Vec") returned 0x72a43a40 [0048.720] GetProcAddress (hModule=0x72940000, lpProcName="__vbaExceptHandler") returned 0x72a247df [0048.721] GetProcAddress (hModule=0x72940000, lpProcName=0x2c7) returned 0x72a37ddb [0048.721] GetProcAddress (hModule=0x72940000, lpProcName="__vbaPrintFile") returned 0x72a150a3 [0048.721] GetProcAddress (hModule=0x72940000, lpProcName=0x2c8) returned 0x72a389c4 [0048.721] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrToUnicode") returned 0x72a0bf1d [0048.721] GetProcAddress (hModule=0x72940000, lpProcName=0x2c9) returned 0x72a38971 [0048.722] GetProcAddress (hModule=0x72940000, lpProcName=0x25e) returned 0x72a27e26 [0048.722] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fprem") returned 0x72a30689 [0048.722] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fdivr_m64") returned 0x72a303ba [0048.722] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarDiv") returned 0x72a47689 [0048.723] GetProcAddress (hModule=0x72940000, lpProcName=0x25f) returned 0x72a27f4d [0048.723] GetProcAddress (hModule=0x72940000, lpProcName=0x260) returned 0x72a20f56 [0048.723] GetProcAddress (hModule=0x72940000, lpProcName=0x213) returned 0x72a15c89 [0048.723] GetProcAddress (hModule=0x72940000, lpProcName=0x2cc) returned 0x72a197d1 [0048.723] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFPException") returned 0x72a47513 [0048.724] GetProcAddress (hModule=0x72940000, lpProcName=0x214) returned 0x72a15c9a [0048.724] GetProcAddress (hModule=0x72940000, lpProcName=0x2cd) returned 0x72a28fe9 [0048.724] GetProcAddress (hModule=0x72940000, lpProcName="__vbaInStrVar") returned 0x72a2738d [0048.724] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrCompVar") returned 0x72a27b3e [0048.724] GetProcAddress (hModule=0x72940000, lpProcName="__vbaGetOwner3") returned 0x72a25750 [0048.724] GetProcAddress (hModule=0x72940000, lpProcName="__vbaUbound") returned 0x72a1c65a [0048.725] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrVarVal") returned 0x72a21948 [0048.725] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarCat") returned 0x72a2697d [0048.725] GetProcAddress (hModule=0x72940000, lpProcName=0x217) returned 0x72a1c85d [0048.725] GetProcAddress (hModule=0x72940000, lpProcName="__vbaI2Var") returned 0x72a24e21 [0048.725] GetProcAddress (hModule=0x72940000, lpProcName=0x219) returned 0x72a20ebe [0048.725] GetProcAddress (hModule=0x72940000, lpProcName=0x284) returned 0x72a1de99 [0048.725] GetProcAddress (hModule=0x72940000, lpProcName=0x285) returned 0x72a153f7 [0048.726] GetProcAddress (hModule=0x72940000, lpProcName="_CIlog") returned 0x72a3942b [0048.726] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFileOpen") returned 0x72a13d10 [0048.726] GetProcAddress (hModule=0x72940000, lpProcName="__vbaR8Str") returned 0x72a210ea [0048.726] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarLateMemCallLdRf") returned 0x72a48da8 [0048.727] GetProcAddress (hModule=0x72940000, lpProcName=0x288) returned 0x72a14275 [0048.727] GetProcAddress (hModule=0x72940000, lpProcName=0x23a) returned 0x72a25618 [0048.727] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVar2Vec") returned 0x72a43aec [0048.727] GetProcAddress (hModule=0x72940000, lpProcName="__vbaInStr") returned 0x7294a296 [0048.727] GetProcAddress (hModule=0x72940000, lpProcName="__vbaNew2") returned 0x72a1a237 [0048.727] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fdiv_m32i") returned 0x72a3033a [0048.728] GetProcAddress (hModule=0x72940000, lpProcName=0x23c) returned 0x72a21290 [0048.728] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fdivr_m32i") returned 0x72a3043a [0048.728] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarSetObj") returned 0x72a1a01f [0048.728] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrCopy") returned 0x72a26c4a [0048.728] GetProcAddress (hModule=0x72940000, lpProcName=0x2a9) returned 0x72a1dae3 [0048.729] GetProcAddress (hModule=0x72940000, lpProcName="__vbaI4Str") returned 0x72a2105e [0048.729] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarNot") returned 0x72a49564 [0048.729] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFreeStrList") returned 0x72a26c01 [0048.730] GetProcAddress (hModule=0x72940000, lpProcName=0x240) returned 0x72a15f0d [0048.730] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fdivr_m32") returned 0x72a3036e [0048.730] GetProcAddress (hModule=0x72940000, lpProcName="_adj_fdiv_r") returned 0x72a2fda9 [0048.730] GetProcAddress (hModule=0x72940000, lpProcName=0x242) returned 0x72a161f8 [0048.730] GetProcAddress (hModule=0x72940000, lpProcName=0x2ad) returned 0x72a1ef7d [0048.730] GetProcAddress (hModule=0x72940000, lpProcName=0x64) returned 0x729435a4 [0048.730] GetProcAddress (hModule=0x72940000, lpProcName=0x243) returned 0x72a16224 [0048.731] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarTstNe") returned 0x72a4980f [0048.731] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarSetVar") returned 0x72a1a0c7 [0048.731] GetProcAddress (hModule=0x72940000, lpProcName="__vbaI4Var") returned 0x72a24e2f [0048.731] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarCmpEq") returned 0x72a49922 [0048.731] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarAdd") returned 0x72a477c1 [0048.732] GetProcAddress (hModule=0x72940000, lpProcName="__vbaLateMemCall") returned 0x72a48cb8 [0048.732] GetProcAddress (hModule=0x72940000, lpProcName="__vbaAryLock") returned 0x72a1c6d9 [0048.732] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrToAnsi") returned 0x7294a3d7 [0048.732] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrComp") returned 0x72a27be9 [0048.732] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarDup") returned 0x72a46df6 [0048.734] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFpI2") returned 0x72a47559 [0048.734] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarLateMemCallLd") returned 0x72a48d8c [0048.734] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFpI4") returned 0x72a47570 [0048.734] GetProcAddress (hModule=0x72940000, lpProcName=0x268) returned 0x72a26d9a [0048.734] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarCopy") returned 0x72a46bb8 [0048.735] GetProcAddress (hModule=0x72940000, lpProcName="__vbaRecDestructAnsi") returned 0x72a1b7d1 [0048.735] GetProcAddress (hModule=0x72940000, lpProcName=0x269) returned 0x72a26dad [0048.735] GetProcAddress (hModule=0x72940000, lpProcName="__vbaLateMemCallLd") returned 0x72a48c4d [0048.735] GetProcAddress (hModule=0x72940000, lpProcName="__vbaR8IntI2") returned 0x72a297f3 [0048.735] GetProcAddress (hModule=0x72940000, lpProcName="_CIatan") returned 0x72a392c0 [0048.735] GetProcAddress (hModule=0x72940000, lpProcName="__vbaI2ErrVar") returned 0x72a24e1a [0048.736] GetProcAddress (hModule=0x72940000, lpProcName="__vbaAryCopy") returned 0x72a0c20d [0048.736] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrMove") returned 0x72a26c30 [0048.736] GetProcAddress (hModule=0x72940000, lpProcName=0x26a) returned 0x72a26e9e [0048.736] GetProcAddress (hModule=0x72940000, lpProcName="__vbaStrVarCopy") returned 0x72a20646 [0048.736] GetProcAddress (hModule=0x72940000, lpProcName="__vbaForEachVar") returned 0x72a46315 [0048.737] GetProcAddress (hModule=0x72940000, lpProcName="__vbaR8IntI4") returned 0x72a2980a [0048.737] GetProcAddress (hModule=0x72940000, lpProcName=0x26b) returned 0x72a26eb1 [0048.737] GetProcAddress (hModule=0x72940000, lpProcName="_allmul") returned 0x72a2eeed [0048.737] GetProcAddress (hModule=0x72940000, lpProcName="_CItan") returned 0x72a39644 [0048.738] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFPInt") returned 0x72a29821 [0048.738] GetProcAddress (hModule=0x72940000, lpProcName="__vbaAryUnlock") returned 0x72a1c6fc [0048.738] GetProcAddress (hModule=0x72940000, lpProcName="__vbaVarForNext") returned 0x72a493fa [0048.738] GetProcAddress (hModule=0x72940000, lpProcName="_CIexp") returned 0x72a2dd11 [0048.739] GetProcAddress (hModule=0x72940000, lpProcName="__vbaMidStmtBstr") returned 0x72a27c22 [0048.739] GetProcAddress (hModule=0x72940000, lpProcName="__vbaI4ErrVar") returned 0x72a24e28 [0048.739] GetProcAddress (hModule=0x72940000, lpProcName=0x244) returned 0x72a1624d [0048.739] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFreeObj") returned 0x72a19faf [0048.740] GetProcAddress (hModule=0x72940000, lpProcName="__vbaFreeStr") returned 0x72a26bec [0048.740] GetProcAddress (hModule=0x72940000, lpProcName=0x245) returned 0x72a1325a [0048.740] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0048.740] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0048.740] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\ProgramData\\zhang.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0048.740] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x104) returned 0x16607d0 [0048.741] GetCurrentThreadId () returned 0xa94 [0048.741] GetCurrentThreadId () returned 0xa94 [0048.741] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xec8) returned 0x16608e0 [0048.741] GetCommandLineA () returned="C:\\ProgramData\\zhang.exe" [0048.741] lstrlenA (lpString="") returned 0 [0048.741] lstrcpyA (in: lpString1=0x18feac, lpString2="" | out: lpString1="") returned="" [0048.741] SetErrorMode (uMode=0x8001) returned 0x8001 [0048.741] GetModuleFileNameA (in: hModule=0x72940000, lpFilename=0x18fb68, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0048.742] GetUserDefaultLCID () returned 0x409 [0048.742] lstrcpyA (in: lpString1=0x18f868, lpString2="*" | out: lpString1="*") returned="*" [0048.742] LoadStringA (in: hInstance=0x72940000, uID=0x7d1, lpBuffer=0x18fc6c, cchBufferMax=8 | out: lpBuffer="409") returned 0x3 [0048.742] GetSystemDefaultLCID () returned 0x409 [0048.742] GetUserDefaultLCID () returned 0x409 [0048.742] GetLocaleInfoA (in: Locale=0x400, LCType=0xe, lpLCData=0x18fc76, cchData=2 | out: lpLCData=".") returned 2 [0048.742] GetStockObject (i=13) returned 0x18a002e [0048.742] GetObjectA (in: h=0x18a002e, c=60, pv=0x18fc3c | out: pv=0x18fc3c) returned 60 [0048.742] GetLocaleInfoA (in: Locale=0x409, LCType=0x80000003, lpLCData=0x18fc38, cchData=4 | out: lpLCData="ENU") returned 4 [0048.742] lstrcpyA (in: lpString1=0x18fc68, lpString2="EN" | out: lpString1="EN") returned="EN" [0048.742] lstrlenA (lpString="{xx}") returned 4 [0048.742] lstrlenA (lpString="VB98.CHM") returned 8 [0048.742] lstrcpyA (in: lpString1=0x72a4eae8, lpString2="VB98.CHM" | out: lpString1="VB98.CHM") returned="VB98.CHM" [0048.742] GetLocaleInfoA (in: Locale=0x409, LCType=0x80000003, lpLCData=0x18fc38, cchData=4 | out: lpLCData="ENU") returned 4 [0048.742] lstrcpyA (in: lpString1=0x18fc68, lpString2="EN" | out: lpString1="EN") returned="EN" [0048.742] lstrlenA (lpString="{xx}") returned 4 [0048.742] lstrlenA (lpString="VBENLR98.CHM") returned 12 [0048.743] lstrcpyA (in: lpString1=0x72a4ebf0, lpString2="VBENLR98.CHM" | out: lpString1="VBENLR98.CHM") returned="VBENLR98.CHM" [0048.743] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18fd90, nSize=0x104 | out: lpFilename="C:\\ProgramData\\zhang.exe" (normalized: "c:\\programdata\\zhang.exe")) returned 0x18 [0048.743] GetModuleFileNameA (in: hModule=0x72940000, lpFilename=0x18fc8c, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0048.743] lstrcpynA (in: lpString1=0x18fb70, lpString2="C:\\Windows\\system32\\MSVBVM60.DLL", iMaxLength=260 | out: lpString1="C:\\Windows\\system32\\MSVBVM60.DLL") returned="C:\\Windows\\system32\\MSVBVM60.DLL" [0048.743] lstrlenA (lpString="C:\\Windows\\system32\\MSVBVM60.DLL") returned 32 [0048.743] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x21) returned 0x16617b0 [0048.743] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x21) returned 0x16617e0 [0048.743] lstrcpyA (in: lpString1=0x16617b0, lpString2="C:\\Windows\\system32\\MSVBVM60.DLL" | out: lpString1="C:\\Windows\\system32\\MSVBVM60.DLL") returned="C:\\Windows\\system32\\MSVBVM60.DLL" [0048.743] LCMapStringA (in: Locale=0x409, dwMapFlags=0x200, lpSrcStr="C:\\ProgramData\\zhang.exe", cchSrc=-1, lpDestStr=0x18fb50, cchDest=260 | out: lpDestStr="C:\\PROGRAMDATA\\ZHANG.EXE") returned 25 [0048.744] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x18fc54, dwRevision=0x1 | out: pSecurityDescriptor=0x18fc54) returned 1 [0048.744] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x18fc54, bDaclPresent=1, pDacl=0x0, bDaclDefaulted=0 | out: pSecurityDescriptor=0x18fc54) returned 1 [0048.744] CreateSemaphoreA (lpSemaphoreAttributes=0x18fc68, lInitialCount=0, lMaximumCount=2147483647, lpName="C:?PROGRAMDATA?ZHANG.EXE") returned 0x90 [0048.744] GetLastError () returned 0x0 [0048.744] GetVersionExA (in: lpVersionInformation=0x18fbcc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x18fbcc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0048.744] OleInitialize (pvReserved=0x0) returned 0x0 [0048.751] OaBuildVersion () returned 0x321396 [0048.751] LoadLibraryA (lpLibFileName="OLEAUT32.DLL") returned 0x76e40000 [0048.751] GetLastError () returned 0x0 [0048.751] GetProcAddress (hModule=0x76e40000, lpProcName="OleLoadPictureEx") returned 0x76ea70a1 [0048.751] RegisterClipboardFormatA (lpszFormat="Link") returned 0xc168 [0048.751] RegisterClipboardFormatA (lpszFormat="Rich Text Format") returned 0xc0b1 [0048.751] GetClassInfoA (in: hInstance=0x72940000, lpClassName="VBFocusRT6", lpWndClass=0x18fc34 | out: lpWndClass=0x18fc34) returned 0 [0048.751] RegisterClassA (lpWndClass=0x18fc34) returned 0xc16a [0048.752] GetClassInfoA (in: hInstance=0x72940000, lpClassName="VBBubbleRT6", lpWndClass=0x18fc34 | out: lpWndClass=0x18fc34) returned 0 [0048.752] RegisterClassA (lpWndClass=0x18fc34) returned 0xc121 [0048.752] HeapCreate (flOptions=0x0, dwInitialSize=0x400, dwMaximumSize=0x0) returned 0x280000 [0048.752] GetUserDefaultLCID () returned 0x409 [0048.752] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x3a4) returned 0x1661810 [0048.752] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x3a4) returned 0x1661bc0 [0048.753] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xd4) returned 0x1661f70 [0048.753] GetSystemInfo (in: lpSystemInfo=0x18fbf4 | out: lpSystemInfo=0x18fbf4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0048.753] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x1a0000 [0048.753] VirtualAlloc (lpAddress=0x1a0000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0048.753] VirtualAlloc (lpAddress=0x1a0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0048.754] VirtualAlloc (lpAddress=0x1a0000, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0048.754] VirtualAlloc (lpAddress=0x1a0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0048.754] VirtualAlloc (lpAddress=0x1a0000, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0048.754] VirtualAlloc (lpAddress=0x1a0000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0048.754] VirtualProtect (in: lpAddress=0x1a0000, dwSize=0x6000, flNewProtect=0x20, lpflOldProtect=0x18fc50 | out: lpflOldProtect=0x18fc50*=0x4) returned 1 [0048.756] GetCurrentProcess () returned 0xffffffff [0048.756] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x1a0000, dwSize=0x6000) returned 1 [0048.756] GlobalAddAtomA (lpString="VBDisabled") returned 0xc157 [0048.756] GetVersion () returned 0x1db10106 [0048.756] GetModuleHandleA (lpModuleName=0x7295a0cc) returned 0x76e40000 [0048.756] GetProcAddress (hModule=0x76e40000, lpProcName="DispCallFunc") returned 0x76e53dcf [0048.756] GetProcAddress (hModule=0x76e40000, lpProcName="LoadTypeLibEx") returned 0x76e507b7 [0048.757] GetProcAddress (hModule=0x76e40000, lpProcName="UnRegisterTypeLib") returned 0x76e71ca9 [0048.757] GetProcAddress (hModule=0x76e40000, lpProcName="CreateTypeLib2") returned 0x76e58e70 [0048.757] GetProcAddress (hModule=0x76e40000, lpProcName="VarDateFromUdate") returned 0x76e57684 [0048.757] GetProcAddress (hModule=0x76e40000, lpProcName="VarUdateFromDate") returned 0x76e5cc98 [0048.757] GetProcAddress (hModule=0x76e40000, lpProcName="GetAltMonthNames") returned 0x76e8903a [0048.757] GetProcAddress (hModule=0x76e40000, lpProcName="VarNumFromParseNum") returned 0x76e56231 [0048.757] GetProcAddress (hModule=0x76e40000, lpProcName="VarParseNumFromStr") returned 0x76e55fea [0048.758] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecFromR4") returned 0x76e63f94 [0048.758] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecFromR8") returned 0x76e64e9e [0048.758] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecFromDate") returned 0x76e8db72 [0048.758] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecFromI4") returned 0x76e72a8c [0048.758] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecFromCy") returned 0x76e8d737 [0048.758] GetProcAddress (hModule=0x76e40000, lpProcName="VarR4FromDec") returned 0x76e8e015 [0048.758] GetProcAddress (hModule=0x76e40000, lpProcName="GetRecordInfoFromTypeInfo") returned 0x76e8cc3d [0048.758] GetProcAddress (hModule=0x76e40000, lpProcName="GetRecordInfoFromGuids") returned 0x76e8d1c4 [0048.758] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayGetRecordInfo") returned 0x76e8d48c [0048.759] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArraySetRecordInfo") returned 0x76e8d4c6 [0048.759] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayGetIID") returned 0x76e8d509 [0048.759] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArraySetIID") returned 0x76e5e7bb [0048.759] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayCopyData") returned 0x76e5e496 [0048.759] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayAllocDescriptorEx") returned 0x76e5ddf1 [0048.759] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayCreateEx") returned 0x76e8d53f [0048.759] GetProcAddress (hModule=0x76e40000, lpProcName="VarFormat") returned 0x76e92055 [0048.759] GetProcAddress (hModule=0x76e40000, lpProcName="VarFormatDateTime") returned 0x76e920ea [0048.759] GetProcAddress (hModule=0x76e40000, lpProcName="VarFormatNumber") returned 0x76e92151 [0048.759] GetProcAddress (hModule=0x76e40000, lpProcName="VarFormatPercent") returned 0x76e921f5 [0048.760] GetProcAddress (hModule=0x76e40000, lpProcName="VarFormatCurrency") returned 0x76e92288 [0048.760] GetProcAddress (hModule=0x76e40000, lpProcName="VarWeekdayName") returned 0x76e92335 [0048.760] GetProcAddress (hModule=0x76e40000, lpProcName="VarMonthName") returned 0x76e923d5 [0048.760] GetProcAddress (hModule=0x76e40000, lpProcName="VarAdd") returned 0x76e65934 [0048.760] GetProcAddress (hModule=0x76e40000, lpProcName="VarAnd") returned 0x76e65a98 [0048.760] GetProcAddress (hModule=0x76e40000, lpProcName="VarCat") returned 0x76e659b4 [0048.760] GetProcAddress (hModule=0x76e40000, lpProcName="VarDiv") returned 0x76ebe405 [0048.760] GetProcAddress (hModule=0x76e40000, lpProcName="VarEqv") returned 0x76ebef07 [0048.761] GetProcAddress (hModule=0x76e40000, lpProcName="VarIdiv") returned 0x76ebf00a [0048.761] GetProcAddress (hModule=0x76e40000, lpProcName="VarImp") returned 0x76ebef47 [0048.761] GetProcAddress (hModule=0x76e40000, lpProcName="VarMod") returned 0x76ebf15e [0048.761] GetProcAddress (hModule=0x76e40000, lpProcName="VarMul") returned 0x76ebdbd4 [0048.761] GetProcAddress (hModule=0x76e40000, lpProcName="VarOr") returned 0x76ebecfa [0048.761] GetProcAddress (hModule=0x76e40000, lpProcName="VarPow") returned 0x76ebea66 [0048.761] GetProcAddress (hModule=0x76e40000, lpProcName="VarSub") returned 0x76ebd332 [0048.761] GetProcAddress (hModule=0x76e40000, lpProcName="VarXor") returned 0x76ebee2e [0048.761] GetProcAddress (hModule=0x76e40000, lpProcName="VarAbs") returned 0x76ebca11 [0048.762] GetProcAddress (hModule=0x76e40000, lpProcName="VarFix") returned 0x76ebcc5f [0048.762] GetProcAddress (hModule=0x76e40000, lpProcName="VarInt") returned 0x76ebcde7 [0048.762] GetProcAddress (hModule=0x76e40000, lpProcName="VarNeg") returned 0x76ebc802 [0048.762] GetProcAddress (hModule=0x76e40000, lpProcName="VarNot") returned 0x76ebec66 [0048.762] GetProcAddress (hModule=0x76e40000, lpProcName="VarRound") returned 0x76ebd155 [0048.762] GetProcAddress (hModule=0x76e40000, lpProcName="VarCmp") returned 0x76e5b0dc [0048.762] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecAdd") returned 0x76e75f3e [0048.762] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecCmp") returned 0x76e64fd0 [0048.762] GetProcAddress (hModule=0x76e40000, lpProcName="VarBstrCat") returned 0x76e60d2c [0048.762] GetProcAddress (hModule=0x76e40000, lpProcName="VarCyMulI4") returned 0x76e759ed [0048.763] GetProcAddress (hModule=0x76e40000, lpProcName="VarBstrCmp") returned 0x76e4f8b8 [0048.763] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x76620000 [0048.763] GetProcAddress (hModule=0x76620000, lpProcName="CoCreateInstanceEx") returned 0x76669d4e [0048.763] GetProcAddress (hModule=0x76620000, lpProcName="CLSIDFromProgIDEx") returned 0x76630782 [0048.763] GetSystemMetrics (nIndex=42) returned 0 [0048.763] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x72a4e688 | out: ppMalloc=0x72a4e688*=0x767666bc) returned 0x0 [0048.763] IMalloc:Alloc (This=0x767666bc, cb=0x4) returned 0x2d9358 [0048.763] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18f968, nSize=0x104 | out: lpFilename="C:\\ProgramData\\zhang.exe" (normalized: "c:\\programdata\\zhang.exe")) returned 0x18 [0048.764] lstrcatA (in: lpString1="C:\\ProgramData\\zhang.exe", lpString2=".cfg" | out: lpString1="C:\\ProgramData\\zhang.exe.cfg") returned="C:\\ProgramData\\zhang.exe.cfg" [0048.764] SetLastError (dwErrCode=0x0) [0048.764] SearchPathA (in: lpPath=0x0, lpFileName="C:\\ProgramData\\zhang.exe.cfg", lpExtension=0x0, nBufferLength=0x103, lpBuffer=0x18f864, lpFilePart=0x18f838 | out: lpBuffer="|ú\x18", lpFilePart=0x18f838) returned 0x0 [0048.764] SetLastError (dwErrCode=0x2) [0048.764] GetLastError () returned 0x2 [0048.764] lstrcmpiA (lpString1="zhang", lpString2="MTX") returned 1 [0048.764] lstrcmpiA (lpString1="zhang", lpString2="DLLHOST") returned 1 [0048.764] lstrcmpiA (lpString1="zhang", lpString2="INETINFO") returned 1 [0048.764] lstrcmpiA (lpString1="zhang", lpString2="W3WP") returned 1 [0048.764] lstrcmpiA (lpString1="zhang", lpString2="ASPNET_WP") returned 1 [0048.764] lstrcmpiA (lpString1="zhang", lpString2="DLLHST3G") returned 1 [0048.764] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18f95c, nSize=0x104 | out: lpFilename="C:\\ProgramData\\zhang.exe" (normalized: "c:\\programdata\\zhang.exe")) returned 0x18 [0048.764] lstrcmpiA (lpString1="zhang", lpString2="IEXPLORE") returned 1 [0048.764] LoadLibraryA (lpLibFileName="SXS.DLL") returned 0x75620000 [0048.766] GetLastError () returned 0x0 [0048.766] GetProcAddress (hModule=0x75620000, lpProcName="SxsOleAut32MapIIDOrCLSIDToTypeLibrary") returned 0x75667685 [0048.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18feac, cbMultiByte=-1, lpWideCharStr=0x18fea8, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.766] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x1c) returned 0x1662050 [0048.766] CoRegisterMessageFilter (in: lpMessageFilter=0x1662054, lplpMessageFilter=0x166205c | out: lplpMessageFilter=0x166205c*=0x0) returned 0x0 [0048.766] IUnknown:AddRef (This=0x1662054) returned 0x2 [0048.767] GetClassInfoExA (in: hInstance=0x72940000, lpszClass="ThunderRT6Main", lpwcx=0x18fe78 | out: lpwcx=0x18fe78) returned 0 [0048.767] LoadIconA (hInstance=0x400000, lpIconName=0x1) returned 0x5018b [0048.767] GetModuleHandleA (lpModuleName="USER32") returned 0x77130000 [0048.768] GetProcAddress (hModule=0x77130000, lpProcName="GetSystemMetrics") returned 0x77147d2f [0048.768] GetProcAddress (hModule=0x77130000, lpProcName="MonitorFromWindow") returned 0x77153150 [0048.768] GetProcAddress (hModule=0x77130000, lpProcName="MonitorFromRect") returned 0x7716e7a0 [0048.768] GetProcAddress (hModule=0x77130000, lpProcName="MonitorFromPoint") returned 0x77155281 [0048.768] GetProcAddress (hModule=0x77130000, lpProcName="EnumDisplayMonitors") returned 0x7715451a [0048.768] GetProcAddress (hModule=0x77130000, lpProcName="GetMonitorInfoA") returned 0x77154413 [0048.768] GetSystemMetrics (nIndex=0) returned 1440 [0048.768] GetSystemMetrics (nIndex=78) returned 1440 [0048.768] GetSystemMetrics (nIndex=1) returned 900 [0048.768] GetSystemMetrics (nIndex=79) returned 900 [0048.768] GetSystemMetrics (nIndex=50) returned 16 [0048.768] GetSystemMetrics (nIndex=49) returned 16 [0048.768] LoadImageA (hInst=0x400000, name=0x1, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x700e7 [0048.769] RegisterClassExA (param_1=0x18fe78) returned 0x98c162 [0048.769] CreateWindowExA (dwExStyle=0x80, lpClassName="ThunderRT6Main", lpWindowName=0x0, dwStyle=0x80090000, X=-2147483648, Y=-2147483648, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x72940000, lpParam=0x0) returned 0x4015c [0048.769] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x81, wParam=0x0, lParam=0x18fa5c) returned 0x1 [0048.770] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x83, wParam=0x0, lParam=0x18fa48) returned 0x0 [0048.770] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x1, wParam=0x0, lParam=0x18fa5c) returned 0x0 [0048.770] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0048.771] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0048.771] MonitorFromWindow (hwnd=0x4015c, dwFlags=0x2) returned 0x10001 [0048.771] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0x18fe80 | out: lpmi=0x18fe80) returned 1 [0048.771] SetWindowPos (hWnd=0x4015c, hWndInsertAfter=0x0, X=720, Y=450, cx=0, cy=0, uFlags=0x1d) returned 1 [0048.771] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x46, wParam=0x0, lParam=0x18fe20) returned 0x0 [0048.772] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x47, wParam=0x0, lParam=0x18fe20) returned 0x0 [0048.772] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x3, wParam=0x0, lParam=0x1c202d0) returned 0x0 [0048.772] ShowWindow (hWnd=0x4015c, nCmdShow=4) returned 0 [0048.772] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0048.772] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x46, wParam=0x0, lParam=0x18fe34) returned 0x0 [0048.772] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x47, wParam=0x0, lParam=0x18fe34) returned 0x0 [0048.773] GetWindowThreadProcessId (in: hWnd=0x4015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa94 [0048.773] VirtualQuery (in: lpAddress=0x18fea8, lpBuffer=0x18fe8c, dwLength=0x1c | out: lpBuffer=0x18fe8c*(BaseAddress=0x18f000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0048.773] GetUserDefaultLCID () returned 0x409 [0048.773] IsValidCodePage (CodePage=0x3a4) returned 1 [0048.773] IsValidCodePage (CodePage=0x3b5) returned 1 [0048.773] IsValidCodePage (CodePage=0x3b6) returned 1 [0048.773] IsValidCodePage (CodePage=0x3a8) returned 1 [0048.778] GetUserDefaultLangID () returned 0x409 [0048.778] GetSystemDefaultLangID () returned 0x2d0409 [0048.778] GetSystemMetrics (nIndex=42) returned 0 [0048.779] IMalloc:Alloc (This=0x767666bc, cb=0xa8) returned 0x2d9a68 [0048.779] IMalloc:GetSize (This=0x767666bc, pv=0x2d9a68) returned 0xa8 [0048.779] IMalloc:Alloc (This=0x767666bc, cb=0xc) returned 0x2dc988 [0048.779] GetCurrentThreadId () returned 0xa94 [0048.779] IMalloc:Alloc (This=0x767666bc, cb=0x3c) returned 0x2d9368 [0048.779] IMalloc:Alloc (This=0x767666bc, cb=0x1c) returned 0x2d5608 [0048.779] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\VBA\\Monitors", phkResult=0x18fe74 | out: phkResult=0x18fe74*=0x0) returned 0x2 [0048.779] IMalloc:Alloc (This=0x767666bc, cb=0x1c) returned 0x2d5630 [0048.779] GetCurrentThreadId () returned 0xa94 [0048.779] SetWindowsHookExA (idHook=-1, lpfn=0x729a1e09, hmod=0x0, dwThreadId=0xa94) returned 0xc0065 [0048.779] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x14) returned 0x1662078 [0048.779] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x80) returned 0x1662098 [0048.780] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x10) returned 0x1662120 [0048.780] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x2c) returned 0x1662138 [0048.780] GetClassInfoA (in: hInstance=0x72940000, lpClassName="VBMsoStdCompMgr", lpWndClass=0x18fdcc | out: lpWndClass=0x18fdcc) returned 0 [0048.780] RegisterClassA (lpWndClass=0x18fdcc) returned 0xa2c163 [0048.780] CreateWindowExA (dwExStyle=0x0, lpClassName="VBMsoStdCompMgr", lpWindowName=0x0, dwStyle=0x80000000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x72940000, lpParam=0x0) returned 0x30160 [0048.780] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x81, wParam=0x0, lParam=0x18fa08) returned 0x1 [0048.780] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x83, wParam=0x0, lParam=0x18f9f4) returned 0x0 [0048.780] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x1, wParam=0x0, lParam=0x18fa08) returned 0x0 [0048.781] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0048.781] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0048.781] SetWindowLongA (hWnd=0x30160, nIndex=0, dwNewLong=23470236) returned 0 [0048.781] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x38) returned 0x1662170 [0048.781] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16621b0 [0048.781] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x10) returned 0x16621d0 [0048.781] RegisterClipboardFormatA (lpszFormat="Object Descriptor") returned 0xc00e [0048.781] RegisterClipboardFormatA (lpszFormat="Link Source Descriptor") returned 0xc00f [0048.781] RegisterClipboardFormatA (lpszFormat="Embed Source") returned 0xc00b [0048.781] RegisterClipboardFormatA (lpszFormat="Embedded Object") returned 0xc00a [0048.781] RegisterClipboardFormatA (lpszFormat="Link Source") returned 0xc00d [0048.781] RegisterClipboardFormatA (lpszFormat="OwnerLink") returned 0xc003 [0048.782] RegisterClipboardFormatA (lpszFormat="FileName") returned 0xc006 [0048.782] CreateCompatibleDC (hdc=0x0) returned 0x230101b3 [0048.782] GetCurrentObject (hdc=0x230101b3, type=0x7) returned 0x185000f [0048.782] CreateWindowExA (dwExStyle=0x0, lpClassName="VBFocusRT6", lpWindowName=0x0, dwStyle=0x40000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x4015c, hMenu=0x0, hInstance=0x72940000, lpParam=0x0) returned 0x3015e [0048.782] NtdllDefWindowProc_A (hWnd=0x3015e, Msg=0x81, wParam=0x0, lParam=0x18fa98) returned 0x1 [0048.782] NtdllDefWindowProc_A (hWnd=0x3015e, Msg=0x83, wParam=0x0, lParam=0x18fa84) returned 0x0 [0048.782] NtdllDefWindowProc_A (hWnd=0x3015e, Msg=0x1, wParam=0x0, lParam=0x18fa98) returned 0x0 [0048.783] NtdllDefWindowProc_A (hWnd=0x3015e, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0048.783] NtdllDefWindowProc_A (hWnd=0x3015e, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0048.783] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x210, wParam=0x1, lParam=0x3015e) returned 0x0 [0048.783] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16621e8 [0048.783] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x114) returned 0x2807d0 [0048.783] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x5c) returned 0x1662208 [0048.784] GetCurrentThreadId () returned 0xa94 [0048.784] GetCurrentThreadId () returned 0xa94 [0048.784] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x10) returned 0x1662270 [0048.784] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x30) returned 0x1662288 [0048.784] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x434) returned 0x16622c0 [0048.784] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x434) returned 0x1662700 [0048.784] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x3c) returned 0x1662b40 [0048.784] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1662b88 [0048.784] lstrlenA (lpString="VB") returned 2 [0048.784] lstrlenA (lpString=0x72956af8) returned 10 [0048.784] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xe) returned 0x1662ca8 [0048.785] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x16c) returned 0x1662cc0 [0048.785] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x68) returned 0x1662e38 [0048.785] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x2c8) returned 0x1662ea8 [0048.785] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x28) returned 0x1663178 [0048.785] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x16631a8 [0048.785] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x28) returned 0x16631c8 [0048.785] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x16631f8 [0048.786] lstrlenA (lpString="VB") returned 2 [0048.786] lstrlenA (lpString="Label") returned 5 [0048.786] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x9) returned 0x1663318 [0048.786] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x34) returned 0x1663330 [0048.786] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xf0) returned 0x1663370 [0048.786] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x48) returned 0x1663468 [0048.786] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x1f4) returned 0x16634b8 [0048.786] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x16636b8 [0048.786] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x16636d8 [0048.787] lstrlenA (lpString="VB") returned 2 [0048.787] lstrlenA (lpString="TextBox") returned 7 [0048.787] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xb) returned 0x16637f8 [0048.787] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x38) returned 0x1663810 [0048.787] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x120) returned 0x1663850 [0048.787] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x60) returned 0x1663978 [0048.787] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x250) returned 0x16639e0 [0048.787] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1663c38 [0048.787] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1663c58 [0048.787] lstrlenA (lpString="VB") returned 2 [0048.787] lstrlenA (lpString="Frame") returned 5 [0048.787] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x9) returned 0x1663d78 [0048.787] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x24) returned 0x1663d90 [0048.787] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xb0) returned 0x1663dc0 [0048.787] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x34) returned 0x1663e78 [0048.788] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x184) returned 0x1663eb8 [0048.788] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1664048 [0048.788] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1664068 [0048.788] lstrlenA (lpString="VB") returned 2 [0048.788] lstrlenA (lpString="CommandButton") returned 13 [0048.788] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x11) returned 0x1664188 [0048.788] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x28) returned 0x16641a8 [0048.788] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xd4) returned 0x16641d8 [0048.788] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x44) returned 0x16642b8 [0048.788] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x1c8) returned 0x1664308 [0048.789] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x16644d8 [0048.789] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x16644f8 [0048.789] lstrlenA (lpString="VB") returned 2 [0048.789] lstrlenA (lpString="ListBox") returned 7 [0048.789] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xb) returned 0x1664618 [0048.789] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x108) returned 0x1664630 [0048.789] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x54) returned 0x1664740 [0048.789] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x230) returned 0x16647a0 [0048.789] RtlReAllocateHeap (Heap=0x1660000, Flags=0x0, Ptr=0x1663178, Size=0x50) returned 0x16649d8 [0048.789] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1663178 [0048.789] RtlReAllocateHeap (Heap=0x1660000, Flags=0x0, Ptr=0x16631c8, Size=0x50) returned 0x1664a30 [0048.790] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1664a88 [0048.790] lstrlenA (lpString="VB") returned 2 [0048.790] lstrlenA (lpString="Timer") returned 5 [0048.790] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x9) returned 0x16631c8 [0048.790] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xc) returned 0x16631e0 [0048.790] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x30) returned 0x1664ba8 [0048.790] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x4) returned 0x1663198 [0048.790] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x9c) returned 0x1664be0 [0048.790] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1664c88 [0048.791] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1664ca8 [0048.791] lstrlenA (lpString="VB") returned 2 [0048.791] lstrlenA (lpString="Printer") returned 7 [0048.791] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xb) returned 0x1664dc8 [0048.791] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xdc) returned 0x1664de0 [0048.794] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1664ec8 [0048.794] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1664ee8 [0048.794] lstrlenA (lpString="VB") returned 2 [0048.794] lstrlenA (lpString="Form") returned 4 [0048.794] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x8) returned 0x1665008 [0048.794] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x184) returned 0x1665018 [0048.794] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x7c) returned 0x16651a8 [0048.794] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x2f8) returned 0x1665230 [0048.795] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1665530 [0048.795] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1665550 [0048.795] lstrlenA (lpString="VB") returned 2 [0048.795] lstrlenA (lpString="Screen") returned 6 [0048.795] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xa) returned 0x1665670 [0048.795] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x2c) returned 0x1665688 [0048.795] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xa0) returned 0x16656c0 [0048.795] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1665768 [0048.795] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1665788 [0048.795] lstrlenA (lpString="VB") returned 2 [0048.795] lstrlenA (lpString="Clipboard") returned 9 [0048.795] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xd) returned 0x16658a8 [0048.796] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x1c) returned 0x16658c0 [0048.796] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x68) returned 0x16658e8 [0048.796] RtlReAllocateHeap (Heap=0x1660000, Flags=0x0, Ptr=0x16649d8, Size=0x78) returned 0x1665958 [0048.796] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x16649d8 [0048.796] RtlReAllocateHeap (Heap=0x1660000, Flags=0x0, Ptr=0x1664a30, Size=0x78) returned 0x16659d8 [0048.796] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1665a58 [0048.796] lstrlenA (lpString="VB") returned 2 [0048.796] lstrlenA (lpString="FileListBox") returned 11 [0048.796] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xf) returned 0x16649f8 [0048.796] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x28) returned 0x1664a10 [0048.796] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xec) returned 0x1665b78 [0048.796] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x58) returned 0x1665c70 [0048.797] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x1f8) returned 0x1665cd0 [0048.797] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1664a40 [0048.797] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1665ed0 [0048.797] lstrlenA (lpString="VB") returned 2 [0048.797] lstrlenA (lpString="MDIForm") returned 7 [0048.797] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xb) returned 0x1664a60 [0048.797] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x184) returned 0x1665ff0 [0048.797] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x7c) returned 0x1666180 [0048.797] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x2f8) returned 0x1666208 [0048.798] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1666508 [0048.798] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1670d90 [0048.798] lstrlenA (lpString="VB") returned 2 [0048.798] lstrlenA (lpString="App") returned 3 [0048.798] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x7) returned 0x1664a78 [0048.798] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x84) returned 0x1670eb0 [0048.799] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x148) returned 0x1670f40 [0048.799] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1671090 [0048.799] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x16710b0 [0048.799] lstrlenA (lpString="VB") returned 2 [0048.799] lstrlenA (lpString="Image") returned 5 [0048.799] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x9) returned 0x16711d0 [0048.799] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x24) returned 0x16711e8 [0048.799] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x98) returned 0x1671218 [0048.799] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x34) returned 0x16712b8 [0048.799] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x154) returned 0x16712f8 [0048.800] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1671470 [0048.800] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1672058 [0048.800] lstrlenA (lpString="VB") returned 2 [0048.800] lstrlenA (lpString="UserControl") returned 11 [0048.800] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xf) returned 0x1672178 [0048.800] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x1e4) returned 0x1672190 [0048.800] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xb0) returned 0x1672380 [0048.800] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x3a4) returned 0x1672438 [0048.800] RtlReAllocateHeap (Heap=0x1660000, Flags=0x0, Ptr=0x1665958, Size=0xa0) returned 0x16727e8 [0048.801] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1671490 [0048.801] RtlReAllocateHeap (Heap=0x1660000, Flags=0x0, Ptr=0x16659d8, Size=0xa0) returned 0x1672890 [0048.801] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1672938 [0048.801] lstrlenA (lpString="VB") returned 2 [0048.801] lstrlenA (lpString="PropertyPage") returned 12 [0048.801] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x10) returned 0x1672a70 [0048.801] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x190) returned 0x1672e58 [0048.801] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x88) returned 0x1665958 [0048.801] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x310) returned 0x1672ff0 [0048.801] lstrcmpiA (lpString1="VB.MDIForm", lpString2="VB.PropertyPage") returned -1 [0048.801] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x16714b0 [0048.802] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1673320 [0048.802] lstrlenA (lpString="VB") returned 2 [0048.802] lstrlenA (lpString="UserDocument") returned 12 [0048.802] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x10) returned 0x1672a88 [0048.802] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x1c8) returned 0x1675308 [0048.802] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xa8) returned 0x16754d8 [0048.802] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x370) returned 0x1675588 [0048.802] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x16714d0 [0048.803] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x20) returned 0x16659e8 [0048.803] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x170) returned 0x1675900 [0048.803] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1673448 [0048.803] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x12c) returned 0x1675a78 [0048.803] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x24) returned 0x1665a10 [0048.803] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x16714f0 [0048.803] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x30) returned 0x2808f0 [0048.804] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xa0) returned 0x1675bb0 [0048.804] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x28) returned 0x1675c58 [0048.804] GetCurrentThreadId () returned 0xa94 [0048.804] GetCurrentThreadId () returned 0xa94 [0048.804] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x10) returned 0x1672aa0 [0048.804] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x30) returned 0x280928 [0048.804] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xa0) returned 0x1675c88 [0048.804] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x28) returned 0x1675d30 [0048.804] GetCurrentThreadId () returned 0xa94 [0048.804] GetCurrentThreadId () returned 0xa94 [0048.804] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x10) returned 0x1672ab8 [0048.804] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x30) returned 0x280960 [0048.805] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xa0) returned 0x1675d60 [0048.805] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x28) returned 0x1675e08 [0048.805] GetCurrentThreadId () returned 0xa94 [0048.805] GetCurrentThreadId () returned 0xa94 [0048.805] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x10) returned 0x1672ad0 [0048.805] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x30) returned 0x280998 [0048.805] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xa0) returned 0x1675e38 [0048.805] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x28) returned 0x1675ee0 [0048.806] GetCurrentThreadId () returned 0xa94 [0048.806] GetCurrentThreadId () returned 0xa94 [0048.806] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x10) returned 0x1672ae8 [0048.806] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1673570 [0048.806] lstrlenA (lpString="VB") returned 2 [0048.806] lstrlenA (lpString="CheckBox") returned 8 [0048.806] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672b00 [0048.806] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x28) returned 0x1675f10 [0048.806] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xec) returned 0x1675f40 [0048.806] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x48) returned 0x1676038 [0048.807] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x1f8) returned 0x1676088 [0048.808] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1671510 [0048.808] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1673698 [0048.808] lstrlenA (lpString="VB") returned 2 [0048.808] lstrlenA (lpString="OptionButton") returned 12 [0048.808] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x10) returned 0x1672b18 [0048.808] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x28) returned 0x1676288 [0048.808] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xd4) returned 0x16762b8 [0048.808] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x4c) returned 0x1676398 [0048.808] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x1c8) returned 0x16763f0 [0048.809] RtlReAllocateHeap (Heap=0x1660000, Flags=0x0, Ptr=0x16727e8, Size=0xc8) returned 0x16765c0 [0048.809] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1671530 [0048.809] RtlReAllocateHeap (Heap=0x1660000, Flags=0x0, Ptr=0x1672890, Size=0xc8) returned 0x1676690 [0048.809] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x16737c0 [0048.810] lstrlenA (lpString="VB") returned 2 [0048.810] lstrlenA (lpString="ComboBox") returned 8 [0048.810] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672b30 [0048.810] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x108) returned 0x16727e8 [0048.810] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x4c) returned 0x1676760 [0048.810] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x230) returned 0x16767b8 [0048.811] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1671550 [0048.811] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x16738e8 [0048.811] lstrlenA (lpString="VB") returned 2 [0048.811] lstrlenA (lpString="HScrollBar") returned 10 [0048.811] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xe) returned 0x1672b48 [0048.811] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x24) returned 0x16728f8 [0048.811] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x90) returned 0x16769f0 [0048.811] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x28) returned 0x1676a88 [0048.812] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x144) returned 0x1676ab8 [0048.812] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1671570 [0048.813] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1673a10 [0048.813] lstrlenA (lpString="VB") returned 2 [0048.813] lstrlenA (lpString="VScrollBar") returned 10 [0048.813] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xe) returned 0x1672b60 [0048.813] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x24) returned 0x1676c08 [0048.813] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x90) returned 0x1676c38 [0048.813] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x28) returned 0x1676cd0 [0048.813] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x144) returned 0x1676d00 [0048.814] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1671590 [0048.814] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1673b38 [0048.814] lstrlenA (lpString="VB") returned 2 [0048.814] lstrlenA (lpString="DriveListBox") returned 12 [0048.814] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x10) returned 0x1672b78 [0048.814] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x28) returned 0x1676e50 [0048.814] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xc0) returned 0x1676e80 [0048.814] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x40) returned 0x1676f48 [0048.815] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x1a0) returned 0x1676f90 [0048.815] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x16715b0 [0048.816] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1673c60 [0048.816] lstrlenA (lpString="VB") returned 2 [0048.816] lstrlenA (lpString="DirListBox") returned 10 [0048.816] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xe) returned 0x1672b90 [0048.816] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x28) returned 0x1677138 [0048.816] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xc8) returned 0x1677168 [0048.816] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x50) returned 0x1677238 [0048.816] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x1b0) returned 0x1677290 [0048.817] RtlReAllocateHeap (Heap=0x1660000, Flags=0x0, Ptr=0x16765c0, Size=0xf0) returned 0x1677448 [0048.817] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x16715d0 [0048.817] RtlReAllocateHeap (Heap=0x1660000, Flags=0x0, Ptr=0x1676690, Size=0xf0) returned 0x1677540 [0048.817] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1673d88 [0048.817] lstrlenA (lpString="VB") returned 2 [0048.817] lstrlenA (lpString="Menu") returned 4 [0048.818] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x8) returned 0x1672928 [0048.818] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x38) returned 0x16765c0 [0048.818] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x4) returned 0x1665a40 [0048.818] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xb8) returned 0x1676600 [0048.818] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x16715f0 [0048.818] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1673eb0 [0048.819] lstrlenA (lpString="VB") returned 2 [0048.819] lstrlenA (lpString="Shape") returned 5 [0048.819] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x9) returned 0x1672ba8 [0048.819] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x1c) returned 0x16766c0 [0048.819] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x68) returned 0x16766e8 [0048.819] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xfc) returned 0x1677638 [0048.819] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1671610 [0048.819] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1673fd8 [0048.819] lstrlenA (lpString="VB") returned 2 [0048.819] lstrlenA (lpString="Line") returned 4 [0048.819] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x8) returned 0x1677740 [0048.820] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x1671630 [0048.820] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x50) returned 0x1677750 [0048.820] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xd0) returned 0x16777a8 [0048.820] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1671650 [0048.820] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1674100 [0048.820] lstrlenA (lpString="VB") returned 2 [0048.820] lstrlenA (lpString="Data") returned 4 [0048.820] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x8) returned 0x1677880 [0048.820] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xd8) returned 0x1677890 [0048.821] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x3c) returned 0x1677970 [0048.821] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x1d8) returned 0x16779b8 [0048.821] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1671670 [0048.821] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x114) returned 0x1674228 [0048.821] lstrlenA (lpString="VB") returned 2 [0048.821] lstrlenA (lpString="OLE") returned 3 [0048.821] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x7) returned 0x1677b98 [0048.821] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x17c) returned 0x1677ba8 [0048.821] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x40) returned 0x1677d30 [0048.821] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x2f0) returned 0x1677d78 [0048.822] RtlReAllocateHeap (Heap=0x1660000, Flags=0x0, Ptr=0x1677448, Size=0x118) returned 0x1678070 [0048.822] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1671690 [0048.823] RtlReAllocateHeap (Heap=0x1660000, Flags=0x0, Ptr=0x1677540, Size=0x118) returned 0x1678190 [0048.823] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2dd2e8 [0048.823] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2dd358 [0048.823] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2dd3c8 [0048.823] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2dd438 [0048.823] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2dd4a8 [0048.823] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2dd518 [0048.823] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2dd588 [0048.823] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2dd5f8 [0048.823] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2dd668 [0048.823] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2dd6d8 [0048.823] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2dd748 [0048.824] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2dd7b8 [0048.824] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2dd828 [0048.824] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2dd898 [0048.824] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2dd920 [0048.824] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2dd990 [0048.824] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2dda00 [0048.824] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2dda70 [0048.824] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2ddae0 [0048.824] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2ddb50 [0048.824] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2ddbc0 [0048.824] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2ddc30 [0048.824] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x2ddca0 [0048.824] IMalloc:Alloc (This=0x767666bc, cb=0xc) returned 0x2dc9a0 [0048.824] IMalloc:Alloc (This=0x767666bc, cb=0x1e4) returned 0x2de908 [0048.824] IMalloc:GetSize (This=0x767666bc, pv=0x2de908) returned 0x1e4 [0048.825] IMalloc:Alloc (This=0x767666bc, cb=0x20) returned 0x2d5810 [0048.825] GetCurrentThreadId () returned 0xa94 [0048.825] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x54) returned 0x1677448 [0048.825] GetCurrentThreadId () returned 0xa94 [0048.825] IMalloc:Alloc (This=0x767666bc, cb=0x1c) returned 0x2d5838 [0048.825] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x104) returned 0x16774a8 [0048.825] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x6f8) returned 0x16782b0 [0048.826] VirtualProtect (in: lpAddress=0x1a0000, dwSize=0x6000, flNewProtect=0x4, lpflOldProtect=0x18fdf8 | out: lpflOldProtect=0x18fdf8*=0x20) returned 1 [0048.826] GetCurrentProcess () returned 0xffffffff [0048.826] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x1a0000, dwSize=0x6000) returned 1 [0048.826] VirtualAlloc (lpAddress=0x1a0000, dwSize=0x7000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0048.826] VirtualAlloc (lpAddress=0x1a0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0048.827] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xd4) returned 0x16789b0 [0048.827] VirtualAlloc (lpAddress=0x1a0000, dwSize=0x9000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0048.827] VirtualAlloc (lpAddress=0x1a0000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0048.827] VirtualProtect (in: lpAddress=0x1a0000, dwSize=0xa000, flNewProtect=0x20, lpflOldProtect=0x18fdf8 | out: lpflOldProtect=0x18fdf8*=0x4) returned 1 [0048.829] GetCurrentProcess () returned 0xffffffff [0048.829] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x1a0000, dwSize=0xa000) returned 1 [0048.829] GetCurrentThreadId () returned 0xa94 [0048.829] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x23ec) returned 0x1678a90 [0048.846] GetCurrentThreadId () returned 0xa94 [0048.846] SetWindowTextA (hWnd=0x4015c, lpString="xydo") returned 1 [0048.846] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0xc, wParam=0x0, lParam=0x18fd6c) returned 0x1 [0048.846] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\VBA\\Monitors", phkResult=0x18fd54 | out: phkResult=0x18fd54*=0x0) returned 0x2 [0048.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP", cchWideChar=5, lpMultiByteStr=0x18f9b4, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TEMP", lpUsedDefaultChar=0x0) returned 5 [0048.847] CompareStringA (Locale=0x0, dwCmpFlags=0x0, lpString1="", cchCount1=1, lpString2="", cchCount2=1) returned 2 [0048.847] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchCount1=4, lpString2="TEMP", cchCount2=4) returned 1 [0048.847] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchCount1=4, lpString2="TEMP", cchCount2=4) returned 2 [0048.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd0795, cbMultiByte=37, lpWideCharStr=0x2deafc, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 37 [0048.847] SysReAllocStringLen (in: pbstr=0x18fa44*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", psz=0x0, len=0x24 | out: pbstr=0x18fa44*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 1 [0048.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x18f48c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 37 [0048.847] GetFullPathNameA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", nBufferLength=0x104, lpBuffer=0x18f6c8, lpFilePart=0x18f484 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpFilePart=0x18f484*="Temp") returned 0x24 [0048.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x18f914, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 37 [0048.847] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpFindFileData=0x18f464 | out: lpFindFileData=0x18f464*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x197ccc20, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x197ccc20, ftLastWriteTime.dwHighDateTime=0x1d68e85, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2deb48, dwReserved1=0x2c0000, cFileName="Temp", cAlternateFileName="")) returned 0x2deba8 [0048.848] FileTimeToLocalFileTime (in: lpFileTime=0x18f468, lpLocalFileTime=0x18f438 | out: lpLocalFileTime=0x18f438) returned 1 [0048.848] FileTimeToSystemTime (in: lpFileTime=0x18f438, lpSystemTime=0x18f440 | out: lpSystemTime=0x18f440) returned 1 [0048.849] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="OS=Windows_NT", cchCount1=2, lpString2="TZ", cchCount2=2) returned 1 [0048.849] GetTimeZoneInformation (in: lpTimeZoneInformation=0x72a50f68 | out: lpTimeZoneInformation=0x72a50f68) returned 0x1 [0048.851] FileTimeToLocalFileTime (in: lpFileTime=0x18f470, lpLocalFileTime=0x18f438 | out: lpLocalFileTime=0x18f438) returned 1 [0048.851] FileTimeToSystemTime (in: lpFileTime=0x18f438, lpSystemTime=0x18f440 | out: lpSystemTime=0x18f440) returned 1 [0048.851] FileTimeToLocalFileTime (in: lpFileTime=0x18f478, lpLocalFileTime=0x18f438 | out: lpLocalFileTime=0x18f438) returned 1 [0048.851] FileTimeToSystemTime (in: lpFileTime=0x18f438, lpSystemTime=0x18f440 | out: lpSystemTime=0x18f440) returned 1 [0048.851] FindNextFileA (in: hFindFile=0x2deba8, lpFindFileData=0x18f464 | out: lpFindFileData=0x18f464*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x197ccc20, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x197ccc20, ftLastWriteTime.dwHighDateTime=0x1d68e85, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2deb48, dwReserved1=0x2c0000, cFileName="Temp", cAlternateFileName="")) returned 0 [0048.851] GetLastError () returned 0x12 [0048.851] GetLastError () returned 0x12 [0048.851] SetLastError (dwErrCode=0x12) [0048.851] FindClose (in: hFindFile=0x2deba8 | out: hFindFile=0x2deba8) returned 1 [0048.851] GetLastError () returned 0x12 [0048.851] SetLastError (dwErrCode=0x12) [0048.851] VarBstrCmp (bstrLeft="", bstrRight="", lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP", cchWideChar=5, lpMultiByteStr=0x18f9b4, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TEMP", lpUsedDefaultChar=0x0) returned 5 [0048.852] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchCount1=4, lpString2="TEMP", cchCount2=4) returned 1 [0048.852] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchCount1=4, lpString2="TEMP", cchCount2=4) returned 2 [0048.852] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd0795, cbMultiByte=37, lpWideCharStr=0x2df11c, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 37 [0048.852] SysReAllocStringLen (in: pbstr=0x18fa44*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", psz=0x0, len=0x24 | out: pbstr=0x18fa44*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 1 [0048.852] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.852] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.853] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.853] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x0 [0048.853] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.853] VarBstrCmp (bstrLeft="C:\\Users\\5P5NRG~1\\AppData\\Local", bstrRight="", lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\", cchWideChar=-1, lpMultiByteStr=0x18f3c4, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\", lpUsedDefaultChar=0x0) returned 33 [0048.854] GetFullPathNameA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\", nBufferLength=0x104, lpBuffer=0x18f600, lpFilePart=0x18f3bc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\", lpFilePart=0x18f3bc*=0x0) returned 0x20 [0048.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\", cchWideChar=-1, lpMultiByteStr=0x18f84c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\", lpUsedDefaultChar=0x0) returned 33 [0048.854] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\*.*", lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df168, dwReserved1=0x2c0000, cFileName=".", cAlternateFileName="")) returned 0x2deba8 [0048.854] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f370 | out: lpLocalFileTime=0x18f370) returned 1 [0048.854] FileTimeToSystemTime (in: lpFileTime=0x18f370, lpSystemTime=0x18f378 | out: lpSystemTime=0x18f378) returned 1 [0048.854] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f370 | out: lpLocalFileTime=0x18f370) returned 1 [0048.854] FileTimeToSystemTime (in: lpFileTime=0x18f370, lpSystemTime=0x18f378 | out: lpSystemTime=0x18f378) returned 1 [0048.854] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f370 | out: lpLocalFileTime=0x18f370) returned 1 [0048.854] FileTimeToSystemTime (in: lpFileTime=0x18f370, lpSystemTime=0x18f378 | out: lpSystemTime=0x18f378) returned 1 [0048.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f728, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0048.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f728, cbMultiByte=-1, lpWideCharStr=0x2dc9bc, cchWideChar=2 | out: lpWideCharStr=".") returned 2 [0048.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x18f86c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 37 [0048.854] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp"), lpSecurityAttributes=0x0) returned 0 [0048.855] GetLastError () returned 0xb7 [0048.855] GetLastError () returned 0xb7 [0048.855] SetLastError (dwErrCode=0xb7) [0048.855] GetLastError () returned 0xb7 [0048.855] SetLastError (dwErrCode=0xb7) [0048.855] GetLastError () returned 0xb7 [0048.855] SetLastError (dwErrCode=0xb7) [0048.855] GetLastError () returned 0xb7 [0048.855] SetLastError (dwErrCode=0xb7) [0048.855] GetLastError () returned 0xb7 [0048.855] SetLastError (dwErrCode=0xb7) [0048.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0048.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x2dc9bc, cchWideChar=5 | out: lpWideCharStr="xyno") returned 5 [0048.855] RaiseException (dwExceptionCode=0xc000008f, dwExceptionFlags=0x1, nNumberOfArguments=0x2, lpArguments=0x18f828) [0048.856] RtlUnwind (TargetFrame=0x18fa28, TargetIp=0x72a43caf, ExceptionRecord=0x0, ReturnValue=0x0) [0048.856] SysStringLen (param_1=" ") returned 0xff [0048.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=255, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 255 [0048.857] SysStringLen (param_1=" ") returned 0xff [0048.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=256, lpMultiByteStr=0x2df38c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 256 [0048.857] SetErrorMode (uMode=0x8001) returned 0x8001 [0048.857] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77710000 [0048.857] SetErrorMode (uMode=0x8001) returned 0x8001 [0048.857] GetProcAddress (hModule=0x77710000, lpProcName="GetUserNameA") returned 0x7773a4b4 [0048.857] GetUserNameA (in: lpBuffer=0x2df38c, pcbBuffer=0x18fa24 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18fa24) returned 1 [0048.859] GetLastError () returned 0x0 [0048.859] SysStringByteLen (bstr="瀵丵䝲湊樰⁓䅈偌捭穸 †††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††† ") returned 0xff [0048.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2df38c, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0048.859] SysStringByteLen (bstr="瀵丵䝲湊樰⁓䅈偌捭穸 †††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††††† ") returned 0xff [0048.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2df38c, cbMultiByte=256, lpWideCharStr=0x2df174, cchWideChar=511 | out: lpWideCharStr="5p5NrGJn0jS HALPmcxz") returned 256 [0048.860] CharLowerBuffW (in: lpsz="5p5NrGJn0jS HALPmcxz", cchLength=0x15 | out: lpsz="5p5nrgjn0js halpmcxz") returned 0x15 [0048.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18f98c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0048.860] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0048.860] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0048.860] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0048.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfb24, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0048.860] SysReAllocStringLen (in: pbstr=0x18fa1c*="C:", psz=0x0, len=0x2 | out: pbstr=0x18fa1c*="C:") returned 1 [0048.860] VarCat (in: pvarLeft=0x18fce0, pvarRight=0x18fc30, pvarResult=0x18fcd0 | out: pvarResult=0x18fcd0) returned 0x0 [0048.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x18f48c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData", lpUsedDefaultChar=0x0) returned 15 [0048.861] GetFullPathNameA (in: lpFileName="C:\\ProgramData", nBufferLength=0x104, lpBuffer=0x18f6c8, lpFilePart=0x18f484 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x18f484*="ProgramData") returned 0xe [0048.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x18f914, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData", lpUsedDefaultChar=0x0) returned 15 [0048.861] FindClose (in: hFindFile=0x2deba8 | out: hFindFile=0x2deba8) returned 1 [0048.861] FindFirstFileA (in: lpFileName="C:\\ProgramData", lpFindFileData=0x18f464 | out: lpFindFileData=0x18f464*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cee05e0, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x1cee05e0, ftLastWriteTime.dwHighDateTime=0x1d68e85, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x2deba8 [0048.861] FileTimeToLocalFileTime (in: lpFileTime=0x18f468, lpLocalFileTime=0x18f438 | out: lpLocalFileTime=0x18f438) returned 1 [0048.861] FileTimeToSystemTime (in: lpFileTime=0x18f438, lpSystemTime=0x18f440 | out: lpSystemTime=0x18f440) returned 1 [0048.861] FileTimeToLocalFileTime (in: lpFileTime=0x18f470, lpLocalFileTime=0x18f438 | out: lpLocalFileTime=0x18f438) returned 1 [0048.861] FileTimeToSystemTime (in: lpFileTime=0x18f438, lpSystemTime=0x18f440 | out: lpSystemTime=0x18f440) returned 1 [0048.861] FileTimeToLocalFileTime (in: lpFileTime=0x18f478, lpLocalFileTime=0x18f438 | out: lpLocalFileTime=0x18f438) returned 1 [0048.861] FileTimeToSystemTime (in: lpFileTime=0x18f438, lpSystemTime=0x18f440 | out: lpSystemTime=0x18f440) returned 1 [0048.862] FindNextFileA (in: hFindFile=0x2deba8, lpFindFileData=0x18f464 | out: lpFindFileData=0x18f464*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cee05e0, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x1cee05e0, ftLastWriteTime.dwHighDateTime=0x1d68e85, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0048.862] GetLastError () returned 0x12 [0048.862] GetLastError () returned 0x12 [0048.862] SetLastError (dwErrCode=0x12) [0048.862] FindClose (in: hFindFile=0x2deba8 | out: hFindFile=0x2deba8) returned 1 [0048.862] GetLastError () returned 0x12 [0048.862] SetLastError (dwErrCode=0x12) [0048.862] VarBstrCmp (bstrLeft="", bstrRight="", lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18f98c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0048.863] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0048.863] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0048.863] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0048.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfb24, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0048.864] SysReAllocStringLen (in: pbstr=0x18fa1c*="C:", psz=0x0, len=0x2 | out: pbstr=0x18fa1c*="C:") returned 1 [0048.864] VarCat (in: pvarLeft=0x18fce0, pvarRight=0x18fc30, pvarResult=0x18fcd0 | out: pvarResult=0x18fcd0) returned 0x0 [0048.864] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.864] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.864] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.865] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x0 [0048.865] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.865] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.865] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.866] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.866] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.866] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.866] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x0 [0048.866] VarCmp (pvarLeft=0x18f9f8, pvarRight=0x18f9b8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.867] VarBstrCmp (bstrLeft="C:", bstrRight="", lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\", cchWideChar=-1, lpMultiByteStr=0x18f3c4, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\", lpUsedDefaultChar=0x0) returned 4 [0048.867] GetFullPathNameA (in: lpFileName="C:\\", nBufferLength=0x104, lpBuffer=0x18f600, lpFilePart=0x18f3bc | out: lpBuffer="C:\\", lpFilePart=0x18f3bc*=0x0) returned 0x3 [0048.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\", cchWideChar=-1, lpMultiByteStr=0x18f84c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\", lpUsedDefaultChar=0x0) returned 4 [0048.867] FindFirstFileA (in: lpFileName="C:\\*.*", lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77cd1733, dwReserved1=0x2deba8, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x2deba8 [0048.867] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f370 | out: lpLocalFileTime=0x18f370) returned 1 [0048.867] FileTimeToSystemTime (in: lpFileTime=0x18f370, lpSystemTime=0x18f378 | out: lpSystemTime=0x18f378) returned 1 [0048.867] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f370 | out: lpLocalFileTime=0x18f370) returned 1 [0048.867] FileTimeToSystemTime (in: lpFileTime=0x18f370, lpSystemTime=0x18f378 | out: lpSystemTime=0x18f378) returned 1 [0048.868] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f370 | out: lpLocalFileTime=0x18f370) returned 1 [0048.868] FileTimeToSystemTime (in: lpFileTime=0x18f370, lpSystemTime=0x18f378 | out: lpSystemTime=0x18f378) returned 1 [0048.868] FindNextFileA (in: hFindFile=0x2deba8, lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2deba8, dwReserved1=0x520024, cFileName="Boot", cAlternateFileName="")) returned 1 [0048.868] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.868] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.868] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.868] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.868] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.868] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.869] FindNextFileA (in: hFindFile=0x2deba8, lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x2deba8, dwReserved1=0x520024, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0048.869] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.869] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.869] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.884] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.884] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.884] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.884] FindNextFileA (in: hFindFile=0x2deba8, lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x2deba8, dwReserved1=0x520024, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0048.884] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.884] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.884] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.884] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.884] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.885] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.885] FindNextFileA (in: hFindFile=0x2deba8, lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2deba8, dwReserved1=0x520024, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0048.885] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.885] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.885] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.886] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.886] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.886] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.886] FindNextFileA (in: hFindFile=0x2deba8, lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x520024, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0048.886] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.886] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.886] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.886] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.887] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.887] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.887] FindNextFileA (in: hFindFile=0x2deba8, lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x520024, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0048.887] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.887] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.887] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.887] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.887] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.888] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.888] FindNextFileA (in: hFindFile=0x2deba8, lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x520024, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0048.888] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.888] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.888] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.888] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.888] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.888] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.889] FindNextFileA (in: hFindFile=0x2deba8, lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xaece4da0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x520024, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0048.889] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.889] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.889] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.889] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.889] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.889] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.889] FindNextFileA (in: hFindFile=0x2deba8, lpFindFileData=0x18f39c | out: lpFindFileData=0x18f39c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x520024, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0048.889] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.890] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.890] FileTimeToLocalFileTime (in: lpFileTime=0x18f3a8, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.890] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.890] FileTimeToLocalFileTime (in: lpFileTime=0x18f3b0, lpLocalFileTime=0x18f374 | out: lpLocalFileTime=0x18f374) returned 1 [0048.890] FileTimeToSystemTime (in: lpFileTime=0x18f374, lpSystemTime=0x18f37c | out: lpSystemTime=0x18f37c) returned 1 [0048.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f728, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0048.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f728, cbMultiByte=-1, lpWideCharStr=0x2dfb24, cchWideChar=9 | out: lpWideCharStr="PerfLogs") returned 9 [0048.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x18f86c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData", lpUsedDefaultChar=0x0) returned 15 [0048.891] CreateDirectoryA (lpPathName="C:\\ProgramData" (normalized: "c:\\programdata"), lpSecurityAttributes=0x0) returned 0 [0048.891] GetLastError () returned 0xb7 [0048.891] GetLastError () returned 0xb7 [0048.891] SetLastError (dwErrCode=0xb7) [0048.891] GetLastError () returned 0xb7 [0048.891] SetLastError (dwErrCode=0xb7) [0048.891] GetLastError () returned 0xb7 [0048.892] SetLastError (dwErrCode=0xb7) [0048.892] GetLastError () returned 0xb7 [0048.892] SetLastError (dwErrCode=0xb7) [0048.892] GetLastError () returned 0xb7 [0048.892] SetLastError (dwErrCode=0xb7) [0048.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0048.893] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x2dfb24, cchWideChar=5 | out: lpWideCharStr="xyno") returned 5 [0048.893] RaiseException (dwExceptionCode=0xc000008f, dwExceptionFlags=0x1, nNumberOfArguments=0x2, lpArguments=0x18f828) [0048.893] RtlUnwind (TargetFrame=0x18fa28, TargetIp=0x72a43caf, ExceptionRecord=0x0, ReturnValue=0x0) [0048.894] SetErrorMode (uMode=0x8001) returned 0x8001 [0048.894] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0048.894] SetErrorMode (uMode=0x8001) returned 0x8001 [0048.895] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersionExW") returned 0x76d41ae5 [0048.895] GetVersionExW (in: lpVersionInformation=0x18f918*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x18f918*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0048.895] GetLastError () returned 0x0 [0048.896] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xfc) returned 0x167ae88 [0048.896] GetVersionExA (in: lpVersionInformation=0x18f8c4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x118f918, dwMinorVersion=0x18f814, dwBuildNumber=0x76d41ae5, dwPlatformId=0x18fd3c, szCSDVersion="Í\x1eËwÓ.\x13") | out: lpVersionInformation=0x18f8c4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0048.896] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0048.896] GetCurrentThreadId () returned 0xa94 [0048.896] GetCurrentThreadId () returned 0xa94 [0048.896] GetCurrentThreadId () returned 0xa94 [0048.897] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x5) returned 0x16775b8 [0048.897] SetWindowTextA (hWnd=0x4015c, lpString="xydo") returned 1 [0048.897] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0xc, wParam=0x0, lParam=0x16775b8) returned 0x1 [0048.897] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x1) returned 0x16775c8 [0048.897] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x5) returned 0x16775d8 [0048.897] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x5) returned 0x16775e8 [0048.898] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x16716b0 [0048.898] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18f8b0, nSize=0x104 | out: lpFilename="C:\\ProgramData\\zhang.exe" (normalized: "c:\\programdata\\zhang.exe")) returned 0x18 [0048.899] lstrcpynA (in: lpString1=0x18f79c, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0048.899] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0048.899] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x16775f8 [0048.899] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167af90 [0048.899] lstrcpyA (in: lpString1=0x16775f8, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0048.902] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xf) returned 0x1672bc0 [0048.902] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167af90 | out: hHeap=0x1660000) returned 1 [0048.902] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16775f8 | out: hHeap=0x1660000) returned 1 [0048.902] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1672bc0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0048.902] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1672bc0, cbMultiByte=-1, lpWideCharStr=0x2e1224, cchWideChar=15 | out: lpWideCharStr="C:\\ProgramData") returned 15 [0048.902] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0048.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18f98c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0048.902] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0048.902] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0048.902] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0048.903] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfa0c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0048.903] SysReAllocStringLen (in: pbstr=0x18fa1c*="C:", psz=0x0, len=0x2 | out: pbstr=0x18fa1c*="C:") returned 1 [0048.903] VarCat (in: pvarLeft=0x18fce0, pvarRight=0x18fc30, pvarResult=0x18fcd0 | out: pvarResult=0x18fcd0) returned 0x0 [0048.903] VarCmp (pvarLeft=0x18fcc0, pvarRight=0x18fcd0, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.903] VarNot (in: pvarIn=0x18fcb0, pvarResult=0x18fca0 | out: pvarResult=0x18fca0) returned 0x0 [0048.903] SetErrorMode (uMode=0x8001) returned 0x8001 [0048.903] LoadLibraryA (lpLibFileName="shell32") returned 0x759d0000 [0053.187] SetErrorMode (uMode=0x8001) returned 0x8001 [0053.187] GetProcAddress (hModule=0x759d0000, lpProcName="IsUserAnAdmin") returned 0x75a244f5 [0053.187] IsUserAnAdmin () returned 1 [0053.188] GetLastError () returned 0x0 [0053.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\chk.dat", cchWideChar=-1, lpMultiByteStr=0x18f48c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\chk.dat", lpUsedDefaultChar=0x0) returned 23 [0053.189] GetFullPathNameA (in: lpFileName="C:\\ProgramData\\chk.dat", nBufferLength=0x104, lpBuffer=0x18f6c8, lpFilePart=0x18f484 | out: lpBuffer="C:\\ProgramData\\chk.dat", lpFilePart=0x18f484*="chk.dat") returned 0x16 [0053.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\chk.dat", cchWideChar=-1, lpMultiByteStr=0x18f914, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\chk.dat", lpUsedDefaultChar=0x0) returned 23 [0053.189] FindClose (in: hFindFile=0x2deba8 | out: hFindFile=0x2deba8) returned 1 [0053.190] FindFirstFileA (in: lpFileName="C:\\ProgramData\\chk.dat", lpFindFileData=0x18f464 | out: lpFindFileData=0x18f464*(dwFileAttributes=0x2c0000, ftCreationTime.dwLowDateTime=0x2deba8, ftCreationTime.dwHighDateTime=0x18fcf0, ftLastAccessTime.dwLowDateTime=0x18f594, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18f6c8, nFileSizeHigh=0x18f48c, nFileSizeLow=0x2df650, dwReserved0=0x2c0150, dwReserved1=0x505c3a43, cFileName="", cAlternateFileName="yÑá…þÿÿÿL\x95Âv¨È¢rüY¡r\x14ù\x18")) returned 0xffffffff [0053.192] GetLastError () returned 0x2 [0053.192] GetLastError () returned 0x2 [0053.192] SetLastError (dwErrCode=0x2) [0053.192] GetLastError () returned 0x2 [0053.192] SetLastError (dwErrCode=0x2) [0053.193] VarBstrCmp (bstrLeft="", bstrRight="", lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\chk.dat", cchWideChar=-1, lpMultiByteStr=0x18f7f4, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\chk.dat", lpUsedDefaultChar=0x0) returned 23 [0053.193] GetFullPathNameA (in: lpFileName="C:\\ProgramData\\chk.dat", nBufferLength=0x104, lpBuffer=0x18f924, lpFilePart=0x18f7ec | out: lpBuffer="C:\\ProgramData\\chk.dat", lpFilePart=0x18f7ec*="chk.dat") returned 0x16 [0053.194] CreateFileA (lpFileName="C:\\ProgramData\\chk.dat" (normalized: "c:\\programdata\\chk.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x18f8e4, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb4 [0053.197] GetFileType (hFile=0xb4) returned 0x1 [0053.197] IMalloc:Alloc (This=0x767666bc, cb=0x53) returned 0x2e36d0 [0053.197] IMalloc:Realloc (This=0x767666bc, pv=0x0, cb=0x60) returned 0x2e3730 [0053.198] CloseHandle (hObject=0xb4) returned 1 [0053.199] IMalloc:Free (This=0x767666bc, pv=0x2e36d0) [0053.199] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18f7b8, nSize=0x104 | out: lpFilename="C:\\ProgramData\\zhang.exe" (normalized: "c:\\programdata\\zhang.exe")) returned 0x18 [0053.199] lstrcpynA (in: lpString1=0x18f6a4, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0053.199] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0053.199] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x16775f8 [0053.199] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167af90 [0053.199] lstrcpyA (in: lpString1=0x16775f8, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0053.201] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xf) returned 0x1672bc0 [0053.201] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167af90 | out: hHeap=0x1660000) returned 1 [0053.201] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16775f8 | out: hHeap=0x1660000) returned 1 [0053.201] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1672bc0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0053.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1672bc0, cbMultiByte=-1, lpWideCharStr=0x2e1224, cchWideChar=15 | out: lpWideCharStr="C:\\ProgramData") returned 15 [0053.202] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0053.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\MSWINSCK.OCX", cchWideChar=-1, lpMultiByteStr=0x18f394, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\MSWINSCK.OCX", lpUsedDefaultChar=0x0) returned 28 [0053.202] GetFullPathNameA (in: lpFileName="C:\\ProgramData\\MSWINSCK.OCX", nBufferLength=0x104, lpBuffer=0x18f5d0, lpFilePart=0x18f38c | out: lpBuffer="C:\\ProgramData\\MSWINSCK.OCX", lpFilePart=0x18f38c*="MSWINSCK.OCX") returned 0x1b [0053.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\MSWINSCK.OCX", cchWideChar=-1, lpMultiByteStr=0x18f81c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\MSWINSCK.OCX", lpUsedDefaultChar=0x0) returned 28 [0053.202] FindFirstFileA (in: lpFileName="C:\\ProgramData\\MSWINSCK.OCX", lpFindFileData=0x18f36c | out: lpFindFileData=0x18f36c*(dwFileAttributes=0x18f38c, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18f9dc, ftLastAccessTime.dwLowDateTime=0x18f49c, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18f5d0, nFileSizeHigh=0x18f394, nFileSizeLow=0x18f5df, dwReserved0=0x0, dwReserved1=0x505c3a43, cFileName="rogramData\\MSWINSCK.OCX", cAlternateFileName="8ø\x18")) returned 0xffffffff [0053.203] GetLastError () returned 0x2 [0053.203] GetLastError () returned 0x2 [0053.203] SetLastError (dwErrCode=0x2) [0053.203] GetLastError () returned 0x2 [0053.203] SetLastError (dwErrCode=0x2) [0053.203] VarBstrCmp (bstrLeft="", bstrRight="", lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.221] lstrcpynA (in: lpString1=0x18f6a4, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0053.222] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0053.223] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x16775f8 [0053.223] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167af90 [0053.223] lstrcpyA (in: lpString1=0x16775f8, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0053.224] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xf) returned 0x1672bc0 [0053.224] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167af90 | out: hHeap=0x1660000) returned 1 [0053.224] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16775f8 | out: hHeap=0x1660000) returned 1 [0053.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1672bc0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0053.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1672bc0, cbMultiByte=-1, lpWideCharStr=0x2e1224, cchWideChar=15 | out: lpWideCharStr="C:\\ProgramData") returned 15 [0053.224] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0053.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\MSWINSCK.OCX", cchWideChar=-1, lpMultiByteStr=0x18f6fc, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\MSWINSCK.OCX", lpUsedDefaultChar=0x0) returned 28 [0053.225] GetFullPathNameA (in: lpFileName="C:\\ProgramData\\MSWINSCK.OCX", nBufferLength=0x104, lpBuffer=0x18f82c, lpFilePart=0x18f6f4 | out: lpBuffer="C:\\ProgramData\\MSWINSCK.OCX", lpFilePart=0x18f6f4*="MSWINSCK.OCX") returned 0x1b [0053.225] CreateFileA (lpFileName="C:\\ProgramData\\MSWINSCK.OCX" (normalized: "c:\\programdata\\mswinsck.ocx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f7ec, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb4 [0053.225] GetFileType (hFile=0xb4) returned 0x1 [0053.226] IMalloc:Alloc (This=0x767666bc, cb=0x257) returned 0x354710 [0053.227] VarParseNumFromStr (in: strIn="&H4D", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.227] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="M") returned 1 [0053.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="M", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="M", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="M", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M", lpUsedDefaultChar=0x0) returned 1 [0053.230] VarParseNumFromStr (in: strIn="&H5A", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.230] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.230] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="Z") returned 1 [0053.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Z", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Z", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Z", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Z", lpUsedDefaultChar=0x0) returned 1 [0053.232] VarParseNumFromStr (in: strIn="&H90", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.232] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.232] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x90") returned 1 [0053.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x90", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x90", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x90", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x90", lpUsedDefaultChar=0x0) returned 1 [0053.233] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.233] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.235] VarParseNumFromStr (in: strIn="&H3", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.235] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.235] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x03") returned 1 [0053.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x03", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x03", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x03", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x03", lpUsedDefaultChar=0x0) returned 1 [0053.237] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.237] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.237] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.239] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.239] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.239] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.240] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.240] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.241] VarParseNumFromStr (in: strIn="&H4", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.241] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x04") returned 1 [0053.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x04", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x04", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x04", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x04", lpUsedDefaultChar=0x0) returned 1 [0053.242] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.242] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.244] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.244] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.245] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.245] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.245] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.246] VarParseNumFromStr (in: strIn="&HFF", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.246] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="ÿ") returned 1 [0053.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ÿ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ÿ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ÿ", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ÿ", lpUsedDefaultChar=0x0) returned 1 [0053.247] VarParseNumFromStr (in: strIn="&HFF", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.247] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="ÿ") returned 1 [0053.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ÿ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ÿ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ÿ", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ÿ", lpUsedDefaultChar=0x0) returned 1 [0053.248] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.248] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.249] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.249] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.250] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.251] VarParseNumFromStr (in: strIn="&HB8", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.251] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.251] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="¸") returned 1 [0053.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="¸", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="¸", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="¸", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="¸", lpUsedDefaultChar=0x0) returned 1 [0053.254] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.254] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.257] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.257] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.259] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.259] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.261] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.261] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.262] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.264] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.264] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.266] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.266] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.268] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.268] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.269] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.270] VarParseNumFromStr (in: strIn="&H40", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.270] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="@") returned 1 [0053.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@", lpUsedDefaultChar=0x0) returned 1 [0053.272] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.272] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.273] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.273] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.274] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.274] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.275] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.275] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.276] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.276] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.277] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.277] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.277] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.277] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.277] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.278] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.278] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.278] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.278] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.279] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.279] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.279] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.280] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.280] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.280] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.281] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.281] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.281] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.282] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.282] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.282] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.283] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.283] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.283] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.285] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.285] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.286] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.286] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.287] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.287] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.287] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.288] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.288] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.289] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.289] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.289] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.289] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.289] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.289] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.290] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.290] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.291] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.291] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.291] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.292] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.292] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.292] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.292] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.292] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.292] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.293] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.293] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.293] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.294] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.294] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.294] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.295] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.295] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.295] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.295] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.295] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.295] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.296] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.296] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.297] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.297] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.297] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.297] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.297] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.297] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.298] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.298] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.299] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.299] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.299] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.301] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.301] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.302] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.302] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.302] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.303] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.303] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.303] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.304] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.304] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.304] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.305] VarParseNumFromStr (in: strIn="&H80", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.305] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.305] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="€") returned 1 [0053.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="€", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="€", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="€", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x80", lpUsedDefaultChar=0x0) returned 1 [0053.305] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.306] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.306] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.306] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.307] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.307] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.307] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.308] VarParseNumFromStr (in: strIn="&HE", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.308] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.308] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x0e") returned 1 [0053.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0e", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0e", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0e", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x0e", lpUsedDefaultChar=0x0) returned 1 [0053.308] VarParseNumFromStr (in: strIn="&H1F", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.308] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.309] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x1f") returned 1 [0053.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x1f", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x1f", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x1f", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x1f", lpUsedDefaultChar=0x0) returned 1 [0053.309] VarParseNumFromStr (in: strIn="&HBA", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.309] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.309] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="º") returned 1 [0053.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="º", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="º", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="º", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="º", lpUsedDefaultChar=0x0) returned 1 [0053.310] VarParseNumFromStr (in: strIn="&HE", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.310] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.310] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x0e") returned 1 [0053.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0e", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0e", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0e", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x0e", lpUsedDefaultChar=0x0) returned 1 [0053.310] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.310] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.310] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.311] VarParseNumFromStr (in: strIn="&HB4", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.311] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.311] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="´") returned 1 [0053.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="´", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="´", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="´", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="´", lpUsedDefaultChar=0x0) returned 1 [0053.312] VarParseNumFromStr (in: strIn="&H9", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.312] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.312] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x09") returned 1 [0053.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x09", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x09", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x09", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x09", lpUsedDefaultChar=0x0) returned 1 [0053.312] VarParseNumFromStr (in: strIn="&HCD", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.312] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.312] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="Í") returned 1 [0053.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Í", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Í", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Í", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Í", lpUsedDefaultChar=0x0) returned 1 [0053.313] VarParseNumFromStr (in: strIn="&H21", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.313] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.313] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="!") returned 1 [0053.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!", lpUsedDefaultChar=0x0) returned 1 [0053.313] VarParseNumFromStr (in: strIn="&HB8", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.313] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.314] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="¸") returned 1 [0053.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="¸", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="¸", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="¸", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="¸", lpUsedDefaultChar=0x0) returned 1 [0053.314] VarParseNumFromStr (in: strIn="&H1", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.314] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.314] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0053.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01", lpUsedDefaultChar=0x0) returned 1 [0053.315] VarParseNumFromStr (in: strIn="&H4C", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.316] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.316] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="L") returned 1 [0053.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="L", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="L", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="L", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="L", lpUsedDefaultChar=0x0) returned 1 [0053.316] VarParseNumFromStr (in: strIn="&HCD", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.316] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.316] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="Í") returned 1 [0053.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Í", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Í", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Í", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Í", lpUsedDefaultChar=0x0) returned 1 [0053.317] VarParseNumFromStr (in: strIn="&H21", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.317] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="!") returned 1 [0053.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!", lpUsedDefaultChar=0x0) returned 1 [0053.317] VarParseNumFromStr (in: strIn="&H54", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.317] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="T") returned 1 [0053.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="T", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="T", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="T", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="T", lpUsedDefaultChar=0x0) returned 1 [0053.318] VarParseNumFromStr (in: strIn="&H68", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.318] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.318] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0053.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 1 [0053.319] VarParseNumFromStr (in: strIn="&H69", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.319] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.319] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0053.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i", lpUsedDefaultChar=0x0) returned 1 [0053.319] VarParseNumFromStr (in: strIn="&H73", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.319] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.320] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0053.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="s", lpUsedDefaultChar=0x0) returned 1 [0053.320] VarParseNumFromStr (in: strIn="&H20", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.320] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.320] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 1 [0053.321] VarParseNumFromStr (in: strIn="&H70", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.321] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.321] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0053.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="p", lpUsedDefaultChar=0x0) returned 1 [0053.322] VarParseNumFromStr (in: strIn="&H72", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.322] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0053.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="r", lpUsedDefaultChar=0x0) returned 1 [0053.323] VarParseNumFromStr (in: strIn="&H6F", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.323] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0053.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="o", lpUsedDefaultChar=0x0) returned 1 [0053.325] VarParseNumFromStr (in: strIn="&H67", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.325] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="g") returned 1 [0053.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="g", lpUsedDefaultChar=0x0) returned 1 [0053.327] VarParseNumFromStr (in: strIn="&H72", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.327] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0053.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="r", lpUsedDefaultChar=0x0) returned 1 [0053.328] VarParseNumFromStr (in: strIn="&H61", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.328] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0053.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="a", lpUsedDefaultChar=0x0) returned 1 [0053.330] VarParseNumFromStr (in: strIn="&H6D", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.330] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0053.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="m", lpUsedDefaultChar=0x0) returned 1 [0053.332] VarParseNumFromStr (in: strIn="&H20", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.332] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 1 [0053.333] VarParseNumFromStr (in: strIn="&H63", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.333] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0053.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c", lpUsedDefaultChar=0x0) returned 1 [0053.335] VarParseNumFromStr (in: strIn="&H61", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.335] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.335] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0053.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="a", lpUsedDefaultChar=0x0) returned 1 [0053.336] VarParseNumFromStr (in: strIn="&H6E", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.336] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0053.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="n", lpUsedDefaultChar=0x0) returned 1 [0053.338] VarParseNumFromStr (in: strIn="&H6E", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.338] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.338] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0053.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="n", lpUsedDefaultChar=0x0) returned 1 [0053.339] VarParseNumFromStr (in: strIn="&H6F", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.339] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.340] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0053.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="o", lpUsedDefaultChar=0x0) returned 1 [0053.341] VarParseNumFromStr (in: strIn="&H74", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.341] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.341] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0053.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="t", lpUsedDefaultChar=0x0) returned 1 [0053.342] VarParseNumFromStr (in: strIn="&H20", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.342] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.342] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 1 [0053.343] VarParseNumFromStr (in: strIn="&H62", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.343] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.343] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="b") returned 1 [0053.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b", lpUsedDefaultChar=0x0) returned 1 [0053.344] VarParseNumFromStr (in: strIn="&H65", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.344] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.344] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0053.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e", lpUsedDefaultChar=0x0) returned 1 [0053.345] VarParseNumFromStr (in: strIn="&H20", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.345] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.345] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 1 [0053.347] VarParseNumFromStr (in: strIn="&H72", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.347] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.347] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0053.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="r", lpUsedDefaultChar=0x0) returned 1 [0053.348] VarParseNumFromStr (in: strIn="&H75", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.348] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.348] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0053.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="u", lpUsedDefaultChar=0x0) returned 1 [0053.349] VarParseNumFromStr (in: strIn="&H6E", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.349] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0053.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="n", lpUsedDefaultChar=0x0) returned 1 [0053.350] VarParseNumFromStr (in: strIn="&H20", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.350] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.350] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 1 [0053.351] VarParseNumFromStr (in: strIn="&H69", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.351] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0053.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i", lpUsedDefaultChar=0x0) returned 1 [0053.352] VarParseNumFromStr (in: strIn="&H6E", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.352] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.352] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0053.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="n", lpUsedDefaultChar=0x0) returned 1 [0053.353] VarParseNumFromStr (in: strIn="&H20", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.353] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.353] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 1 [0053.354] VarParseNumFromStr (in: strIn="&H44", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.354] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.354] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="D") returned 1 [0053.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D", lpUsedDefaultChar=0x0) returned 1 [0053.355] VarParseNumFromStr (in: strIn="&H4F", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.355] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="O") returned 1 [0053.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="O", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="O", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="O", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="O", lpUsedDefaultChar=0x0) returned 1 [0053.356] VarParseNumFromStr (in: strIn="&H53", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.356] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.356] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="S") returned 1 [0053.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="S", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="S", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="S", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="S", lpUsedDefaultChar=0x0) returned 1 [0053.357] VarParseNumFromStr (in: strIn="&H20", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.357] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.357] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 1 [0053.357] VarParseNumFromStr (in: strIn="&H6D", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.357] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.357] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0053.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="m", lpUsedDefaultChar=0x0) returned 1 [0053.358] VarParseNumFromStr (in: strIn="&H6F", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.358] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.358] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0053.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="o", lpUsedDefaultChar=0x0) returned 1 [0053.359] VarParseNumFromStr (in: strIn="&H64", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.359] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.359] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0053.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="d", lpUsedDefaultChar=0x0) returned 1 [0053.359] VarParseNumFromStr (in: strIn="&H65", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.359] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.359] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0053.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e", lpUsedDefaultChar=0x0) returned 1 [0053.360] VarParseNumFromStr (in: strIn="&H2E", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.360] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.360] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0053.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x0) returned 1 [0053.361] VarParseNumFromStr (in: strIn="&HD", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.361] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\r") returned 1 [0053.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r", lpUsedDefaultChar=0x0) returned 1 [0053.361] VarParseNumFromStr (in: strIn="&HD", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.361] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.362] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\r") returned 1 [0053.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r", lpUsedDefaultChar=0x0) returned 1 [0053.409] VarParseNumFromStr (in: strIn="&HA", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.409] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.409] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0053.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\n", lpUsedDefaultChar=0x0) returned 1 [0053.410] VarParseNumFromStr (in: strIn="&H24", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.410] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.410] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="$") returned 1 [0053.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$", lpUsedDefaultChar=0x0) returned 1 [0053.411] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.411] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.411] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.411] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.412] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.412] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.413] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.413] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.413] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.414] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.414] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.414] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.414] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.414] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.415] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.415] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.416] VarParseNumFromStr (in: strIn="&H50", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.416] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="P") returned 1 [0053.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P", lpUsedDefaultChar=0x0) returned 1 [0053.417] VarParseNumFromStr (in: strIn="&H45", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.417] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.417] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="E") returned 1 [0053.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="E", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="E", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="E", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="E", lpUsedDefaultChar=0x0) returned 1 [0053.418] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.418] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.419] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.419] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.420] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.421] VarParseNumFromStr (in: strIn="&H4C", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.421] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="L") returned 1 [0053.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="L", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="L", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="L", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="L", lpUsedDefaultChar=0x0) returned 1 [0053.422] VarParseNumFromStr (in: strIn="&H1", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.422] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0053.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01", lpUsedDefaultChar=0x0) returned 1 [0053.424] VarParseNumFromStr (in: strIn="&H4", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.424] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x04") returned 1 [0053.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x04", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x04", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x04", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x04", lpUsedDefaultChar=0x0) returned 1 [0053.426] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.426] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.428] VarParseNumFromStr (in: strIn="&H25", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.428] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.429] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="%") returned 1 [0053.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="%", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="%", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="%", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="%", lpUsedDefaultChar=0x0) returned 1 [0053.430] VarParseNumFromStr (in: strIn="&H53", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.430] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="S") returned 1 [0053.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="S", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="S", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="S", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="S", lpUsedDefaultChar=0x0) returned 1 [0053.432] VarParseNumFromStr (in: strIn="&H89", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.432] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="‰") returned 1 [0053.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="‰", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="‰", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="‰", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x89", lpUsedDefaultChar=0x0) returned 1 [0053.433] VarParseNumFromStr (in: strIn="&H35", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.433] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.434] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0053.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5", lpUsedDefaultChar=0x0) returned 1 [0053.435] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.435] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.436] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.437] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.437] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.438] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.440] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.441] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.442] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.443] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.443] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.444] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.444] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.444] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.445] VarParseNumFromStr (in: strIn="&HC7", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.445] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.445] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="Ç") returned 1 [0053.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ç", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ç", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ç", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ç", lpUsedDefaultChar=0x0) returned 1 [0053.447] VarParseNumFromStr (in: strIn="&HA", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.447] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0053.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\n", lpUsedDefaultChar=0x0) returned 1 [0053.449] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.449] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.449] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.451] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.451] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.452] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.453] VarParseNumFromStr (in: strIn="&HE0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.453] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="à") returned 1 [0053.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="à", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="à", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="à", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="à", lpUsedDefaultChar=0x0) returned 1 [0053.456] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.456] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.457] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.458] VarParseNumFromStr (in: strIn="&H2", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.458] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x02") returned 1 [0053.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x02", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x02", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x02", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x02", lpUsedDefaultChar=0x0) returned 1 [0053.461] VarParseNumFromStr (in: strIn="&H23", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.461] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.461] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="#") returned 1 [0053.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="#", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="#", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="#", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="#", lpUsedDefaultChar=0x0) returned 1 [0053.463] VarParseNumFromStr (in: strIn="&HB", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.463] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.463] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x0b") returned 1 [0053.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0b", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0b", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0b", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x0b", lpUsedDefaultChar=0x0) returned 1 [0053.464] VarParseNumFromStr (in: strIn="&H1", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.464] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0053.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01", lpUsedDefaultChar=0x0) returned 1 [0053.466] VarParseNumFromStr (in: strIn="&H5", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.466] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.466] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x05") returned 1 [0053.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x05", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x05", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x05", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x05", lpUsedDefaultChar=0x0) returned 1 [0053.468] VarParseNumFromStr (in: strIn="&H2", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.468] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.468] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x02") returned 1 [0053.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x02", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x02", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x02", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x02", lpUsedDefaultChar=0x0) returned 1 [0053.470] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.470] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.470] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.472] VarParseNumFromStr (in: strIn="&H8", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.472] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.472] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x08") returned 1 [0053.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x08", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x08", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x08", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x08", lpUsedDefaultChar=0x0) returned 1 [0053.473] VarParseNumFromStr (in: strIn="&H1", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.473] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0053.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01", lpUsedDefaultChar=0x0) returned 1 [0053.475] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.475] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.476] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.476] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.476] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.477] VarParseNumFromStr (in: strIn="&H84", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.477] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.477] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="„") returned 1 [0053.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="„", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="„", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="„", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x84", lpUsedDefaultChar=0x0) returned 1 [0053.478] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.478] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.478] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.479] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.479] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.481] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.481] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.481] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.482] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.482] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.482] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.483] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.483] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.483] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.485] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.485] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.485] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.486] VarParseNumFromStr (in: strIn="&H44", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.486] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.486] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="D") returned 1 [0053.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D", lpUsedDefaultChar=0x0) returned 1 [0053.488] VarParseNumFromStr (in: strIn="&H13", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.488] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.489] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x13") returned 1 [0053.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x13", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x13", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x13", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x13", lpUsedDefaultChar=0x0) returned 1 [0053.490] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.490] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.491] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.491] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.491] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.492] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.492] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.492] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.493] VarParseNumFromStr (in: strIn="&H10", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.493] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.493] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x10") returned 1 [0053.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x10", lpUsedDefaultChar=0x0) returned 1 [0053.494] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.494] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.495] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.495] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.495] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.496] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.496] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.496] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.496] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.497] VarParseNumFromStr (in: strIn="&H20", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.497] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 1 [0053.498] VarParseNumFromStr (in: strIn="&H1", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.498] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0053.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01", lpUsedDefaultChar=0x0) returned 1 [0053.500] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.500] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.500] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.501] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.501] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.502] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.502] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.504] VarParseNumFromStr (in: strIn="&H17", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.504] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.505] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x17") returned 1 [0053.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x17", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x17", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x17", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x17", lpUsedDefaultChar=0x0) returned 1 [0053.506] VarParseNumFromStr (in: strIn="&H22", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.506] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.506] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\"") returned 1 [0053.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\"", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\"", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\"", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"", lpUsedDefaultChar=0x0) returned 1 [0053.507] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.507] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.508] VarParseNumFromStr (in: strIn="&H10", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.509] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x10") returned 1 [0053.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x10", lpUsedDefaultChar=0x0) returned 1 [0053.510] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.510] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.511] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.512] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.512] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.513] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.513] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.515] VarParseNumFromStr (in: strIn="&H2", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.515] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x02") returned 1 [0053.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x02", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x02", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x02", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x02", lpUsedDefaultChar=0x0) returned 1 [0053.516] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.516] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.516] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.518] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.518] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.532] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.534] VarParseNumFromStr (in: strIn="&H4", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.534] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.534] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x04") returned 1 [0053.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x04", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x04", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x04", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x04", lpUsedDefaultChar=0x0) returned 1 [0053.535] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.535] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.536] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.537] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.537] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.538] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.538] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.540] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.540] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.540] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.542] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.542] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.542] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.543] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.543] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.545] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.545] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.546] VarParseNumFromStr (in: strIn="&H4", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.546] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x04") returned 1 [0053.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x04", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x04", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x04", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x04", lpUsedDefaultChar=0x0) returned 1 [0053.547] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.547] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.547] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.548] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.549] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.550] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.550] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.552] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.552] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.552] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.553] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.553] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.555] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.555] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.555] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.557] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.557] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.559] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.559] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.560] VarParseNumFromStr (in: strIn="&HC0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.561] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="À") returned 1 [0053.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="À", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="À", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="À", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="À", lpUsedDefaultChar=0x0) returned 1 [0053.562] VarParseNumFromStr (in: strIn="&H1", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.562] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0053.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01", lpUsedDefaultChar=0x0) returned 1 [0053.564] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.564] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.566] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.566] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.568] VarParseNumFromStr (in: strIn="&H4", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.568] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x04") returned 1 [0053.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x04", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x04", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x04", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x04", lpUsedDefaultChar=0x0) returned 1 [0053.570] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.570] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.570] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.572] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.572] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.574] VarParseNumFromStr (in: strIn="&HE", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.574] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.575] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x0e") returned 1 [0053.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0e", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0e", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0e", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x0e", lpUsedDefaultChar=0x0) returned 1 [0053.576] VarParseNumFromStr (in: strIn="&H7E", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.577] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.577] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="~") returned 1 [0053.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="~", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="~", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="~", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="~", lpUsedDefaultChar=0x0) returned 1 [0053.579] VarParseNumFromStr (in: strIn="&H2", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.579] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x02") returned 1 [0053.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x02", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x02", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x02", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x02", lpUsedDefaultChar=0x0) returned 1 [0053.582] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.582] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.582] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.584] VarParseNumFromStr (in: strIn="&H2", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.584] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x02") returned 1 [0053.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x02", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x02", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x02", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x02", lpUsedDefaultChar=0x0) returned 1 [0053.586] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.586] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.587] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.587] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.589] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.589] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.591] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.591] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.593] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.593] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.594] VarParseNumFromStr (in: strIn="&H10", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.595] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x10") returned 1 [0053.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x10", lpUsedDefaultChar=0x0) returned 1 [0053.597] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.597] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.599] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.599] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.601] VarParseNumFromStr (in: strIn="&H10", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.601] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x10") returned 1 [0053.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x10", lpUsedDefaultChar=0x0) returned 1 [0053.603] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.604] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.606] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.606] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.609] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.609] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.611] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.611] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.614] VarParseNumFromStr (in: strIn="&H10", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.614] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe44, cchWideChar=1 | out: lpWideCharStr="\x10") returned 1 [0053.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x10", lpUsedDefaultChar=0x0) returned 1 [0053.616] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.617] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.617] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.619] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.619] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.619] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.621] VarParseNumFromStr (in: strIn="&H10", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.621] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.621] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe44, cchWideChar=1 | out: lpWideCharStr="\x10") returned 1 [0053.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x10", lpUsedDefaultChar=0x0) returned 1 [0053.622] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.622] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.624] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.624] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dc9bc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.626] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.626] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.628] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.628] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.630] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.630] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.632] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.632] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.632] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.634] VarParseNumFromStr (in: strIn="&H10", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.634] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x10") returned 1 [0053.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x10", lpUsedDefaultChar=0x0) returned 1 [0053.636] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.636] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.637] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.637] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.639] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.639] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.641] VarParseNumFromStr (in: strIn="&H80", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.641] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="€") returned 1 [0053.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="€", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="€", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="€", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x80", lpUsedDefaultChar=0x0) returned 1 [0053.643] VarParseNumFromStr (in: strIn="&H68", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.643] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0053.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 1 [0053.645] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.645] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.647] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.647] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.649] VarParseNumFromStr (in: strIn="&HC3", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.649] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="Ã") returned 1 [0053.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ã", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ã", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ã", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ã", lpUsedDefaultChar=0x0) returned 1 [0053.651] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.651] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.653] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.653] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.655] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.655] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.656] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.656] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.657] VarParseNumFromStr (in: strIn="&HB", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.657] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="\x0b") returned 1 [0053.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0b", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0b", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0b", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x0b", lpUsedDefaultChar=0x0) returned 1 [0053.660] VarParseNumFromStr (in: strIn="&H1", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.660] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0053.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01", lpUsedDefaultChar=0x0) returned 1 [0053.662] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.662] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.663] VarParseNumFromStr (in: strIn="&HF6", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.663] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.664] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="ö") returned 1 [0053.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ö", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ö", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ö", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ö", lpUsedDefaultChar=0x0) returned 1 [0053.665] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.666] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.666] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.667] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.668] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.668] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.669] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.669] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.670] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.671] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.671] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.672] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.673] VarParseNumFromStr (in: strIn="&H30", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.673] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0053.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0", lpUsedDefaultChar=0x0) returned 1 [0053.676] VarParseNumFromStr (in: strIn="&H1", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.676] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.676] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0053.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01", lpUsedDefaultChar=0x0) returned 1 [0053.678] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.678] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.678] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.679] VarParseNumFromStr (in: strIn="&HA4", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.680] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="¤") returned 1 [0053.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="¤", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="¤", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="¤", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="¤", lpUsedDefaultChar=0x0) returned 1 [0053.681] VarParseNumFromStr (in: strIn="&H66", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.681] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0053.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="f", lpUsedDefaultChar=0x0) returned 1 [0053.684] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.684] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.686] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.686] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.686] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.688] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.688] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.689] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.691] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.691] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.693] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.694] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.696] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.696] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.696] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.698] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.698] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.700] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.700] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.701] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.702] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.702] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.703] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.705] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.705] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.705] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.707] VarParseNumFromStr (in: strIn="&H10", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.707] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.707] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x10") returned 1 [0053.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x10", lpUsedDefaultChar=0x0) returned 1 [0053.709] VarParseNumFromStr (in: strIn="&H93", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.709] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.710] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="“") returned 1 [0053.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="“", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="“", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="“", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x93", lpUsedDefaultChar=0x0) returned 1 [0053.712] VarParseNumFromStr (in: strIn="&H1", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.712] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.712] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0053.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01", lpUsedDefaultChar=0x0) returned 1 [0053.714] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.714] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.715] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.717] VarParseNumFromStr (in: strIn="&H20", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.717] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 1 [0053.719] VarParseNumFromStr (in: strIn="&H14", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.719] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.719] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="\x14") returned 1 [0053.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x14", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x14", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x14", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x14", lpUsedDefaultChar=0x0) returned 1 [0053.722] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.722] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.722] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.724] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.724] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.725] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.726] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.726] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.726] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.728] VarParseNumFromStr (in: strIn="&HA0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.728] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.728] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 1 [0053.730] VarParseNumFromStr (in: strIn="&H1", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.730] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.730] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0053.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01", lpUsedDefaultChar=0x0) returned 1 [0053.732] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.732] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.735] VarParseNumFromStr (in: strIn="&H6C", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.735] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.735] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0053.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="l", lpUsedDefaultChar=0x0) returned 1 [0053.738] VarParseNumFromStr (in: strIn="&H13", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.738] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.739] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="\x13") returned 1 [0053.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x13", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x13", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x13", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x13", lpUsedDefaultChar=0x0) returned 1 [0053.740] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.741] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.741] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.742] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.742] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.744] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.744] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.745] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.746] VarParseNumFromStr (in: strIn="&HA", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.746] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.746] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0053.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\n", lpUsedDefaultChar=0x0) returned 1 [0053.747] VarParseNumFromStr (in: strIn="&H1", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.747] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0053.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01", lpUsedDefaultChar=0x0) returned 1 [0053.749] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.749] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.750] VarParseNumFromStr (in: strIn="&H1C", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.750] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.750] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x1c") returned 1 [0053.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x1c", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x1c", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x1c", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x1c", lpUsedDefaultChar=0x0) returned 1 [0053.752] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.752] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.752] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.754] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.754] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.756] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.756] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.758] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.758] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.760] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.760] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.761] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.761] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.763] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.763] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.764] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.764] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.765] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.765] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.767] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.767] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.767] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.798] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.798] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.798] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.800] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.800] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.802] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.802] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.802] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.804] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.804] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.806] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.806] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.808] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.808] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.808] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.809] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.809] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.809] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.810] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.810] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.812] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.812] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.812] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.813] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.813] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.813] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.813] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.815] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.815] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.815] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.816] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.816] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.816] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.817] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.817] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.818] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.818] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.818] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.818] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.819] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.819] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.819] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.819] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.820] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.820] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.820] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.821] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.821] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.822] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.822] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.822] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.822] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.823] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.823] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.824] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.824] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.824] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.826] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.826] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.826] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.826] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.827] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.828] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.828] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.828] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.829] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.829] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.830] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.831] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.831] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.831] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.832] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.832] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.832] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.833] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.833] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.833] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.834] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.834] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.834] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.834] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.835] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.836] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.836] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.836] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.837] VarParseNumFromStr (in: strIn="&H10", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.837] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.837] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="\x10") returned 1 [0053.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x10", lpUsedDefaultChar=0x0) returned 1 [0053.838] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.838] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.839] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.839] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.839] VarParseNumFromStr (in: strIn="&H4", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.839] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x04") returned 1 [0053.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x04", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x04", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x04", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x04", lpUsedDefaultChar=0x0) returned 1 [0053.840] VarParseNumFromStr (in: strIn="&H3", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.840] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.841] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="\x03") returned 1 [0053.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x03", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x03", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x03", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x03", lpUsedDefaultChar=0x0) returned 1 [0053.842] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.842] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.842] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.843] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.843] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.845] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.845] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.847] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.847] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.848] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.849] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.850] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.850] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.850] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.851] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.851] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.852] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.852] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.852] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.853] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.854] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.855] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.855] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.856] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.856] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.857] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.857] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.859] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.859] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.860] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.860] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.863] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.863] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.865] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.865] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.866] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.866] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.867] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.867] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.868] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.868] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.868] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.868] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.869] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.869] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.870] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.870] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.871] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.871] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.872] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.872] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.873] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.873] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.874] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.874] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.874] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.875] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.876] VarParseNumFromStr (in: strIn="&H2E", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.876] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0053.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x0) returned 1 [0053.877] VarParseNumFromStr (in: strIn="&H74", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.878] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.878] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0053.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="t", lpUsedDefaultChar=0x0) returned 1 [0053.879] VarParseNumFromStr (in: strIn="&H65", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.879] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.879] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0053.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e", lpUsedDefaultChar=0x0) returned 1 [0053.881] VarParseNumFromStr (in: strIn="&H78", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.881] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.881] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="x") returned 1 [0053.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="x", lpUsedDefaultChar=0x0) returned 1 [0053.882] VarParseNumFromStr (in: strIn="&H74", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.882] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0053.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="t", lpUsedDefaultChar=0x0) returned 1 [0053.884] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.884] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.885] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.885] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.886] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.886] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.886] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.886] VarParseNumFromStr (in: strIn="&H1E", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.886] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x1e") returned 1 [0053.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x1e", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x1e", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x1e", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x1e", lpUsedDefaultChar=0x0) returned 1 [0053.887] VarParseNumFromStr (in: strIn="&H7", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.887] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="\x07") returned 1 [0053.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x07", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x07", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x07", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x07", lpUsedDefaultChar=0x0) returned 1 [0053.888] VarParseNumFromStr (in: strIn="&H1", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.888] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0053.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01", lpUsedDefaultChar=0x0) returned 1 [0053.889] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.889] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.890] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.890] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.891] VarParseNumFromStr (in: strIn="&H10", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.891] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.891] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="\x10") returned 1 [0053.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x10", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x10", lpUsedDefaultChar=0x0) returned 1 [0053.893] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.893] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.893] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.894] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.894] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.894] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.895] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.895] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.895] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.896] VarParseNumFromStr (in: strIn="&H8", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.896] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.896] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="\x08") returned 1 [0053.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x08", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x08", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x08", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x08", lpUsedDefaultChar=0x0) returned 1 [0053.897] VarParseNumFromStr (in: strIn="&H1", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.897] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.897] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0053.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01", lpUsedDefaultChar=0x0) returned 1 [0053.898] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.898] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.899] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.899] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.899] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.900] VarParseNumFromStr (in: strIn="&H6", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.900] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.900] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="\x06") returned 1 [0053.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x06", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x06", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x06", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x06", lpUsedDefaultChar=0x0) returned 1 [0053.901] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.901] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.901] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.901] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.901] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.901] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.902] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.902] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.902] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.904] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.904] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.904] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.905] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.905] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.905] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.906] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.906] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.907] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.907] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.907] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.907] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.907] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.907] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.908] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.908] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.910] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.910] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.910] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.911] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.911] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.911] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.912] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.912] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.912] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.913] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.913] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.913] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.914] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.914] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.914] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.915] VarParseNumFromStr (in: strIn="&H20", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.915] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 1 [0053.916] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.916] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.916] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.916] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.916] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.916] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.917] VarParseNumFromStr (in: strIn="&H60", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.917] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.917] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="`") returned 1 [0053.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="`", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="`", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="`", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="`", lpUsedDefaultChar=0x0) returned 1 [0053.918] VarParseNumFromStr (in: strIn="&H2E", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.918] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.918] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0053.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x0) returned 1 [0053.919] VarParseNumFromStr (in: strIn="&H64", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.919] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0053.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="d", lpUsedDefaultChar=0x0) returned 1 [0053.919] VarParseNumFromStr (in: strIn="&H61", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.919] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0053.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="a", lpUsedDefaultChar=0x0) returned 1 [0053.920] VarParseNumFromStr (in: strIn="&H74", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.920] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.920] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0053.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="t", lpUsedDefaultChar=0x0) returned 1 [0053.921] VarParseNumFromStr (in: strIn="&H61", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.921] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.921] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0053.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="a", lpUsedDefaultChar=0x0) returned 1 [0053.922] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.922] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.923] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.923] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.923] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.923] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.923] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.923] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.924] VarParseNumFromStr (in: strIn="&H38", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.924] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="8") returned 1 [0053.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8", lpUsedDefaultChar=0x0) returned 1 [0053.925] VarParseNumFromStr (in: strIn="&H7", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.925] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="\x07") returned 1 [0053.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x07", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x07", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x07", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x07", lpUsedDefaultChar=0x0) returned 1 [0053.926] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.926] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.926] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.926] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.926] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.926] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.927] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.927] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.927] VarParseNumFromStr (in: strIn="&H20", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.927] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 1 [0053.928] VarParseNumFromStr (in: strIn="&H1", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.928] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0053.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01", lpUsedDefaultChar=0x0) returned 1 [0053.929] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.929] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.930] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.930] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.930] VarParseNumFromStr (in: strIn="&H8", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.930] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="\x08") returned 1 [0053.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x08", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x08", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x08", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x08", lpUsedDefaultChar=0x0) returned 1 [0053.931] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.931] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.931] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.931] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.931] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.932] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.932] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.932] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.932] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.933] VarParseNumFromStr (in: strIn="&HE", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.933] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="\x0e") returned 1 [0053.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0e", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0e", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0e", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x0e", lpUsedDefaultChar=0x0) returned 1 [0053.934] VarParseNumFromStr (in: strIn="&H1", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.934] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.934] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0053.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01", lpUsedDefaultChar=0x0) returned 1 [0053.935] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.935] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.935] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.936] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.936] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.938] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.938] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.940] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.940] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.941] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.942] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.943] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.943] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.944] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.944] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.945] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.946] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.946] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.948] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.948] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.950] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.950] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.952] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.952] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.954] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.954] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.956] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.956] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.958] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.958] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.960] VarParseNumFromStr (in: strIn="&H40", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.960] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="@") returned 1 [0053.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@", lpUsedDefaultChar=0x0) returned 1 [0053.962] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.962] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.962] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.963] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.963] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.964] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.965] VarParseNumFromStr (in: strIn="&HC0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.965] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.965] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="À") returned 1 [0053.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="À", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="À", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="À", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="À", lpUsedDefaultChar=0x0) returned 1 [0053.966] VarParseNumFromStr (in: strIn="&H2E", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.966] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.966] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0053.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x0) returned 1 [0053.967] VarParseNumFromStr (in: strIn="&H72", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.967] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.968] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0053.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="r", lpUsedDefaultChar=0x0) returned 1 [0053.968] VarParseNumFromStr (in: strIn="&H73", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.968] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.969] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0053.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="s", lpUsedDefaultChar=0x0) returned 1 [0053.969] VarParseNumFromStr (in: strIn="&H72", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.969] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.970] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0053.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="r", lpUsedDefaultChar=0x0) returned 1 [0053.971] VarParseNumFromStr (in: strIn="&H63", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.971] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.972] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0053.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c", lpUsedDefaultChar=0x0) returned 1 [0053.973] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.973] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.973] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.975] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.975] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.975] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.977] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.977] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.977] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.979] VarParseNumFromStr (in: strIn="&HE4", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.979] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="ä") returned 1 [0053.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ä", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ä", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ä", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ä", lpUsedDefaultChar=0x0) returned 1 [0053.981] VarParseNumFromStr (in: strIn="&H66", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.981] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0053.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="f", lpUsedDefaultChar=0x0) returned 1 [0053.983] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.983] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.985] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.985] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.985] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.987] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.987] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.987] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.989] VarParseNumFromStr (in: strIn="&H30", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.989] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.989] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0053.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0", lpUsedDefaultChar=0x0) returned 1 [0053.990] VarParseNumFromStr (in: strIn="&H1", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.991] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.991] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0053.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01", lpUsedDefaultChar=0x0) returned 1 [0053.992] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.992] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.992] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.994] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.994] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.994] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.995] VarParseNumFromStr (in: strIn="&H68", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.995] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.995] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe44, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0053.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 1 [0053.996] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.996] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.996] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe6c, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.997] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.997] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.998] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe6c, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.998] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.998] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.998] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0053.999] VarParseNumFromStr (in: strIn="&H16", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0053.999] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0053.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfe6c, cchWideChar=1 | out: lpWideCharStr="\x16") returned 1 [0053.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x16", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0053.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x16", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x16", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x16", lpUsedDefaultChar=0x0) returned 1 [0054.000] VarParseNumFromStr (in: strIn="&H1", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.000] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.001] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0054.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01", lpUsedDefaultChar=0x0) returned 1 [0054.002] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.002] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.002] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.003] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.003] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.003] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.004] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.004] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.004] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.005] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.005] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.005] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.006] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.006] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.007] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.007] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.007] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.007] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.007] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.008] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.008] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.008] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.008] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.009] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.009] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.009] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.009] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.009] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.010] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.010] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.010] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.010] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.011] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.011] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.011] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.012] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.012] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.012] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.013] VarParseNumFromStr (in: strIn="&H40", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.013] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.013] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="@") returned 1 [0054.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@", lpUsedDefaultChar=0x0) returned 1 [0054.013] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.013] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.014] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.014] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.015] VarParseNumFromStr (in: strIn="&HC0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.015] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.015] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="À") returned 1 [0054.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="À", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="À", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="À", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="À", lpUsedDefaultChar=0x0) returned 1 [0054.015] VarParseNumFromStr (in: strIn="&H2E", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.015] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.015] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0054.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x0) returned 1 [0054.016] VarParseNumFromStr (in: strIn="&H72", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.016] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.016] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0054.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="r", lpUsedDefaultChar=0x0) returned 1 [0054.016] VarParseNumFromStr (in: strIn="&H65", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.017] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.017] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0054.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e", lpUsedDefaultChar=0x0) returned 1 [0054.017] VarParseNumFromStr (in: strIn="&H6C", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.017] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.017] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0054.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="l", lpUsedDefaultChar=0x0) returned 1 [0054.018] VarParseNumFromStr (in: strIn="&H6F", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.018] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0054.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="o", lpUsedDefaultChar=0x0) returned 1 [0054.019] VarParseNumFromStr (in: strIn="&H63", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.019] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.019] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0054.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c", lpUsedDefaultChar=0x0) returned 1 [0054.020] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.020] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.020] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.020] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.020] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.020] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.021] VarParseNumFromStr (in: strIn="&H6C", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.021] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.021] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0054.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="l", lpUsedDefaultChar=0x0) returned 1 [0054.022] VarParseNumFromStr (in: strIn="&H13", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.022] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x13") returned 1 [0054.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x13", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x13", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x13", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x13", lpUsedDefaultChar=0x0) returned 1 [0054.023] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.023] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.023] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.024] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.024] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.025] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.025] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.025] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.026] VarParseNumFromStr (in: strIn="&HA0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.026] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.026] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0054.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 1 [0054.027] VarParseNumFromStr (in: strIn="&H1", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.027] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.027] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0054.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01", lpUsedDefaultChar=0x0) returned 1 [0054.028] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.028] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.030] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.030] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.030] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.030] WriteFile (in: hFile=0xb4, lpBuffer=0x354748*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18f388, lpOverlapped=0x0 | out: lpBuffer=0x354748*, lpNumberOfBytesWritten=0x18f388*=0x200, lpOverlapped=0x0) returned 1 [0054.032] VarParseNumFromStr (in: strIn="&H14", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.032] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.032] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="\x14") returned 1 [0054.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x14", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x14", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x14", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x14", lpUsedDefaultChar=0x0) returned 1 [0054.034] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.034] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.034] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.035] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.035] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.035] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.035] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.035] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.036] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.036] VarParseNumFromStr (in: strIn="&H7E", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.036] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.036] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="~") returned 1 [0054.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="~", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="~", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="~", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="~", lpUsedDefaultChar=0x0) returned 1 [0054.037] VarParseNumFromStr (in: strIn="&H1", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.037] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0054.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x01", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01", lpUsedDefaultChar=0x0) returned 1 [0054.038] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.038] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.038] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.038] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.039] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.040] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.040] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.040] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.041] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.041] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.042] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.042] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.042] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.042] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.042] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.042] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.043] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.043] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.043] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.044] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.044] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.044] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.045] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.045] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.045] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.046] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.046] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.046] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.047] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.047] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.049] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.049] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.049] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.050] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.050] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.050] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.051] VarParseNumFromStr (in: strIn="&H40", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.051] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.051] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="@") returned 1 [0054.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@", lpUsedDefaultChar=0x0) returned 1 [0054.052] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.052] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.052] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.052] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.053] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.053] VarParseNumFromStr (in: strIn="&H42", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.053] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.053] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="B") returned 1 [0054.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="B", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="B", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="B", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B", lpUsedDefaultChar=0x0) returned 1 [0054.054] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.054] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.054] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.055] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.055] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.055] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.057] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.057] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.057] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.059] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.059] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.060] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.061] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.061] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.062] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.063] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.064] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.064] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.065] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.065] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.066] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.066] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.066] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.067] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.068] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.068] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.068] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.069] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.069] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.069] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.070] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.070] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.071] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.071] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.071] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.073] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.073] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.074] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.074] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.074] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.075] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.075] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.076] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.076] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.077] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.077] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.078] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.078] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.078] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.079] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.079] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.079] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.080] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.080] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.081] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.081] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.082] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.082] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.082] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.083] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.083] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.083] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.083] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.083] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.083] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.084] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.084] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.084] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.084] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.085] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.085] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.086] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.086] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.086] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.086] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.087] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.087] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.088] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.088] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.088] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.088] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.089] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.089] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.089] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.090] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.090] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.090] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.091] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.091] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.091] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.091] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.092] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.092] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.093] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.093] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.093] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.093] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.094] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.094] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.094] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.095] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.095] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.095] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.096] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.096] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.097] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.097] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.097] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.098] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.098] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.098] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.098] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.098] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.099] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.100] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.100] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.101] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.102] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.102] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.103] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.103] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.105] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.105] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.106] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.106] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.108] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.108] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.110] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.110] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.111] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.111] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.112] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.112] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.113] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.113] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.114] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.114] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.114] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.115] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.115] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.116] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.116] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.116] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.117] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.117] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.117] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.118] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.118] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.118] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.118] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.119] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.119] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.119] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.120] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.120] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.120] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.121] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.121] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.121] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.121] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.121] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.122] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.122] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.122] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.122] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.123] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.123] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.123] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.124] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.124] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.124] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.125] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.125] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.125] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.126] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.126] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.126] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.128] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.128] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.128] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.128] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.128] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.129] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.130] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.130] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.130] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.131] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.131] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.132] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.132] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.133] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.133] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.134] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.134] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.135] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.136] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.136] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.137] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.137] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.138] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.138] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.139] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.139] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.140] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.140] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.140] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.142] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.142] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.142] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.144] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.144] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.146] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.146] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.148] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.148] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.148] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.149] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.149] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.149] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.151] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.151] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.151] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.153] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.153] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.153] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.154] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.154] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.154] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.156] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.156] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.156] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.157] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.157] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.158] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.160] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.160] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.161] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.161] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.162] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.163] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.163] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.163] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.165] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.165] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.167] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.167] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.169] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.169] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.171] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.171] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.172] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.172] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.173] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.175] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.175] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.175] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.176] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.177] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.177] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.178] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.178] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.179] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.180] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.180] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.181] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.182] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.182] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.183] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.185] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.185] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.185] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.186] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.186] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.186] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.188] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.188] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.188] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.191] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.191] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.192] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.193] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.194] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.194] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.195] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.195] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.196] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.196] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.197] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.197] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.199] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.199] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.200] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.201] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.201] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.201] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.202] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.202] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.204] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.204] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.206] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.207] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.208] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.208] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.208] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.209] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.209] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.210] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.210] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.212] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.212] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.213] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.213] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.213] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.214] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.214] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.214] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.214] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.215] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.215] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.215] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.215] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.215] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.216] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.216] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.216] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.216] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.217] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.217] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.217] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.217] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.218] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.218] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.220] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.221] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.221] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.223] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.223] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.223] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.224] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.225] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.226] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.227] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.228] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.228] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.229] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.230] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.230] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.231] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.231] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.231] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.233] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.233] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.233] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.234] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.234] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.235] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.235] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.235] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.237] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.237] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.237] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.238] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.238] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.239] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.240] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.240] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.242] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.242] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.244] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.244] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.245] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.246] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.247] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.247] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.249] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.249] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.249] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.250] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.250] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.251] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.252] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.252] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.253] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.253] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.255] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.255] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.256] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.257] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.257] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.258] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.258] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.258] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.259] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.259] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.260] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.261] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.261] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.261] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.262] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.263] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.263] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.264] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.264] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.265] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.265] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.265] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.266] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.266] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.267] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.268] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.268] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.269] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.270] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.270] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.271] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.271] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.272] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.272] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.272] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.272] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dfb24, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.273] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.273] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.273] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f958, cbMultiByte=1, lpWideCharStr=0x2dc9d4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0054.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.275] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.275] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.276] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.276] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.277] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.277] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.277] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.277] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.278] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.278] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.278] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.278] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.279] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.279] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe44, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.280] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.280] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe6c, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.281] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.281] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfe6c, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.282] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.282] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.283] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.283] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.284] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.284] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.285] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.285] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.286] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.286] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.287] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.287] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.287] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.287] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.288] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.288] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.289] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.289] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.289] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.289] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.290] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.290] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.291] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.291] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.291] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.291] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.292] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.292] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.293] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.293] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.294] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.294] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.294] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.294] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.295] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.295] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.295] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.295] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.296] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.296] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.297] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.299] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.299] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.299] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.300] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.300] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.300] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.300] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.301] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.301] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.301] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.301] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.302] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.302] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.302] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.302] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.303] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.303] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.304] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.304] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.304] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.304] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.304] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.304] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.305] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.305] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.305] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.306] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.306] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.306] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.307] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.307] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.307] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.307] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.308] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.308] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.309] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.309] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.310] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.310] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.311] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.311] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.312] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.312] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.313] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.313] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.315] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.315] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.316] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.316] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.317] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.317] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.318] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.318] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.319] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.319] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.320] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.320] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.321] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.321] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.322] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.322] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.323] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.323] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.324] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.324] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.324] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.324] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.325] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.325] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.326] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.326] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.328] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.328] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.329] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.329] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.331] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.331] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.332] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.332] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.333] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.333] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.334] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.334] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.335] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.335] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.335] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.335] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.336] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.336] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.337] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.337] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.338] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.338] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.339] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.339] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.340] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.340] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.341] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.341] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.342] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.342] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.342] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.342] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.343] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.343] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.344] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.344] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.345] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.345] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.346] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.346] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.346] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.346] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.347] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.347] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.347] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.347] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.348] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.348] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.348] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.348] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.349] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.349] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.350] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.350] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.350] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.350] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.351] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.351] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.352] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.352] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.353] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.353] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.353] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.353] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.354] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.354] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.355] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.355] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.356] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.356] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.356] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.356] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.357] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.357] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.358] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.358] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.359] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.359] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.360] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.360] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.362] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.362] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.363] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.363] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.365] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.365] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.366] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.366] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.367] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.367] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.368] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.368] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.369] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.369] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.370] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.370] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.372] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.372] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.373] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.373] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.374] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.374] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.376] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.376] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.377] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.378] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.379] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.379] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.380] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.380] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.381] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.381] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.381] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.381] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.382] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.382] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.382] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.382] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x2dfb24, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0054.383] VarParseNumFromStr (in: strIn="&H0", lcid=0x409, dwFlags=0x80000000, pnumprs=0x18f910, rgbDig=0x18f8f0 | out: pnumprs=0x18f910, rgbDig=0x18f8f0) returned 0x0 [0054.383] VarNumFromParseNum (in: pnumprs=0x18f910, rgbDig=0x18f8f0, dwVtBits=0x8, pvar=0x18f940 | out: pvar=0x18f940) returned 0x0 [0054.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0054.468] IMalloc:Free (This=0x767666bc, pv=0x354710) [0054.469] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x8e)) [0054.469] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x8e)) [0054.472] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.472] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.473] GetCurrentProcessId () returned 0xa90 [0054.474] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.474] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.474] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.498] GetTickCount () returned 0x11475eb [0054.498] GetTickCount () returned 0x11475eb [0054.516] GetTickCount () returned 0x114760b [0054.516] CoFreeUnusedLibraries () [0054.517] GetTickCount () returned 0x114760b [0054.517] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.517] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.517] GetTickCount () returned 0x114760b [0054.553] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0xec)) [0054.553] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.553] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.554] GetCurrentProcessId () returned 0xa90 [0054.554] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.554] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.554] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.554] GetTickCount () returned 0x114762a [0054.554] GetTickCount () returned 0x114762a [0054.554] GetTickCount () returned 0x114762a [0054.554] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.554] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.554] GetTickCount () returned 0x114762a [0054.555] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0xec)) [0054.555] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.555] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.556] GetCurrentProcessId () returned 0xa90 [0054.556] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.556] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.556] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.556] GetTickCount () returned 0x114762a [0054.556] GetTickCount () returned 0x114762a [0054.556] GetTickCount () returned 0x114762a [0054.557] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.557] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.557] GetTickCount () returned 0x114762a [0054.563] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0xfc)) [0054.563] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.563] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.564] GetCurrentProcessId () returned 0xa90 [0054.564] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.564] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.564] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.564] GetTickCount () returned 0x1147639 [0054.564] GetTickCount () returned 0x1147639 [0054.564] GetTickCount () returned 0x1147639 [0054.564] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.564] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.564] GetTickCount () returned 0x1147639 [0054.609] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x11b)) [0054.615] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.615] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.615] GetCurrentProcessId () returned 0xa90 [0054.615] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.615] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.615] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.615] GetTickCount () returned 0x1147668 [0054.615] GetTickCount () returned 0x1147668 [0054.615] GetTickCount () returned 0x1147668 [0054.615] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.615] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.615] GetTickCount () returned 0x1147668 [0054.621] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x12a)) [0054.621] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.621] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.621] GetCurrentProcessId () returned 0xa90 [0054.621] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.621] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.621] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.621] GetTickCount () returned 0x1147668 [0054.621] GetTickCount () returned 0x1147668 [0054.622] GetTickCount () returned 0x1147668 [0054.622] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.622] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.622] GetTickCount () returned 0x1147668 [0054.633] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x13a)) [0054.633] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.633] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.633] GetCurrentProcessId () returned 0xa90 [0054.633] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.633] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.633] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.633] GetTickCount () returned 0x1147678 [0054.633] GetTickCount () returned 0x1147678 [0054.634] GetTickCount () returned 0x1147678 [0054.634] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.634] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.634] GetTickCount () returned 0x1147678 [0054.634] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x13a)) [0054.634] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.634] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.634] GetCurrentProcessId () returned 0xa90 [0054.634] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.634] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.635] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.635] GetTickCount () returned 0x1147678 [0054.635] GetTickCount () returned 0x1147678 [0054.635] GetTickCount () returned 0x1147678 [0054.635] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.635] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.635] GetTickCount () returned 0x1147678 [0054.653] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x14a)) [0054.653] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.653] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.653] GetCurrentProcessId () returned 0xa90 [0054.653] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.653] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.653] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.653] GetTickCount () returned 0x1147687 [0054.653] GetTickCount () returned 0x1147687 [0054.653] GetTickCount () returned 0x1147687 [0054.653] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.653] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.653] GetTickCount () returned 0x1147687 [0054.655] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x14a)) [0054.655] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.655] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.656] GetCurrentProcessId () returned 0xa90 [0054.656] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.656] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.656] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.656] GetTickCount () returned 0x1147687 [0054.656] GetTickCount () returned 0x1147687 [0054.656] GetTickCount () returned 0x1147687 [0054.656] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.656] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.656] GetTickCount () returned 0x1147687 [0054.657] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x159)) [0054.657] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.657] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.657] GetCurrentProcessId () returned 0xa90 [0054.657] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.658] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.658] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.658] GetTickCount () returned 0x1147697 [0054.658] GetTickCount () returned 0x1147697 [0054.658] GetTickCount () returned 0x1147697 [0054.658] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.658] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.658] GetTickCount () returned 0x1147697 [0054.659] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x159)) [0054.659] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.659] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.659] GetCurrentProcessId () returned 0xa90 [0054.659] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.659] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.659] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.659] GetTickCount () returned 0x1147697 [0054.659] GetTickCount () returned 0x1147697 [0054.659] GetTickCount () returned 0x1147697 [0054.659] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.660] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.660] GetTickCount () returned 0x1147697 [0054.665] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x159)) [0054.665] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.665] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.665] GetCurrentProcessId () returned 0xa90 [0054.665] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.665] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.665] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.665] GetTickCount () returned 0x1147697 [0054.665] GetTickCount () returned 0x1147697 [0054.665] GetTickCount () returned 0x1147697 [0054.665] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.665] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.665] GetTickCount () returned 0x1147697 [0054.666] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x159)) [0054.666] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.666] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.666] GetCurrentProcessId () returned 0xa90 [0054.666] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.666] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.667] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.667] GetTickCount () returned 0x1147697 [0054.667] GetTickCount () returned 0x1147697 [0054.667] GetTickCount () returned 0x1147697 [0054.667] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.667] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.667] GetTickCount () returned 0x1147697 [0054.672] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x169)) [0054.673] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.673] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.673] GetCurrentProcessId () returned 0xa90 [0054.674] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.674] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.674] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.674] GetTickCount () returned 0x11476a7 [0054.674] GetTickCount () returned 0x11476a7 [0054.674] GetTickCount () returned 0x11476a7 [0054.674] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.674] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.674] GetTickCount () returned 0x11476a7 [0054.682] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x169)) [0054.683] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.683] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.683] GetCurrentProcessId () returned 0xa90 [0054.683] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.683] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.683] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.683] GetTickCount () returned 0x11476a7 [0054.683] GetTickCount () returned 0x11476a7 [0054.683] GetTickCount () returned 0x11476a7 [0054.683] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.683] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.683] GetTickCount () returned 0x11476a7 [0054.684] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x169)) [0054.684] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.684] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.684] GetCurrentProcessId () returned 0xa90 [0054.684] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.684] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.684] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.684] GetTickCount () returned 0x11476a7 [0054.684] GetTickCount () returned 0x11476a7 [0054.685] GetTickCount () returned 0x11476a7 [0054.685] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.685] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.685] GetTickCount () returned 0x11476a7 [0054.685] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x169)) [0054.685] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.685] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.685] GetCurrentProcessId () returned 0xa90 [0054.685] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.685] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.685] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.685] GetTickCount () returned 0x11476a7 [0054.685] GetTickCount () returned 0x11476a7 [0054.685] GetTickCount () returned 0x11476a7 [0054.686] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.686] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.686] GetTickCount () returned 0x11476a7 [0054.690] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x178)) [0054.691] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.691] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.691] GetCurrentProcessId () returned 0xa90 [0054.691] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.691] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.691] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.691] GetTickCount () returned 0x11476b6 [0054.691] GetTickCount () returned 0x11476b6 [0054.692] GetTickCount () returned 0x11476b6 [0054.692] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.692] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.692] GetTickCount () returned 0x11476b6 [0054.698] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x178)) [0054.698] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.698] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.699] GetCurrentProcessId () returned 0xa90 [0054.699] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.699] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.699] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.699] GetTickCount () returned 0x11476b6 [0054.699] GetTickCount () returned 0x11476b6 [0054.699] GetTickCount () returned 0x11476b6 [0054.699] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.699] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.699] GetTickCount () returned 0x11476b6 [0054.703] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x178)) [0054.703] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.703] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.703] GetCurrentProcessId () returned 0xa90 [0054.703] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.704] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.704] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.704] GetTickCount () returned 0x11476c6 [0054.704] GetTickCount () returned 0x11476c6 [0054.704] GetTickCount () returned 0x11476c6 [0054.704] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.704] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.704] GetTickCount () returned 0x11476c6 [0054.719] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x198)) [0054.719] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.720] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.720] GetCurrentProcessId () returned 0xa90 [0054.720] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.720] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.720] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.720] GetTickCount () returned 0x11476d5 [0054.720] GetTickCount () returned 0x11476d5 [0054.720] GetTickCount () returned 0x11476d5 [0054.720] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.720] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.720] GetTickCount () returned 0x11476d5 [0054.723] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x198)) [0054.723] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.723] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.723] GetCurrentProcessId () returned 0xa90 [0054.723] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.724] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.724] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.724] GetTickCount () returned 0x11476d5 [0054.724] GetTickCount () returned 0x11476d5 [0054.724] GetTickCount () returned 0x11476d5 [0054.724] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.724] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.724] GetTickCount () returned 0x11476d5 [0054.735] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x1a7)) [0054.735] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.735] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.735] GetCurrentProcessId () returned 0xa90 [0054.735] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.735] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.735] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.735] GetTickCount () returned 0x11476e5 [0054.735] GetTickCount () returned 0x11476e5 [0054.735] GetTickCount () returned 0x11476e5 [0054.735] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.735] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.735] GetTickCount () returned 0x11476e5 [0054.751] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x1b7)) [0054.751] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.751] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.752] GetCurrentProcessId () returned 0xa90 [0054.752] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.752] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.752] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.752] GetTickCount () returned 0x11476f5 [0054.752] GetTickCount () returned 0x11476f5 [0054.752] GetTickCount () returned 0x11476f5 [0054.752] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.752] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.752] GetTickCount () returned 0x11476f5 [0054.778] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x1c6)) [0054.779] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.779] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.779] GetCurrentProcessId () returned 0xa90 [0054.779] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.779] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.780] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.780] GetTickCount () returned 0x1147704 [0054.780] GetTickCount () returned 0x1147704 [0054.780] GetTickCount () returned 0x1147704 [0054.780] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.780] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.780] GetTickCount () returned 0x1147704 [0054.782] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x1d6)) [0054.782] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.782] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.782] GetCurrentProcessId () returned 0xa90 [0054.782] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.782] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.783] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.783] GetTickCount () returned 0x1147714 [0054.783] GetTickCount () returned 0x1147714 [0054.783] GetTickCount () returned 0x1147714 [0054.783] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.783] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.783] GetTickCount () returned 0x1147714 [0054.797] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x1e6)) [0054.798] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.798] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.798] GetCurrentProcessId () returned 0xa90 [0054.798] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.798] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.798] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.798] GetTickCount () returned 0x1147723 [0054.798] GetTickCount () returned 0x1147723 [0054.798] GetTickCount () returned 0x1147723 [0054.798] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.798] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.798] GetTickCount () returned 0x1147723 [0054.802] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x1e6)) [0054.802] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.802] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.802] GetCurrentProcessId () returned 0xa90 [0054.802] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.802] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.803] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.803] GetTickCount () returned 0x1147723 [0054.803] GetTickCount () returned 0x1147723 [0054.803] GetTickCount () returned 0x1147723 [0054.803] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.803] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.803] GetTickCount () returned 0x1147723 [0054.803] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x1e6)) [0054.803] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.803] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.804] GetCurrentProcessId () returned 0xa90 [0054.804] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.804] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.804] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.804] GetTickCount () returned 0x1147723 [0054.804] GetTickCount () returned 0x1147723 [0054.804] GetTickCount () returned 0x1147723 [0054.804] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.804] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.804] GetTickCount () returned 0x1147723 [0054.814] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x1f5)) [0054.814] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.814] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.814] GetCurrentProcessId () returned 0xa90 [0054.814] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.814] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.814] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.814] GetTickCount () returned 0x1147733 [0054.814] GetTickCount () returned 0x1147733 [0054.814] GetTickCount () returned 0x1147733 [0054.814] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.814] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.814] GetTickCount () returned 0x1147733 [0054.817] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x1f5)) [0054.818] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.818] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.818] GetCurrentProcessId () returned 0xa90 [0054.818] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.818] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.818] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.818] GetTickCount () returned 0x1147733 [0054.818] GetTickCount () returned 0x1147733 [0054.818] GetTickCount () returned 0x1147733 [0054.818] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.818] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.818] GetTickCount () returned 0x1147733 [0054.818] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x1f5)) [0054.818] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.818] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.819] GetCurrentProcessId () returned 0xa90 [0054.819] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.819] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.819] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.819] GetTickCount () returned 0x1147733 [0054.819] GetTickCount () returned 0x1147733 [0054.819] GetTickCount () returned 0x1147733 [0054.819] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.819] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.819] GetTickCount () returned 0x1147733 [0054.844] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x214)) [0054.844] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.844] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.845] GetCurrentProcessId () returned 0xa90 [0054.845] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.845] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.845] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.845] GetTickCount () returned 0x1147752 [0054.845] GetTickCount () returned 0x1147752 [0054.845] GetTickCount () returned 0x1147752 [0054.845] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.845] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.845] GetTickCount () returned 0x1147752 [0054.860] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x224)) [0054.860] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.860] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.861] GetCurrentProcessId () returned 0xa90 [0054.861] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.861] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.861] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.861] GetTickCount () returned 0x1147762 [0054.861] GetTickCount () returned 0x1147762 [0054.861] GetTickCount () returned 0x1147762 [0054.861] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.861] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.862] GetTickCount () returned 0x1147762 [0054.875] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x234)) [0054.875] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.875] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.876] GetCurrentProcessId () returned 0xa90 [0054.876] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.876] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.876] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.876] GetTickCount () returned 0x1147771 [0054.876] GetTickCount () returned 0x1147771 [0054.876] GetTickCount () returned 0x1147771 [0054.876] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.876] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.876] GetTickCount () returned 0x1147771 [0054.891] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x243)) [0054.891] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.891] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.891] GetCurrentProcessId () returned 0xa90 [0054.891] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.891] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.892] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.892] GetTickCount () returned 0x1147781 [0054.892] GetTickCount () returned 0x1147781 [0054.892] GetTickCount () returned 0x1147781 [0054.892] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.892] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.892] GetTickCount () returned 0x1147781 [0054.906] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x253)) [0054.907] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.907] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.907] GetCurrentProcessId () returned 0xa90 [0054.907] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.907] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.907] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.907] GetTickCount () returned 0x1147791 [0054.907] GetTickCount () returned 0x1147791 [0054.907] GetTickCount () returned 0x1147791 [0054.907] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.907] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.907] GetTickCount () returned 0x1147791 [0054.938] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x272)) [0054.938] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.938] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.938] GetCurrentProcessId () returned 0xa90 [0054.938] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.938] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.938] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.938] GetTickCount () returned 0x11477b0 [0054.938] GetTickCount () returned 0x11477b0 [0054.939] GetTickCount () returned 0x11477b0 [0054.939] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.939] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.939] GetTickCount () returned 0x11477b0 [0054.953] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x282)) [0054.954] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.954] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.954] GetCurrentProcessId () returned 0xa90 [0054.954] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.954] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.954] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.955] GetTickCount () returned 0x11477bf [0054.955] GetTickCount () returned 0x11477bf [0054.955] GetTickCount () returned 0x11477bf [0054.955] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.955] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.955] GetTickCount () returned 0x11477bf [0054.969] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x291)) [0054.970] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0054.970] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.970] GetCurrentProcessId () returned 0xa90 [0054.971] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0054.971] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0054.971] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0054.971] GetTickCount () returned 0x11477cf [0054.971] GetTickCount () returned 0x11477cf [0054.972] GetTickCount () returned 0x11477cf [0054.972] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0054.972] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0054.972] GetTickCount () returned 0x11477cf [0055.000] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x2b0)) [0055.000] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.000] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.001] GetCurrentProcessId () returned 0xa90 [0055.001] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.001] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.001] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.001] GetTickCount () returned 0x11477ee [0055.001] GetTickCount () returned 0x11477ee [0055.001] GetTickCount () returned 0x11477ee [0055.001] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.001] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.001] GetTickCount () returned 0x11477ee [0055.031] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x2d0)) [0055.032] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.032] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.032] GetCurrentProcessId () returned 0xa90 [0055.032] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.032] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.032] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.032] GetTickCount () returned 0x114780d [0055.032] GetTickCount () returned 0x114780d [0055.032] GetTickCount () returned 0x114780d [0055.032] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.033] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.033] GetTickCount () returned 0x114780d [0055.047] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x2df)) [0055.047] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.047] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.047] GetCurrentProcessId () returned 0xa90 [0055.047] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.047] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.048] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.048] GetTickCount () returned 0x114781d [0055.048] GetTickCount () returned 0x114781d [0055.048] GetTickCount () returned 0x114781d [0055.048] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.048] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.048] GetTickCount () returned 0x114781d [0055.063] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x2ef)) [0055.063] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.063] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.063] GetCurrentProcessId () returned 0xa90 [0055.063] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.063] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.063] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.063] GetTickCount () returned 0x114782d [0055.063] GetTickCount () returned 0x114782d [0055.063] GetTickCount () returned 0x114782d [0055.063] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.063] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.063] GetTickCount () returned 0x114782d [0055.081] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x2fe)) [0055.081] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.081] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.082] GetCurrentProcessId () returned 0xa90 [0055.082] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.082] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.082] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.082] GetTickCount () returned 0x114783c [0055.082] GetTickCount () returned 0x114783c [0055.082] GetTickCount () returned 0x114783c [0055.082] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.082] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.082] GetTickCount () returned 0x114783c [0055.094] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x30e)) [0055.094] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.094] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.094] GetCurrentProcessId () returned 0xa90 [0055.094] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.094] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.094] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.094] GetTickCount () returned 0x114784c [0055.094] GetTickCount () returned 0x114784c [0055.094] GetTickCount () returned 0x114784c [0055.094] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.094] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.094] GetTickCount () returned 0x114784c [0055.125] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x32d)) [0055.125] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.125] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.125] GetCurrentProcessId () returned 0xa90 [0055.125] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.126] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.126] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.126] GetTickCount () returned 0x114786b [0055.126] GetTickCount () returned 0x114786b [0055.126] GetTickCount () returned 0x114786b [0055.126] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.126] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.126] GetTickCount () returned 0x114786b [0055.140] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x33d)) [0055.141] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.141] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.141] GetCurrentProcessId () returned 0xa90 [0055.141] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.141] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.142] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.142] GetTickCount () returned 0x114787b [0055.142] GetTickCount () returned 0x114787b [0055.142] GetTickCount () returned 0x114787b [0055.142] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.142] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.142] GetTickCount () returned 0x114787b [0055.156] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x34c)) [0055.156] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.156] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.157] GetCurrentProcessId () returned 0xa90 [0055.157] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.157] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.157] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.157] GetTickCount () returned 0x114788a [0055.157] GetTickCount () returned 0x114788a [0055.157] GetTickCount () returned 0x114788a [0055.157] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.157] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.157] GetTickCount () returned 0x114788a [0055.158] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x34c)) [0055.158] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.158] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.158] GetCurrentProcessId () returned 0xa90 [0055.158] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.158] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.158] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.158] GetTickCount () returned 0x114788a [0055.158] GetTickCount () returned 0x114788a [0055.158] GetTickCount () returned 0x114788a [0055.158] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.159] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.159] GetTickCount () returned 0x114788a [0055.188] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x36c)) [0055.188] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.188] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.188] GetCurrentProcessId () returned 0xa90 [0055.188] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.188] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.188] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.188] GetTickCount () returned 0x11478a9 [0055.188] GetTickCount () returned 0x11478a9 [0055.188] GetTickCount () returned 0x11478a9 [0055.188] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.188] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.188] GetTickCount () returned 0x11478a9 [0055.218] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x38b)) [0055.219] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.219] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.219] GetCurrentProcessId () returned 0xa90 [0055.219] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.219] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.219] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.219] GetTickCount () returned 0x11478c9 [0055.219] GetTickCount () returned 0x11478c9 [0055.219] GetTickCount () returned 0x11478c9 [0055.220] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.220] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.220] GetTickCount () returned 0x11478c9 [0055.234] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x39a)) [0055.234] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.234] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.235] GetCurrentProcessId () returned 0xa90 [0055.235] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.235] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.235] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.235] GetTickCount () returned 0x11478d8 [0055.235] GetTickCount () returned 0x11478d8 [0055.236] GetTickCount () returned 0x11478d8 [0055.236] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.236] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.236] GetTickCount () returned 0x11478d8 [0055.250] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x3aa)) [0055.250] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.250] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.250] GetCurrentProcessId () returned 0xa90 [0055.250] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.250] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.250] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.250] GetTickCount () returned 0x11478e8 [0055.250] GetTickCount () returned 0x11478e8 [0055.250] GetTickCount () returned 0x11478e8 [0055.250] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.250] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.251] GetTickCount () returned 0x11478e8 [0055.281] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x19, wMilliseconds=0x3c9)) [0055.281] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.281] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.281] GetCurrentProcessId () returned 0xa90 [0055.281] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.281] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.282] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.282] GetTickCount () returned 0x1147907 [0055.282] GetTickCount () returned 0x1147907 [0055.282] GetTickCount () returned 0x1147907 [0055.282] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.282] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.282] GetTickCount () returned 0x1147907 [0055.312] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x1a, wMilliseconds=0x0)) [0055.313] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.313] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.313] GetCurrentProcessId () returned 0xa90 [0055.313] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.313] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.313] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.313] GetTickCount () returned 0x1147926 [0055.313] GetTickCount () returned 0x1147926 [0055.313] GetTickCount () returned 0x1147926 [0055.313] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.313] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.313] GetTickCount () returned 0x1147926 [0055.328] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x1a, wMilliseconds=0x10)) [0055.328] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.328] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.328] GetCurrentProcessId () returned 0xa90 [0055.328] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.328] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.328] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.328] GetTickCount () returned 0x1147936 [0055.328] GetTickCount () returned 0x1147936 [0055.328] GetTickCount () returned 0x1147936 [0055.328] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.328] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.328] GetTickCount () returned 0x1147936 [0055.343] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x1a, wMilliseconds=0x20)) [0055.343] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.343] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.344] GetCurrentProcessId () returned 0xa90 [0055.344] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.344] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.344] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.344] GetTickCount () returned 0x1147945 [0055.344] GetTickCount () returned 0x1147945 [0055.344] GetTickCount () returned 0x1147945 [0055.344] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.344] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.344] GetTickCount () returned 0x1147945 [0055.359] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x1a, wMilliseconds=0x2f)) [0055.359] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.359] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.360] GetCurrentProcessId () returned 0xa90 [0055.360] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.360] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.360] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.360] GetTickCount () returned 0x1147955 [0055.360] GetTickCount () returned 0x1147955 [0055.360] GetTickCount () returned 0x1147955 [0055.360] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.361] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.361] GetTickCount () returned 0x1147955 [0055.364] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x1a, wMilliseconds=0x2f)) [0055.364] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.364] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.364] GetCurrentProcessId () returned 0xa90 [0055.364] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.364] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.364] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.364] GetTickCount () returned 0x1147955 [0055.365] GetTickCount () returned 0x1147955 [0055.365] GetTickCount () returned 0x1147955 [0055.365] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.365] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.365] GetTickCount () returned 0x1147955 [0055.374] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x1a, wMilliseconds=0x3f)) [0055.375] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.375] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.375] GetCurrentProcessId () returned 0xa90 [0055.375] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.375] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.375] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.375] GetTickCount () returned 0x1147965 [0055.375] GetTickCount () returned 0x1147965 [0055.375] GetTickCount () returned 0x1147965 [0055.375] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.375] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.375] GetTickCount () returned 0x1147965 [0055.376] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x1a, wMilliseconds=0x3f)) [0055.376] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.376] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.376] GetCurrentProcessId () returned 0xa90 [0055.376] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.376] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.376] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.376] GetTickCount () returned 0x1147965 [0055.376] GetTickCount () returned 0x1147965 [0055.377] GetTickCount () returned 0x1147965 [0055.377] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.377] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.377] GetTickCount () returned 0x1147965 [0055.377] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x1a, wMilliseconds=0x3f)) [0055.377] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.377] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.378] GetCurrentProcessId () returned 0xa90 [0055.378] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.378] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.378] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.378] GetTickCount () returned 0x1147965 [0055.378] GetTickCount () returned 0x1147965 [0055.378] GetTickCount () returned 0x1147965 [0055.378] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.378] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.378] GetTickCount () returned 0x1147965 [0055.390] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x1a, wMilliseconds=0x4e)) [0055.390] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.390] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.390] GetCurrentProcessId () returned 0xa90 [0055.390] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.391] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.391] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.391] GetTickCount () returned 0x1147974 [0055.391] GetTickCount () returned 0x1147974 [0055.391] GetTickCount () returned 0x1147974 [0055.391] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.391] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.391] GetTickCount () returned 0x1147974 [0055.406] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x1a, wMilliseconds=0x5e)) [0055.406] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.406] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.407] GetCurrentProcessId () returned 0xa90 [0055.407] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.407] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.407] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.407] GetTickCount () returned 0x1147984 [0055.407] GetTickCount () returned 0x1147984 [0055.408] GetTickCount () returned 0x1147984 [0055.408] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.408] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.408] GetTickCount () returned 0x1147984 [0055.422] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x1a, wMilliseconds=0x6e)) [0055.422] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.422] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.423] GetCurrentProcessId () returned 0xa90 [0055.423] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.423] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.423] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.423] GetTickCount () returned 0x1147993 [0055.423] GetTickCount () returned 0x1147993 [0055.424] GetTickCount () returned 0x1147993 [0055.424] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.424] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.424] GetTickCount () returned 0x1147993 [0055.437] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x1a, wMilliseconds=0x7d)) [0055.437] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.437] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.437] GetCurrentProcessId () returned 0xa90 [0055.437] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.437] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.437] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.437] GetTickCount () returned 0x11479a3 [0055.437] GetTickCount () returned 0x11479a3 [0055.437] GetTickCount () returned 0x11479a3 [0055.438] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.438] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.438] GetTickCount () returned 0x11479a3 [0055.438] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x1a, wMilliseconds=0x7d)) [0055.438] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.438] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.438] GetCurrentProcessId () returned 0xa90 [0055.438] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.439] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.439] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.439] GetTickCount () returned 0x11479a3 [0055.439] GetTickCount () returned 0x11479a3 [0055.439] GetTickCount () returned 0x11479a3 [0055.439] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.439] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.439] GetTickCount () returned 0x11479a3 [0055.439] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x1a, wMilliseconds=0x7d)) [0055.439] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.439] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0055.440] GetCurrentProcessId () returned 0xa90 [0055.440] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x16716d0 [0055.440] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bc0 [0055.440] PeekMessageA (in: lpMsg=0x18f8d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d0) returned 0 [0055.440] GetTickCount () returned 0x11479a3 [0055.440] GetTickCount () returned 0x11479a3 [0055.440] GetTickCount () returned 0x11479a3 [0055.440] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bc0 | out: hHeap=0x1660000) returned 1 [0055.440] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x16716d0 | out: hHeap=0x1660000) returned 1 [0055.441] GetTickCount () returned 0x11479a3 [0055.468] GetLocalTime (in: lpSystemTime=0x18f984 | out: lpSystemTime=0x18f984*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x6, wDay=0x13, wHour=0x17, wMinute=0x2, wSecond=0x1a, wMilliseconds=0x9c)) [0055.468] VarSub (in: pvarLeft=0x18f9e4, pvarRight=0x18fa18, pvarResult=0x18fa04 | out: pvarResult=0x18fa04) returned 0x0 [0055.468] VarCmp (pvarLeft=0x18fa04, pvarRight=0x18f9c4, lcid=0x0, dwFlags=0x30001) returned 0x2 [0055.468] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0055.468] VirtualQuery (in: lpAddress=0x18f6c4, lpBuffer=0x18f6a8, dwLength=0x1c | out: lpBuffer=0x18f6a8*(BaseAddress=0x18f000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0055.469] IMalloc:Alloc (This=0x767666bc, cb=0x74) returned 0x2d10b0 [0055.469] IMalloc:GetSize (This=0x767666bc, pv=0x2d10b0) returned 0x74 [0055.469] IMalloc:Alloc (This=0x767666bc, cb=0x10) returned 0x2dc9d0 [0055.469] IMalloc:GetSize (This=0x767666bc, pv=0x2dc9d0) returned 0x10 [0055.469] GetCurrentThreadId () returned 0xa94 [0055.469] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x104) returned 0x167af90 [0055.469] GetCurrentThreadId () returned 0xa94 [0055.469] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xe8) returned 0x167b0a0 [0055.469] GetCurrentThreadId () returned 0xa94 [0055.470] GetCurrentThreadId () returned 0xa94 [0055.470] GetCurrentThreadId () returned 0xa94 [0055.470] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x140) returned 0x167b190 [0055.471] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x10) returned 0x1672bc0 [0055.471] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x434) returned 0x167b2d8 [0055.471] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xb4 [0055.471] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x198) returned 0x167b718 [0055.471] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x16716d0 [0055.471] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x14) returned 0x16716f0 [0055.471] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x80) returned 0x167b8b8 [0055.472] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167b8b8 | out: hHeap=0x1660000) returned 1 [0055.472] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x72992cd8, cbMultiByte=-1, lpWideCharStr=0x18f79c, cchWideChar=14 | out: lpWideCharStr="MS Sans Serif") returned 14 [0055.472] OleCreateFontIndirect () returned 0x0 [0055.474] lstrlenA (lpString="Form1") returned 5 [0055.474] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x6) returned 0x16775f8 [0055.475] OleLoadPictureEx () returned 0x0 [0055.939] lstrlenA (lpString="Form1") returned 5 [0055.939] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x6) returned 0x1677608 [0055.940] lstrlenA (lpString=0x729b32f8) returned 10 [0055.940] lstrcpyA (in: lpString1=0x18f7b0, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0055.940] lstrlenA (lpString="ThunderRT6Form") returned 14 [0055.940] lstrcpynA (in: lpString1=0x18f7be, lpString2="DC", iMaxLength=116 | out: lpString1="DC") returned="DC" [0055.940] lstrlenA (lpString="ThunderRT6") returned 10 [0055.940] lstrcpyA (in: lpString1=0x18f744, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0055.940] GetClassInfoA (in: hInstance=0x72940000, lpClassName="ThunderRT6Form", lpWndClass=0x18f770 | out: lpWndClass=0x18f770) returned 0 [0055.940] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0055.941] RegisterClassA (lpWndClass=0x18f770) returned 0x16c122 [0055.941] lstrlenA (lpString="ThunderRT6") returned 10 [0055.941] lstrcpyA (in: lpString1=0x18f744, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0055.941] lstrlenA (lpString="ThunderRT6Form") returned 14 [0055.941] lstrcpynA (in: lpString1=0x18f752, lpString2="DC", iMaxLength=29 | out: lpString1="DC") returned="DC" [0055.941] RegisterClassA (lpWndClass=0x18f770) returned 0xc165 [0055.941] AdjustWindowRectEx (in: lpRect=0x18f870, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x18f870) returned 1 [0055.941] CreateWindowExA (dwExStyle=0x0, lpClassName=0xc165, lpWindowName="Form1", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=169, nHeight=66, hWndParent=0x4015c, hMenu=0x0, hInstance=0x72940000, lpParam=0x0) returned 0x5026a [0055.942] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x81, wParam=0x0, lParam=0x18f394) returned 0x1 [0055.942] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x83, wParam=0x0, lParam=0x18f380) returned 0x0 [0056.220] GetSystemMenu (hWnd=0x5026a, bRevert=0) returned 0x150237 [0056.221] SetWindowContextHelpId (param_1=0x5026a, param_2=0xffffffff) returned 1 [0056.221] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x1, wParam=0x0, lParam=0x18f394) returned 0x0 [0056.221] GetWindowRect (in: hWnd=0x5026a, lpRect=0x18f834 | out: lpRect=0x18f834) returned 1 [0056.221] GetDC (hWnd=0x5026a) returned 0x1701024b [0056.221] GetTextMetricsA (in: hdc=0x1701024b, lptm=0x18f75c | out: lptm=0x18f75c) returned 1 [0056.221] SetBkMode (hdc=0x1701024b, mode=1) returned 2 [0056.222] OleTranslateColor () returned 0x0 [0056.222] SetBkColor (hdc=0x1701024b, color=0xffffff) returned 0xffffff [0056.222] OleTranslateColor () returned 0x0 [0056.222] SetTextColor (hdc=0x1701024b, color=0x0) returned 0x0 [0056.222] OleTranslateColor () returned 0x0 [0056.222] CreatePen (iStyle=0, cWidth=1, color=0x0) returned 0x4b300162 [0056.222] SelectObject (hdc=0x1701024b, h=0x4b300162) returned 0x1b00017 [0056.222] SelectObject (hdc=0x1701024b, h=0x1900011) returned 0x1900010 [0056.222] ClientToScreen (in: hWnd=0x5026a, lpPoint=0x18f73c | out: lpPoint=0x18f73c) returned 1 [0056.222] SetBrushOrgEx (in: hdc=0x1701024b, x=6, y=4, lppt=0x0 | out: lppt=0x0) returned 1 [0056.222] UnrealizeObject (h=0x1900015) returned 1 [0056.222] SelectObject (hdc=0x1701024b, h=0x1900015) returned 0x1900011 [0056.222] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x14) returned 0x1671710 [0056.226] SelectObject (hdc=0x1701024b, h=0x180a09da) returned 0x18a002e [0056.226] GetTextMetricsA (in: hdc=0x1701024b, lptm=0x18f550 | out: lptm=0x18f550) returned 1 [0056.228] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xdc) returned 0x167b8b8 [0056.228] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1671730 [0056.228] lstrlenA (lpString="ThunderRT6") returned 10 [0056.228] lstrcpyA (in: lpString1=0x18f780, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0056.228] lstrlenA (lpString="ThunderRT6") returned 10 [0056.228] lstrcpyA (in: lpString1=0x18f714, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0056.228] GetClassInfoA (in: hInstance=0x72940000, lpClassName="ThunderRT6Timer", lpWndClass=0x18f740 | out: lpWndClass=0x18f740) returned 0 [0056.228] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0056.228] RegisterClassA (lpWndClass=0x18f740) returned 0x34c169 [0056.228] CreateWindowExA (dwExStyle=0x4, lpClassName=0xc169, lpWindowName=0x0, dwStyle=0x44010000, X=16, Y=0, nWidth=0, nHeight=0, hWndParent=0x5026a, hMenu=0x1, hInstance=0x72940000, lpParam=0x0) returned 0x6011c [0056.229] SetTimer (hWnd=0x6011c, nIDEvent=0x6011c, uElapse=0x2710, lpTimerFunc=0x0) returned 0x6011c [0056.229] NtdllDefWindowProc_A (hWnd=0x6011c, Msg=0x81, wParam=0x0, lParam=0x18f364) returned 0x1 [0056.229] NtdllDefWindowProc_A (hWnd=0x6011c, Msg=0x83, wParam=0x0, lParam=0x18f350) returned 0x0 [0056.229] NtdllDefWindowProc_A (hWnd=0x6011c, Msg=0x1, wParam=0x0, lParam=0x18f364) returned 0x0 [0056.229] NtdllDefWindowProc_A (hWnd=0x6011c, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0056.229] NtdllDefWindowProc_A (hWnd=0x6011c, Msg=0x3, wParam=0x0, lParam=0x10) returned 0x0 [0056.230] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xf0) returned 0x167b9a0 [0056.230] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1671750 [0056.231] lstrlenA (lpString="ThunderRT6") returned 10 [0056.231] lstrcpyA (in: lpString1=0x18f780, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0056.231] lstrlenA (lpString="ThunderRT6") returned 10 [0056.231] lstrcpyA (in: lpString1=0x18f714, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0056.231] GetClassInfoA (in: hInstance=0x0, lpClassName="ListBox", lpWndClass=0x18f740 | out: lpWndClass=0x18f740) returned 1 [0056.231] GetClassInfoA (in: hInstance=0x72940000, lpClassName="ThunderRT6ListBox", lpWndClass=0x18f740 | out: lpWndClass=0x18f740) returned 0 [0056.231] RegisterClassA (lpWndClass=0x18f740) returned 0xc059 [0056.231] CreateWindowExA (dwExStyle=0x204, lpClassName=0xc059, lpWindowName=0x0, dwStyle=0x44310081, X=144, Y=32, nWidth=41, nHeight=17, hWndParent=0x5026a, hMenu=0x2, hInstance=0x72940000, lpParam=0x0) returned 0x60116 [0056.232] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x81, wParam=0x0, lParam=0x18f364) returned 0x1 [0056.232] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x83, wParam=0x0, lParam=0x18f350) returned 0x0 [0056.233] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x1, wParam=0x0, lParam=0x18f364) returned 0x1 [0056.235] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x5, wParam=0x0, lParam=0xd0014) returned 0x0 [0056.235] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x46, wParam=0x0, lParam=0x18eedc) returned 0x0 [0056.238] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x83, wParam=0x1, lParam=0x18eeb4) returned 0x0 [0056.239] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x47, wParam=0x0, lParam=0x18eedc) returned 0x0 [0056.239] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x5, wParam=0x0, lParam=0x14) returned 0x0 [0056.239] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x46, wParam=0x0, lParam=0x18e404) returned 0x0 [0056.239] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x83, wParam=0x1, lParam=0x18e3dc) returned 0x0 [0056.240] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x47, wParam=0x0, lParam=0x18e404) returned 0x0 [0056.240] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x5, wParam=0x0, lParam=0x25) returned 0x0 [0057.362] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x46, wParam=0x0, lParam=0x18d944) returned 0x0 [0057.362] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x83, wParam=0x1, lParam=0x18d91c) returned 0x0 [0057.364] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x47, wParam=0x0, lParam=0x18d944) returned 0x0 [0057.367] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x3, wParam=0x0, lParam=0x220092) returned 0x0 [0057.367] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x14) returned 0x1671770 [0057.367] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x30, wParam=0x180a09da, lParam=0x0) returned 0x0 [0057.370] ShowWindow (hWnd=0x60116, nCmdShow=5) returned 0 [0057.370] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0057.371] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xe4) returned 0x167ba98 [0057.372] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1671790 [0057.372] lstrlenA (lpString="ThunderRT6") returned 10 [0057.372] lstrcpyA (in: lpString1=0x18f780, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0057.372] lstrlenA (lpString="ThunderRT6") returned 10 [0057.372] lstrcpyA (in: lpString1=0x18f714, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0057.372] GetClassInfoA (in: hInstance=0x0, lpClassName="ListBox", lpWndClass=0x18f740 | out: lpWndClass=0x18f740) returned 1 [0057.372] GetClassInfoA (in: hInstance=0x72940000, lpClassName="ThunderRT6FileListBox", lpWndClass=0x18f740 | out: lpWndClass=0x18f740) returned 0 [0057.373] RegisterClassA (lpWndClass=0x18f740) returned 0xc166 [0057.373] CreateWindowExA (dwExStyle=0x204, lpClassName=0xc166, lpWindowName=0x0, dwStyle=0x44a10003, X=144, Y=48, nWidth=41, nHeight=19, hWndParent=0x5026a, hMenu=0x3, hInstance=0x72940000, lpParam=0x0) returned 0x5011e [0057.373] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x81, wParam=0x0, lParam=0x18f364) returned 0x1 [0057.374] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x83, wParam=0x0, lParam=0x18f350) returned 0x0 [0057.374] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x1, wParam=0x0, lParam=0x18f364) returned 0x1 [0057.374] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x4) returned 0x1677618 [0057.375] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x5, wParam=0x0, lParam=0xd0012) returned 0x0 [0057.375] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x46, wParam=0x0, lParam=0x18ef28) returned 0x0 [0057.375] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x83, wParam=0x1, lParam=0x18ef00) returned 0x0 [0057.376] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x47, wParam=0x0, lParam=0x18ef28) returned 0x0 [0057.376] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x5, wParam=0x0, lParam=0x12) returned 0x0 [0057.376] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x46, wParam=0x0, lParam=0x18e4e8) returned 0x0 [0057.376] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x83, wParam=0x1, lParam=0x18e4c0) returned 0x0 [0057.377] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x47, wParam=0x0, lParam=0x18e4e8) returned 0x0 [0057.377] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x5, wParam=0x0, lParam=0x23) returned 0x0 [0057.379] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x3, wParam=0x0, lParam=0x330093) returned 0x0 [0057.379] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x14) returned 0x16717b0 [0057.380] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x30, wParam=0x180a09da, lParam=0x0) returned 0x0 [0057.380] lstrlenA (lpString=".") returned 1 [0057.380] lstrlenA (lpString=".") returned 1 [0057.380] lstrcpyA (in: lpString1=0x18f60c, lpString2="" | out: lpString1="") returned="" [0057.380] lstrlenA (lpString="") returned 0 [0057.380] lstrlenA (lpString="") returned 0 [0057.380] lstrlenA (lpString=".") returned 1 [0057.380] lstrcatA (in: lpString1="", lpString2="." | out: lpString1=".") returned="." [0057.381] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x18f3a4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0057.381] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0057.381] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0057.381] lstrcpyA (in: lpString1=0x18f738, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0057.381] lstrcmpA (lpString1="", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned -1 [0057.381] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x26) returned 0x167bba0 [0057.382] lstrcpyA (in: lpString1=0x18f3c4, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0057.382] GetShortPathNameA (in: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpszShortPath=0x18f4cc, cchBuffer=0x105 | out: lpszShortPath="C:\\Users\\5P5NRG~1\\Desktop") returned 0x19 [0057.382] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\Desktop") returned 25 [0057.382] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0xb, wParam=0x0, lParam=0x0) returned 0x0 [0057.382] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x184, wParam=0x0, lParam=0x0) returned 0x0 [0057.383] lstrcpyA (in: lpString1=0x18f4e6, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0057.383] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\Desktop\\*.*", lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x12c3ca00, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x12c3ca00, ftLastWriteTime.dwHighDateTime=0x1d68e85, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x184, cFileName=".", cAlternateFileName="")) returned 0x354928 [0057.383] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x12c3ca00, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x12c3ca00, ftLastWriteTime.dwHighDateTime=0x1d68e85, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x184, cFileName="..", cAlternateFileName="")) returned 1 [0057.383] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e836d80, ftCreationTime.dwHighDateTime=0x1d5e615, ftLastAccessTime.dwLowDateTime=0xfd3e37d0, ftLastAccessTime.dwHighDateTime=0x1d5e24d, ftLastWriteTime.dwLowDateTime=0xfd3e37d0, ftLastWriteTime.dwHighDateTime=0x1d5e24d, nFileSizeHigh=0x0, nFileSizeLow=0x12783, dwReserved0=0x0, dwReserved1=0x184, cFileName="5pe8K.swf", cAlternateFileName="")) returned 1 [0057.383] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x0 [0057.383] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x0 [0057.383] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac8ec0e0, ftCreationTime.dwHighDateTime=0x1d5e70f, ftLastAccessTime.dwLowDateTime=0x21b2e970, ftLastAccessTime.dwHighDateTime=0x1d5de9e, ftLastWriteTime.dwLowDateTime=0x21b2e970, ftLastWriteTime.dwHighDateTime=0x1d5de9e, nFileSizeHigh=0x0, nFileSizeLow=0x2324, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="6ug3MEu7AEZX2LBVjH.png", cAlternateFileName="6UG3ME~1.PNG")) returned 1 [0057.383] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x1 [0057.383] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x1 [0057.384] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb459790, ftCreationTime.dwHighDateTime=0x1d5da1b, ftLastAccessTime.dwLowDateTime=0xfca2cdc0, ftLastAccessTime.dwHighDateTime=0x1d5e614, ftLastWriteTime.dwLowDateTime=0xfca2cdc0, ftLastWriteTime.dwHighDateTime=0x1d5e614, nFileSizeHigh=0x0, nFileSizeLow=0x17f8f, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="ANkpZ.mkv", cAlternateFileName="")) returned 1 [0057.384] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x2 [0057.384] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x2 [0057.384] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x670a5480, ftCreationTime.dwHighDateTime=0x1d5e822, ftLastAccessTime.dwLowDateTime=0x22882b70, ftLastAccessTime.dwHighDateTime=0x1d5e16a, ftLastWriteTime.dwLowDateTime=0x22882b70, ftLastWriteTime.dwHighDateTime=0x1d5e16a, nFileSizeHigh=0x0, nFileSizeLow=0x8b77, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="bVY16ra.mp3", cAlternateFileName="")) returned 1 [0057.384] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x3 [0057.384] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x3 [0057.384] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29ca830, ftCreationTime.dwHighDateTime=0x1d5e58b, ftLastAccessTime.dwLowDateTime=0x1a385f20, ftLastAccessTime.dwHighDateTime=0x1d5ddec, ftLastWriteTime.dwLowDateTime=0x1a385f20, ftLastWriteTime.dwHighDateTime=0x1d5ddec, nFileSizeHigh=0x0, nFileSizeLow=0xe643, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="C4c7pA-qeG.gif", cAlternateFileName="C4C7PA~1.GIF")) returned 1 [0057.384] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x4 [0057.384] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x4 [0057.384] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.384] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5f292f0, ftCreationTime.dwHighDateTime=0x1d5d857, ftLastAccessTime.dwLowDateTime=0x87665050, ftLastAccessTime.dwHighDateTime=0x1d5e735, ftLastWriteTime.dwLowDateTime=0x87665050, ftLastWriteTime.dwHighDateTime=0x1d5e735, nFileSizeHigh=0x0, nFileSizeLow=0x551b, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="eEnz6JGF.png", cAlternateFileName="")) returned 1 [0057.384] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x5 [0057.384] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x5 [0057.384] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x590d1970, ftCreationTime.dwHighDateTime=0x1d5e7e7, ftLastAccessTime.dwLowDateTime=0x5a987ae0, ftLastAccessTime.dwHighDateTime=0x1d5dca3, ftLastWriteTime.dwLowDateTime=0x5a987ae0, ftLastWriteTime.dwHighDateTime=0x1d5dca3, nFileSizeHigh=0x0, nFileSizeLow=0x1518d, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="f26rrTD1pPg.mkv", cAlternateFileName="F26RRT~1.MKV")) returned 1 [0057.384] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x6 [0057.385] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x6 [0057.385] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c739e90, ftCreationTime.dwHighDateTime=0x1d5dc16, ftLastAccessTime.dwLowDateTime=0xbed70410, ftLastAccessTime.dwHighDateTime=0x1d5e3d1, ftLastWriteTime.dwLowDateTime=0xbed70410, ftLastWriteTime.dwHighDateTime=0x1d5e3d1, nFileSizeHigh=0x0, nFileSizeLow=0x151c, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="FzsqxN6B5a7Ue9.bmp", cAlternateFileName="FZSQXN~1.BMP")) returned 1 [0057.385] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x7 [0057.385] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x7 [0057.385] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3412190, ftCreationTime.dwHighDateTime=0x1d5e039, ftLastAccessTime.dwLowDateTime=0xdbd1900, ftLastAccessTime.dwHighDateTime=0x1d5e5dc, ftLastWriteTime.dwLowDateTime=0xdbd1900, ftLastWriteTime.dwHighDateTime=0x1d5e5dc, nFileSizeHigh=0x0, nFileSizeLow=0x41c9, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="gjQP9u-s36qE.png", cAlternateFileName="GJQP9U~1.PNG")) returned 1 [0057.385] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x8 [0057.385] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x8 [0057.385] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x525e7a90, ftCreationTime.dwHighDateTime=0x1d5db14, ftLastAccessTime.dwLowDateTime=0x982f8a50, ftLastAccessTime.dwHighDateTime=0x1d5dc04, ftLastWriteTime.dwLowDateTime=0x982f8a50, ftLastWriteTime.dwHighDateTime=0x1d5dc04, nFileSizeHigh=0x0, nFileSizeLow=0x12685, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="hBmwvC3ALPOJB.wav", cAlternateFileName="HBMWVC~1.WAV")) returned 1 [0057.385] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x9 [0057.385] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x9 [0057.385] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24397460, ftCreationTime.dwHighDateTime=0x1d5e1ab, ftLastAccessTime.dwLowDateTime=0x39e9b610, ftLastAccessTime.dwHighDateTime=0x1d5dd8e, ftLastWriteTime.dwLowDateTime=0x39e9b610, ftLastWriteTime.dwHighDateTime=0x1d5dd8e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="JzXY gDrG_Jozwj-5g", cAlternateFileName="JZXYGD~1")) returned 1 [0057.385] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500a1a60, ftCreationTime.dwHighDateTime=0x1d5db00, ftLastAccessTime.dwLowDateTime=0xbfcb8c60, ftLastAccessTime.dwHighDateTime=0x1d5e093, ftLastWriteTime.dwLowDateTime=0xbfcb8c60, ftLastWriteTime.dwHighDateTime=0x1d5e093, nFileSizeHigh=0x0, nFileSizeLow=0xd89a, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="nQtoj4d9RcGmhhIAF.rtf", cAlternateFileName="NQTOJ4~1.RTF")) returned 1 [0057.385] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0xa [0057.385] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0xa [0057.385] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd6ea40, ftCreationTime.dwHighDateTime=0x1d5da37, ftLastAccessTime.dwLowDateTime=0xdbc414f0, ftLastAccessTime.dwHighDateTime=0x1d5e723, ftLastWriteTime.dwLowDateTime=0xdbc414f0, ftLastWriteTime.dwHighDateTime=0x1d5e723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="NW4ytAA2w320poJhgpqZ", cAlternateFileName="NW4YTA~1")) returned 1 [0057.386] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9a9e70, ftCreationTime.dwHighDateTime=0x1d5ddb4, ftLastAccessTime.dwLowDateTime=0x17239840, ftLastAccessTime.dwHighDateTime=0x1d5e111, ftLastWriteTime.dwLowDateTime=0x17239840, ftLastWriteTime.dwHighDateTime=0x1d5e111, nFileSizeHigh=0x0, nFileSizeLow=0xb084, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="pZJdMvUJjDnd1uA.bmp", cAlternateFileName="PZJDMV~1.BMP")) returned 1 [0057.386] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0xb [0057.386] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0xb [0057.386] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bf2c780, ftCreationTime.dwHighDateTime=0x1d5de13, ftLastAccessTime.dwLowDateTime=0xbe14ca60, ftLastAccessTime.dwHighDateTime=0x1d5d8ed, ftLastWriteTime.dwLowDateTime=0xbe14ca60, ftLastWriteTime.dwHighDateTime=0x1d5d8ed, nFileSizeHigh=0x0, nFileSizeLow=0x18c96, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="qz8dXFR4RARvYHsr.jpg", cAlternateFileName="QZ8DXF~1.JPG")) returned 1 [0057.386] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0xc [0057.386] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0xc [0057.386] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb55404f0, ftCreationTime.dwHighDateTime=0x1d5d96e, ftLastAccessTime.dwLowDateTime=0xa3621ac0, ftLastAccessTime.dwHighDateTime=0x1d5e170, ftLastWriteTime.dwLowDateTime=0xa3621ac0, ftLastWriteTime.dwHighDateTime=0x1d5e170, nFileSizeHigh=0x0, nFileSizeLow=0x33b0, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="TbM0XlJR-0oPZAHOz.swf", cAlternateFileName="TBM0XL~1.SWF")) returned 1 [0057.386] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0xd [0057.386] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0xd [0057.386] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba5c2b0, ftCreationTime.dwHighDateTime=0x1d5d9d7, ftLastAccessTime.dwLowDateTime=0x9fec2200, ftLastAccessTime.dwHighDateTime=0x1d5db8a, ftLastWriteTime.dwLowDateTime=0x9fec2200, ftLastWriteTime.dwHighDateTime=0x1d5db8a, nFileSizeHigh=0x0, nFileSizeLow=0x517f, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="VggxJb Dak09K_djx3b.mp3", cAlternateFileName="VGGXJB~1.MP3")) returned 1 [0057.386] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0xe [0057.386] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0xe [0057.386] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac9894f0, ftCreationTime.dwHighDateTime=0x1d5e0b9, ftLastAccessTime.dwLowDateTime=0xc15f4790, ftLastAccessTime.dwHighDateTime=0x1d5de29, ftLastWriteTime.dwLowDateTime=0xc15f4790, ftLastWriteTime.dwHighDateTime=0x1d5de29, nFileSizeHigh=0x0, nFileSizeLow=0x10280, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="wV3hEc3yi.avi", cAlternateFileName="WV3HEC~1.AVI")) returned 1 [0057.386] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0xf [0057.386] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0xf [0057.387] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe26b6f40, ftCreationTime.dwHighDateTime=0x1d5da78, ftLastAccessTime.dwLowDateTime=0x3440c5d0, ftLastAccessTime.dwHighDateTime=0x1d5e650, ftLastWriteTime.dwLowDateTime=0x3440c5d0, ftLastWriteTime.dwHighDateTime=0x1d5e650, nFileSizeHigh=0x0, nFileSizeLow=0x14853, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="xBm-do6KvORHz7Zr9S32.jpg", cAlternateFileName="XBM-DO~1.JPG")) returned 1 [0057.387] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x10 [0057.387] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x10 [0057.387] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5781550, ftCreationTime.dwHighDateTime=0x1d5d8b1, ftLastAccessTime.dwLowDateTime=0xacbf76c0, ftLastAccessTime.dwHighDateTime=0x1d5e770, ftLastWriteTime.dwLowDateTime=0xacbf76c0, ftLastWriteTime.dwHighDateTime=0x1d5e770, nFileSizeHigh=0x0, nFileSizeLow=0x4533, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="YkZMjhDE.flv", cAlternateFileName="")) returned 1 [0057.387] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x11 [0057.387] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x11 [0057.387] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f8ea070, ftCreationTime.dwHighDateTime=0x1d5dfc9, ftLastAccessTime.dwLowDateTime=0xaedfba20, ftLastAccessTime.dwHighDateTime=0x1d5dd69, ftLastWriteTime.dwLowDateTime=0xaedfba20, ftLastWriteTime.dwHighDateTime=0x1d5dd69, nFileSizeHigh=0x0, nFileSizeLow=0x728a, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="YRx3RSx_vvB2l.gif", cAlternateFileName="YRX3RS~1.GIF")) returned 1 [0057.387] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x12 [0057.388] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x12 [0057.388] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac35e8f0, ftCreationTime.dwHighDateTime=0x1d5dace, ftLastAccessTime.dwLowDateTime=0x4e5ac6c0, ftLastAccessTime.dwHighDateTime=0x1d5dc3f, ftLastWriteTime.dwLowDateTime=0x4e5ac6c0, ftLastWriteTime.dwHighDateTime=0x1d5dc3f, nFileSizeHigh=0x0, nFileSizeLow=0xeb4d, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="yY-v R57oK36Y627DVY.docx", cAlternateFileName="YY-VR5~1.DOC")) returned 1 [0057.388] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x13 [0057.388] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x13 [0057.388] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c83b300, ftCreationTime.dwHighDateTime=0x1d5df1c, ftLastAccessTime.dwLowDateTime=0xd392fa20, ftLastAccessTime.dwHighDateTime=0x1d5df45, ftLastWriteTime.dwLowDateTime=0xd392fa20, ftLastWriteTime.dwHighDateTime=0x1d5df45, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="yz_xSO44tL", cAlternateFileName="YZ_XSO~1")) returned 1 [0057.388] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a26500, ftCreationTime.dwHighDateTime=0x1d68e85, ftLastAccessTime.dwLowDateTime=0x2a26500, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x79d1fc00, ftLastWriteTime.dwHighDateTime=0x1d68e79, nFileSizeHigh=0x0, nFileSizeLow=0x71be00, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="zhang.exe", cAlternateFileName="")) returned 1 [0057.388] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x14 [0057.388] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x14 [0057.388] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934a4900, ftCreationTime.dwHighDateTime=0x1d5e175, ftLastAccessTime.dwLowDateTime=0x23db48f0, ftLastAccessTime.dwHighDateTime=0x1d5e065, ftLastWriteTime.dwLowDateTime=0x23db48f0, ftLastWriteTime.dwHighDateTime=0x1d5e065, nFileSizeHigh=0x0, nFileSizeLow=0xebf8, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="Zjhye8zHEQ.odp", cAlternateFileName="ZJHYE8~1.ODP")) returned 1 [0057.388] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x15 [0057.388] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18f600) returned 0x15 [0057.388] FindNextFileA (in: hFindFile=0x354928, lpFindFileData=0x18f5d4 | out: lpFindFileData=0x18f5d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934a4900, ftCreationTime.dwHighDateTime=0x1d5e175, ftLastAccessTime.dwLowDateTime=0x23db48f0, ftLastAccessTime.dwHighDateTime=0x1d5e065, ftLastWriteTime.dwLowDateTime=0x23db48f0, ftLastWriteTime.dwHighDateTime=0x1d5e065, nFileSizeHigh=0x0, nFileSizeLow=0xebf8, dwReserved0=0x5011e, dwReserved1=0x180, cFileName="Zjhye8zHEQ.odp", cAlternateFileName="ZJHYE8~1.ODP")) returned 0 [0057.388] FindClose (in: hFindFile=0x354928 | out: hFindFile=0x354928) returned 1 [0057.388] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0xb, wParam=0x1, lParam=0x0) returned 0x0 [0057.389] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x46, wParam=0x0, lParam=0x18efec) returned 0x0 [0057.389] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x83, wParam=0x1, lParam=0x18efc4) returned 0x0 [0057.389] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x47, wParam=0x0, lParam=0x18efec) returned 0x0 [0057.390] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x5, wParam=0x0, lParam=0x12) returned 0x0 [0057.391] ShowWindow (hWnd=0x5011e, nCmdShow=5) returned 0 [0057.391] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0057.391] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x144) returned 0x167c388 [0057.391] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x16717d0 [0057.392] lstrlenA (lpString="ThunderRT6") returned 10 [0057.392] lstrcpyA (in: lpString1=0x18f780, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0057.392] lstrlenA (lpString="ThunderRT6PictureBox") returned 20 [0057.392] lstrcpynA (in: lpString1=0x18f794, lpString2="DC", iMaxLength=116 | out: lpString1="DC") returned="DC" [0057.392] lstrlenA (lpString="ThunderRT6") returned 10 [0057.392] lstrcpyA (in: lpString1=0x18f714, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0057.392] GetClassInfoA (in: hInstance=0x72940000, lpClassName="ThunderRT6PictureBox", lpWndClass=0x18f740 | out: lpWndClass=0x18f740) returned 0 [0057.392] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0057.393] RegisterClassA (lpWndClass=0x18f740) returned 0xc167 [0057.393] lstrlenA (lpString="ThunderRT6") returned 10 [0057.393] lstrcpyA (in: lpString1=0x18f714, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0057.393] lstrlenA (lpString="ThunderRT6PictureBox") returned 20 [0057.393] lstrcpynA (in: lpString1=0x18f728, lpString2="DC", iMaxLength=29 | out: lpString1="DC") returned="DC" [0057.393] RegisterClassA (lpWndClass=0x18f740) returned 0xc16b [0057.393] CreateWindowExA (dwExStyle=0x204, lpClassName=0xc16b, lpWindowName=0x0, dwStyle=0x46010000, X=144, Y=16, nWidth=41, nHeight=16, hWndParent=0x5026a, hMenu=0x4, hInstance=0x72940000, lpParam=0x0) returned 0x7011a [0057.393] NtdllDefWindowProc_A (hWnd=0x7011a, Msg=0x81, wParam=0x0, lParam=0x18f364) returned 0x1 [0057.394] NtdllDefWindowProc_A (hWnd=0x7011a, Msg=0x83, wParam=0x0, lParam=0x18f350) returned 0x0 [0057.394] NtdllDefWindowProc_A (hWnd=0x7011a, Msg=0x1, wParam=0x0, lParam=0x18f364) returned 0x0 [0057.394] NtdllDefWindowProc_A (hWnd=0x7011a, Msg=0x5, wParam=0x0, lParam=0xc0025) returned 0x0 [0057.394] GetParent (hWnd=0x7011a) returned 0x5026a [0057.394] GetWindowRect (in: hWnd=0x7011a, lpRect=0x18f190 | out: lpRect=0x18f190) returned 1 [0057.394] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5026a, lpPoints=0x18f190, cPoints=0x2 | out: lpPoints=0x18f190) returned -11731102 [0057.394] NtdllDefWindowProc_A (hWnd=0x7011a, Msg=0x3, wParam=0x0, lParam=0x120092) returned 0x0 [0057.395] GetDC (hWnd=0x7011a) returned 0x2e0109d8 [0057.395] GetTextMetricsA (in: hdc=0x2e0109d8, lptm=0x18f72c | out: lptm=0x18f72c) returned 1 [0057.395] SetBkMode (hdc=0x2e0109d8, mode=1) returned 2 [0057.395] OleTranslateColor () returned 0x0 [0057.395] SetBkColor (hdc=0x2e0109d8, color=0xc0c0c0) returned 0xffffff [0057.395] OleTranslateColor () returned 0x0 [0057.395] SetTextColor (hdc=0x2e0109d8, color=0x0) returned 0x0 [0057.395] OleTranslateColor () returned 0x0 [0057.395] CreatePen (iStyle=0, cWidth=1, color=0x0) returned 0xa3009d0 [0057.395] SelectObject (hdc=0x2e0109d8, h=0xa3009d0) returned 0x1b00017 [0057.396] SelectObject (hdc=0x2e0109d8, h=0x1900011) returned 0x1900010 [0057.396] SetBrushOrgEx (in: hdc=0x2e0109d8, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0057.396] UnrealizeObject (h=0x1900015) returned 1 [0057.396] SelectObject (hdc=0x2e0109d8, h=0x1900015) returned 0x1900011 [0057.396] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x14) returned 0x16717f0 [0057.405] SelectObject (hdc=0x2e0109d8, h=0x5f0a01a2) returned 0x18a002e [0057.406] GetTextMetricsA (in: hdc=0x2e0109d8, lptm=0x18f660 | out: lptm=0x18f660) returned 1 [0057.406] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0xf0) returned 0x167c4d8 [0057.406] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x15) returned 0x1671810 [0057.406] lstrlenA (lpString="ThunderRT6") returned 10 [0057.406] lstrcpyA (in: lpString1=0x18f780, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0057.406] CreateWindowExA (dwExStyle=0x204, lpClassName=0xc059, lpWindowName=0x0, dwStyle=0x44310081, X=144, Y=72, nWidth=41, nHeight=17, hWndParent=0x5026a, hMenu=0x5, hInstance=0x72940000, lpParam=0x0) returned 0x60114 [0057.406] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x81, wParam=0x0, lParam=0x18f364) returned 0x1 [0057.407] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x83, wParam=0x0, lParam=0x18f350) returned 0x0 [0057.407] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x1, wParam=0x0, lParam=0x18f364) returned 0x1 [0057.407] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x5, wParam=0x0, lParam=0xd0014) returned 0x0 [0057.407] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x46, wParam=0x0, lParam=0x18eedc) returned 0x0 [0057.407] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x83, wParam=0x1, lParam=0x18eeb4) returned 0x0 [0057.408] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x47, wParam=0x0, lParam=0x18eedc) returned 0x0 [0057.408] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x5, wParam=0x0, lParam=0x14) returned 0x0 [0057.408] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x46, wParam=0x0, lParam=0x18e404) returned 0x0 [0057.409] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x83, wParam=0x1, lParam=0x18e3dc) returned 0x0 [0057.409] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x47, wParam=0x0, lParam=0x18e404) returned 0x0 [0057.409] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x5, wParam=0x0, lParam=0x25) returned 0x0 [0057.410] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x46, wParam=0x0, lParam=0x18d944) returned 0x0 [0057.410] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x83, wParam=0x1, lParam=0x18d91c) returned 0x0 [0057.411] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x47, wParam=0x0, lParam=0x18d944) returned 0x0 [0057.413] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x3, wParam=0x0, lParam=0x4a0092) returned 0x0 [0057.413] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x14) returned 0x1671830 [0057.414] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x30, wParam=0x180a09da, lParam=0x0) returned 0x0 [0057.414] ShowWindow (hWnd=0x60114, nCmdShow=5) returned 0 [0057.414] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0057.415] GetClientRect (in: hWnd=0x5026a, lpRect=0x18f8f0 | out: lpRect=0x18f8f0) returned 1 [0057.415] MapWindowPoints (in: hWndFrom=0x5026a, hWndTo=0x0, lpPoints=0x18f8f0, cPoints=0x2 | out: lpPoints=0x18f8f0) returned 11796638 [0057.415] EqualRect (lprc1=0x18f8f0, lprc2=0x18f8d0) returned 1 [0057.415] SetEvent (hEvent=0xb4) returned 1 [0057.415] SendMessageA (hWnd=0x5026a, Msg=0x80, wParam=0x1, lParam=0xb0129) returned 0x0 [0057.415] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x80, wParam=0x1, lParam=0xb0129) returned 0x0 [0057.445] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x6012b [0057.449] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x18f7ac | out: ppstm=0x18f7ac*=0x2e5fd0) returned 0x0 [0057.450] GetSystemMetrics (nIndex=49) returned 16 [0057.450] GetSystemMetrics (nIndex=50) returned 16 [0057.450] IStream:RemoteSeek (in: This=0x2e5fd0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0057.450] ISequentialStream:RemoteRead (in: This=0x2e5fd0, pv=0x18f75c, cb=0x6, pcbRead=0x0 | out: pv=0x18f75c*=0x0, pcbRead=0x0) returned 0x0 [0057.450] ISequentialStream:RemoteRead (in: This=0x2e5fd0, pv=0x18f734, cb=0x10, pcbRead=0x0 | out: pv=0x18f734*=0x10, pcbRead=0x0) returned 0x0 [0057.450] IStream:RemoteSeek (in: This=0x2e5fd0, dlibMove=0x16, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0057.450] GlobalLock (hMem=0x3ea000c) returned 0x33f498 [0057.450] ISequentialStream:RemoteRead (in: This=0x2e5fd0, pv=0x33f498, cb=0x28, pcbRead=0x0 | out: pv=0x33f498*=0x28, pcbRead=0x0) returned 0x0 [0057.450] ISequentialStream:RemoteRead (in: This=0x2e5fd0, pv=0x33f4c0, cb=0x540, pcbRead=0x0 | out: pv=0x33f4c0*=0x0, pcbRead=0x0) returned 0x0 [0057.450] GlobalUnlock (hMem=0x3ea000c) returned 0 [0057.450] GlobalLock (hMem=0x3ea000c) returned 0x33f498 [0057.451] GlobalSize (hMem=0x3ea000c) returned 0x568 [0057.451] GetDC (hWnd=0x0) returned 0xe010735 [0057.451] CreateCompatibleBitmap (hdc=0xe010735, cx=32, cy=32) returned 0xffffffff900509cf [0057.451] SelectObject (hdc=0x230101b3, h=0x900509cf) returned 0x185000f [0057.451] StretchDIBits (hdc=0x230101b3, xDest=0, yDest=0, DestWidth=32, DestHeight=32, xSrc=0, ySrc=0, SrcWidth=16, SrcHeight=16, lpBits=0x33f8c0, lpbmi=0x33f498, iUsage=0x0, rop=0xcc0020) returned 16 [0057.451] GetObjectA (in: h=0x900509cf, c=24, pv=0x18f6cc | out: pv=0x18f6cc) returned 24 [0057.451] GlobalLock (hMem=0x3ea001c) returned 0x33fa10 [0057.451] GetBitmapBits (in: hbit=0x900509cf, cb=4096, lpvBits=0x33fa10 | out: lpvBits=0x33fa10) returned 4096 [0057.452] SelectObject (hdc=0x230101b3, h=0x185000f) returned 0x900509cf [0057.452] DeleteObject (ho=0x900509cf) returned 1 [0057.452] CreateBitmap (nWidth=32, nHeight=32, nPlanes=0x1, nBitCount=0x1, lpBits=0x0) returned 0x910509cf [0057.452] SelectObject (hdc=0x230101b3, h=0x910509cf) returned 0x185000f [0057.452] StretchDIBits (hdc=0x230101b3, xDest=0, yDest=0, DestWidth=32, DestHeight=32, xSrc=0, ySrc=0, SrcWidth=16, SrcHeight=16, lpBits=0x33f9c0, lpbmi=0x33f498, iUsage=0x0, rop=0xcc0020) returned 16 [0057.452] GetObjectA (in: h=0x910509cf, c=24, pv=0x18f6b4 | out: pv=0x18f6b4) returned 24 [0057.452] GlobalLock (hMem=0x3ea0024) returned 0x33ed00 [0057.452] GetBitmapBits (in: hbit=0x910509cf, cb=128, lpvBits=0x33ed00 | out: lpvBits=0x33ed00) returned 128 [0057.452] CreateIcon (hInstance=0x400000, nWidth=32, nHeight=32, cPlanes=0x1, cBitsPixel=0x20, lpbANDbits=0x33ed00, lpbXORbits=0x33fa10) returned 0x8016b [0057.452] GlobalUnlock (hMem=0x3ea001c) returned 0 [0057.453] GlobalUnlock (hMem=0x3ea0024) returned 0 [0057.453] SelectObject (hdc=0x230101b3, h=0x185000f) returned 0x910509cf [0057.453] DeleteObject (ho=0x910509cf) returned 1 [0057.453] ReleaseDC (hWnd=0x0, hDC=0xe010735) returned 1 [0057.453] GlobalUnlock (hMem=0x3ea000c) returned 0 [0057.453] SendMessageA (hWnd=0x5026a, Msg=0x80, wParam=0x0, lParam=0x8016b) returned 0x0 [0057.453] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x80, wParam=0x0, lParam=0x8016b) returned 0x0 [0057.453] IUnknown:Release (This=0x2e5fd0) returned 0x0 [0057.453] MonitorFromWindow (hwnd=0x60116, dwFlags=0x2) returned 0x10001 [0057.453] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0x18f83c | out: lpmi=0x18f83c) returned 1 [0057.454] GetWindowLongA (hWnd=0x60116, nIndex=-16) returned 1409351809 [0057.454] GetWindowLongA (hWnd=0x60116, nIndex=-20) returned 516 [0057.454] SelectObject (hdc=0x230101b3, h=0x180a09da) returned 0x18a002e [0057.454] GetTextMetricsA (in: hdc=0x230101b3, lptm=0x18f708 | out: lptm=0x18f708) returned 1 [0057.454] SelectObject (hdc=0x230101b3, h=0x18a002e) returned 0x180a09da [0057.454] GetParent (hWnd=0x60116) returned 0x5026a [0057.454] GetWindowRect (in: hWnd=0x60116, lpRect=0x18f83c | out: lpRect=0x18f83c) returned 1 [0057.454] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5026a, lpPoints=0x18f83c, cPoints=0x2 | out: lpPoints=0x18f83c) returned -11731102 [0057.454] MoveWindow (hWnd=0x60116, X=144, Y=32, nWidth=41, nHeight=17, bRepaint=1) returned 1 [0057.454] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x46, wParam=0x0, lParam=0x18f7d8) returned 0x0 [0057.454] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x83, wParam=0x1, lParam=0x18f7b0) returned 0x0 [0057.456] GetParent (hWnd=0x60116) returned 0x5026a [0057.456] GetWindowRect (in: hWnd=0x60116, lpRect=0x18f50c | out: lpRect=0x18f50c) returned 1 [0057.456] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5026a, lpPoints=0x18f50c, cPoints=0x2 | out: lpPoints=0x18f50c) returned -11731102 [0057.456] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x47, wParam=0x0, lParam=0x18f7d8) returned 0x0 [0057.456] GetWindowLongA (hWnd=0x60116, nIndex=-16) returned 1409351809 [0057.456] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x5, wParam=0x0, lParam=0xd0025) returned 0x0 [0057.456] GetParent (hWnd=0x60116) returned 0x5026a [0057.456] GetWindowRect (in: hWnd=0x60116, lpRect=0x18f83c | out: lpRect=0x18f83c) returned 1 [0057.456] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5026a, lpPoints=0x18f83c, cPoints=0x2 | out: lpPoints=0x18f83c) returned -11731102 [0057.457] MonitorFromWindow (hwnd=0x5011e, dwFlags=0x2) returned 0x10001 [0057.457] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0x18f888 | out: lpmi=0x18f888) returned 1 [0057.457] GetWindowLongA (hWnd=0x5011e, nIndex=-16) returned 1419837443 [0057.457] SelectObject (hdc=0x230101b3, h=0x180a09da) returned 0x18a002e [0057.457] GetTextMetricsA (in: hdc=0x230101b3, lptm=0x18f7a0 | out: lptm=0x18f7a0) returned 1 [0057.457] SelectObject (hdc=0x230101b3, h=0x18a002e) returned 0x180a09da [0057.457] GetParent (hWnd=0x5011e) returned 0x5026a [0057.457] GetWindowRect (in: hWnd=0x5011e, lpRect=0x18f888 | out: lpRect=0x18f888) returned 1 [0057.457] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5026a, lpPoints=0x18f888, cPoints=0x2 | out: lpPoints=0x18f888) returned -11731102 [0057.457] MoveWindow (hWnd=0x5011e, X=144, Y=48, nWidth=41, nHeight=20, bRepaint=1) returned 1 [0057.457] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x46, wParam=0x0, lParam=0x18f824) returned 0x0 [0057.457] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x83, wParam=0x1, lParam=0x18f7fc) returned 0x0 [0057.458] GetParent (hWnd=0x5011e) returned 0x5026a [0057.458] GetWindowRect (in: hWnd=0x5011e, lpRect=0x18f5a4 | out: lpRect=0x18f5a4) returned 1 [0057.458] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5026a, lpPoints=0x18f5a4, cPoints=0x2 | out: lpPoints=0x18f5a4) returned -11731102 [0057.458] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x47, wParam=0x0, lParam=0x18f824) returned 0x0 [0057.458] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x5, wParam=0x0, lParam=0xe0012) returned 0x0 [0057.458] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x46, wParam=0x0, lParam=0x18ee9c) returned 0x0 [0057.459] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x83, wParam=0x1, lParam=0x18ee74) returned 0x0 [0057.459] GetParent (hWnd=0x5011e) returned 0x5026a [0057.459] GetWindowRect (in: hWnd=0x5011e, lpRect=0x18ec1c | out: lpRect=0x18ec1c) returned 1 [0057.459] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5026a, lpPoints=0x18ec1c, cPoints=0x2 | out: lpPoints=0x18ec1c) returned -11731102 [0057.459] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x47, wParam=0x0, lParam=0x18ee9c) returned 0x0 [0057.459] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x5, wParam=0x0, lParam=0xd0012) returned 0x0 [0057.461] GetParent (hWnd=0x5011e) returned 0x5026a [0057.461] GetWindowRect (in: hWnd=0x5011e, lpRect=0x18f888 | out: lpRect=0x18f888) returned 1 [0057.461] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5026a, lpPoints=0x18f888, cPoints=0x2 | out: lpPoints=0x18f888) returned -11731102 [0057.461] MonitorFromWindow (hwnd=0x60114, dwFlags=0x2) returned 0x10001 [0057.461] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0x18f83c | out: lpmi=0x18f83c) returned 1 [0057.461] GetWindowLongA (hWnd=0x60114, nIndex=-16) returned 1409351809 [0057.461] GetWindowLongA (hWnd=0x60114, nIndex=-20) returned 516 [0057.461] SelectObject (hdc=0x230101b3, h=0x180a09da) returned 0x18a002e [0057.461] GetTextMetricsA (in: hdc=0x230101b3, lptm=0x18f708 | out: lptm=0x18f708) returned 1 [0057.462] SelectObject (hdc=0x230101b3, h=0x18a002e) returned 0x180a09da [0057.462] GetParent (hWnd=0x60114) returned 0x5026a [0057.462] GetWindowRect (in: hWnd=0x60114, lpRect=0x18f83c | out: lpRect=0x18f83c) returned 1 [0057.462] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5026a, lpPoints=0x18f83c, cPoints=0x2 | out: lpPoints=0x18f83c) returned -11731102 [0057.462] MoveWindow (hWnd=0x60114, X=144, Y=72, nWidth=41, nHeight=17, bRepaint=1) returned 1 [0057.462] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x46, wParam=0x0, lParam=0x18f7d8) returned 0x0 [0057.462] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x83, wParam=0x1, lParam=0x18f7b0) returned 0x0 [0057.463] GetParent (hWnd=0x60114) returned 0x5026a [0057.463] GetWindowRect (in: hWnd=0x60114, lpRect=0x18f50c | out: lpRect=0x18f50c) returned 1 [0057.463] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5026a, lpPoints=0x18f50c, cPoints=0x2 | out: lpPoints=0x18f50c) returned -11731102 [0057.463] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x47, wParam=0x0, lParam=0x18f7d8) returned 0x0 [0057.463] GetWindowLongA (hWnd=0x60114, nIndex=-16) returned 1409351809 [0057.463] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x5, wParam=0x0, lParam=0xd0025) returned 0x0 [0057.464] GetParent (hWnd=0x60114) returned 0x5026a [0057.464] GetWindowRect (in: hWnd=0x60114, lpRect=0x18f83c | out: lpRect=0x18f83c) returned 1 [0057.464] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5026a, lpPoints=0x18f83c, cPoints=0x2 | out: lpPoints=0x18f83c) returned -11731102 [0057.465] IsIconic (hWnd=0x5026a) returned 0 [0057.466] IsZoomed (hWnd=0x5026a) returned 0 [0057.466] GetClientRect (in: hWnd=0x5026a, lpRect=0x18f8e4 | out: lpRect=0x18f8e4) returned 1 [0057.466] GetWindow (hWnd=0x5026a, uCmd=0x5) returned 0x6011c [0057.466] GetWindow (hWnd=0x6011c, uCmd=0x2) returned 0x60116 [0057.466] GetParent (hWnd=0x6011c) returned 0x5026a [0057.466] GetWindow (hWnd=0x60116, uCmd=0x2) returned 0x5011e [0057.466] GetParent (hWnd=0x60116) returned 0x5026a [0057.467] GetWindow (hWnd=0x5011e, uCmd=0x2) returned 0x7011a [0057.467] GetParent (hWnd=0x5011e) returned 0x5026a [0057.467] GetWindow (hWnd=0x7011a, uCmd=0x2) returned 0x60114 [0057.467] GetParent (hWnd=0x7011a) returned 0x5026a [0057.468] GetWindow (hWnd=0x60114, uCmd=0x2) returned 0x0 [0057.468] GetParent (hWnd=0x60114) returned 0x5026a [0057.468] IsWindowVisible (hWnd=0x5026a) returned 0 [0057.468] ShowWindow (hWnd=0x5026a, nCmdShow=0) returned 0 [0057.469] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0057.469] IMalloc:Alloc (This=0x767666bc, cb=0x4c) returned 0x35cf88 [0057.469] IMalloc:GetSize (This=0x767666bc, pv=0x35cf88) returned 0x4c [0057.470] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x34) returned 0x167c5d0 [0057.470] SetErrorMode (uMode=0x8001) returned 0x8001 [0057.470] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77710000 [0057.471] SetErrorMode (uMode=0x8001) returned 0x8001 [0057.471] GetProcAddress (hModule=0x77710000, lpProcName="CryptAcquireContextA") returned 0x777191dd [0057.471] CryptAcquireContextA (in: phProv=0x35cfbc, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x35cfbc*=0x2e3e30) returned 1 [0057.472] GetLastError () returned 0x0 [0057.473] GetVersionExW (in: lpVersionInformation=0x18ed38*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x18ed38*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0057.473] GetLastError () returned 0x0 [0057.473] SafeArrayAllocDescriptorEx (in: vt=0x0, cDims=0x1, ppsaOut=0x18f79c | out: ppsaOut=0x18f79c) returned 0x0 [0057.491] SafeArrayDestroyDescriptor (psa=0x354938) returned 0x0 [0057.492] MkParseDisplayName (in: pbc=0x2e4698, szUserName="winmgmts:\\\\.\\root\\cimv2", pchEaten=0x18ed08, ppmk=0x18ed10 | out: pchEaten=0x18ed08, ppmk=0x18ed10*=0x34b920) returned 0x0 [0059.106] malloc (_Size=0x80) returned 0x16c2750 [0059.107] DllGetClassObject (in: rclsid=0x342cac*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x18e930*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18dfe8 | out: ppv=0x18dfe8*=0x0) returned 0x80004002 [0059.107] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0810 [0059.107] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0059.107] DllGetClassObject (in: rclsid=0x342cac*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x7666ee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eae4 | out: ppv=0x18eae4*=0x4ae0810) returned 0x0 [0059.107] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0810 [0059.107] WinMGMTS:IClassFactory:CreateInstance (in: This=0x4ae0810, pUnkOuter=0x0, riid=0x7666f084*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea90 | out: ppvObject=0x18ea90*=0x4ae0850) returned 0x0 [0059.107] GetVersionExW (in: lpVersionInformation=0x18e8dc*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x7f, dwMinorVersion=0x36b7, dwBuildNumber=0x3, dwPlatformId=0x18e940, szCSDVersion="塩盔\x08쀕") | out: lpVersionInformation=0x18e8dc*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0059.107] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x18e8d0 | out: phkResult=0x18e8d0*=0x140) returned 0x0 [0059.108] RegQueryValueExW (in: hKey=0x140, lpValueName="Default Impersonation Level", lpReserved=0x0, lpType=0x0, lpData=0x18e8d8, lpcbData=0x18e8d4*=0x4 | out: lpType=0x0, lpData=0x18e8d8*=0x3, lpcbData=0x18e8d4*=0x4) returned 0x0 [0059.108] RegCloseKey (hKey=0x140) returned 0x0 [0059.108] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0828 [0059.108] GetSystemDirectoryW (in: lpBuffer=0x4ae0828, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0059.108] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\advapi32.dll", hFile=0x0, dwFlags=0x0) returned 0x77710000 [0059.109] GetProcAddress (hModule=0x77710000, lpProcName="DuplicateTokenEx") returned 0x7771ca24 [0059.109] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0059.109] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0828 [0059.109] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0850 [0059.109] WinMGMTS:IUnknown:Release (This=0x4ae0810) returned 0x0 [0059.109] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0059.110] WinMGMTS:IParseDisplayName:ParseDisplayName (in: This=0x4ae0850, pbc=0x2e4698, pszDisplayName="winmgmts:\\\\.\\root\\cimv2", pchEaten=0x18eca8, ppmkOut=0x18ecac | out: pchEaten=0x18eca8*=0x17, ppmkOut=0x18ecac*=0x34b920) returned 0x0 [0059.110] _wcsnicmp (_String1="winmgmts:", _String2="WINMGMTS:", _MaxCount=0x9) returned 0 [0059.110] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0860 [0059.110] _wcsnicmp (_String1="\\", _String2="{", _MaxCount=0x1) returned -31 [0059.110] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0880 [0059.110] CoCreateInstance (in: rclsid=0x753e42b0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x753e42a0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x4ae0898 | out: ppv=0x4ae0898*=0x4ae08e8) returned 0x0 [0059.325] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae08f8 [0059.325] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0960 [0059.325] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae09c0 [0059.325] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0059.325] GetCurrentThreadId () returned 0xa94 [0059.325] _wcsnicmp (_String1="\\", _String2="[", _MaxCount=0x1) returned 1 [0059.326] _wcsnicmp (_String1="\\", _String2="!", _MaxCount=0x1) returned 59 [0059.326] CoCreateInstance (in: rclsid=0x753e53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x753e50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x18eb70 | out: ppv=0x18eb70*=0x4ae09e0) returned 0x0 [0059.527] CoCreateInstance (in: rclsid=0x753e53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x753e50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x18eae8 | out: ppv=0x18eae8*=0x4ae0a78) returned 0x0 [0059.527] WbemDefPath:IWbemPath:SetText (This=0x4ae0a78, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0059.528] WbemDefPath:IUnknown:Release (This=0x4ae0a78) returned 0x0 [0059.528] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0059.528] WbemDefPath:IWbemPath:SetText (This=0x4ae09e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0059.528] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4ae09e0, puCount=0x18eb38 | out: puCount=0x18eb38*=0x2) returned 0x0 [0059.528] WbemDefPath:IWbemPath:GetText (in: This=0x4ae09e0, lFlags=16, puBuffLength=0x18eb20*=0x0, pszText=0x0 | out: puBuffLength=0x18eb20*=0xb, pszText=0x0) returned 0x0 [0059.529] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0aa0 [0059.529] WbemDefPath:IWbemPath:GetText (in: This=0x4ae09e0, lFlags=16, puBuffLength=0x18eb20*=0xb, pszText="୸ҮÄҮ" | out: puBuffLength=0x18eb20*=0xb, pszText="root\\cimv2") returned 0x0 [0059.529] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0059.529] WbemDefPath:IWbemPath:GetInfo (in: This=0x4ae09e0, uRequestedInfo=0x0, puResponse=0x18eb10 | out: puResponse=0x18eb10*=0x24e01) returned 0x0 [0059.529] WbemDefPath:IWbemPath:GetInfo (in: This=0x4ae09e0, uRequestedInfo=0x0, puResponse=0x18eb10 | out: puResponse=0x18eb10*=0x24e01) returned 0x0 [0059.529] WbemDefPath:IWbemPath:GetServer (in: This=0x4ae09e0, puNameBufLength=0x18eb4c*=0x0, pName=0x0 | out: puNameBufLength=0x18eb4c*=0x2, pName=0x0) returned 0x0 [0059.529] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0aa0 [0059.529] WbemDefPath:IWbemPath:GetServer (in: This=0x4ae09e0, puNameBufLength=0x18eb4c*=0x2, pName="୸Ү" | out: puNameBufLength=0x18eb4c*=0x2, pName=".") returned 0x0 [0059.529] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0059.529] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0059.530] GetCurrentThreadId () returned 0xa94 [0059.530] CoCreateInstance (in: rclsid=0x753e53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x753e50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x18eacc | out: ppv=0x18eacc*=0x4aebc28) returned 0x0 [0059.530] SysStringLen (param_1=".") returned 0x1 [0059.530] WbemDefPath:IWbemPath:SetServer (This=0x4aebc28, Name=".") returned 0x0 [0059.530] CoCreateInstance (in: rclsid=0x753e53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x753e50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x18ea84 | out: ppv=0x18ea84*=0x4aebc98) returned 0x0 [0059.530] CoCreateInstance (in: rclsid=0x753e53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x753e50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x18ea28 | out: ppv=0x18ea28*=0x4aebd30) returned 0x0 [0059.530] WbemDefPath:IWbemPath:SetText (This=0x4aebd30, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0059.531] WbemDefPath:IUnknown:Release (This=0x4aebd30) returned 0x0 [0059.531] SysStringLen (param_1="root\\cimv2") returned 0xa [0059.531] WbemDefPath:IWbemPath:SetText (This=0x4aebc98, uMode=0xc, pszPath="root\\cimv2") returned 0x0 [0059.531] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4aebc98, puCount=0x18ea94 | out: puCount=0x18ea94*=0x2) returned 0x0 [0059.531] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x4aebc28) returned 0x0 [0059.531] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4aebc98, uIndex=0x0, puNameBufLength=0x18ea5c*=0x0, pName=0x0 | out: puNameBufLength=0x18ea5c*=0x5, pName=0x0) returned 0x0 [0059.531] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeb4e8 [0059.531] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4aebc98, uIndex=0x0, puNameBufLength=0x18ea5c*=0x5, pName="\x1a" | out: puNameBufLength=0x18ea5c*=0x5, pName="root") returned 0x0 [0059.531] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0059.531] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4aebc28, uIndex=0x0, pszName="root") returned 0x0 [0059.531] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4aebc98, uIndex=0x1, puNameBufLength=0x18ea5c*=0x0, pName=0x0 | out: puNameBufLength=0x18ea5c*=0x6, pName=0x0) returned 0x0 [0059.531] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeb518 [0059.531] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4aebc98, uIndex=0x1, puNameBufLength=0x18ea5c*=0x6, pName=" " | out: puNameBufLength=0x18ea5c*=0x6, pName="cimv2") returned 0x0 [0059.531] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0059.531] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4aebc28, uIndex=0x1, pszName="cimv2") returned 0x0 [0059.531] WbemDefPath:IUnknown:Release (This=0x4aebc98) returned 0x0 [0059.531] WbemDefPath:IWbemPath:GetText (in: This=0x4aebc28, lFlags=4, puBuffLength=0x18eab0*=0x0, pszText=0x0 | out: puBuffLength=0x18eab0*=0xf, pszText=0x0) returned 0x0 [0059.531] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aebc98 [0059.532] WbemDefPath:IWbemPath:GetText (in: This=0x4aebc28, lFlags=4, puBuffLength=0x18eab0*=0xf, pszText="뺐Ү஠Ү2" | out: puBuffLength=0x18eab0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0059.532] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0059.532] WbemDefPath:IUnknown:Release (This=0x4aebc28) returned 0x0 [0059.532] WbemLocator:IWbemLocator:ConnectServer (in: This=0x4ae08e8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x18eb38 | out: ppNamespace=0x18eb38*=0x4aed684) returned 0x0 [0059.739] GetCurrentThreadId () returned 0xa94 [0059.739] GetCurrentThreadId () returned 0xa94 [0059.739] GetCurrentThreadId () returned 0xa94 [0059.739] PeekMessageA (in: lpMsg=0x18d608, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d608) returned 0 [0059.740] PeekMessageA (in: lpMsg=0x18d608, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d608) returned 0 [0059.740] PeekMessageA (in: lpMsg=0x18d608, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d608) returned 0 [0059.852] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0059.852] GetCurrentThreadId () returned 0xa94 [0059.852] GetCurrentThreadId () returned 0xa94 [0059.852] GetCurrentThreadId () returned 0xa94 [0059.853] PeekMessageA (in: lpMsg=0x18e018, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e018) returned 0 [0059.853] PeekMessageA (in: lpMsg=0x18e018, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e018) returned 0 [0059.853] PeekMessageA (in: lpMsg=0x18e018, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e018) returned 0 [0066.699] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0066.699] GetCurrentThreadId () returned 0xa94 [0066.700] GetCurrentThreadId () returned 0xa94 [0066.700] GetCurrentThreadId () returned 0xa94 [0066.700] PeekMessageA (in: lpMsg=0x18e174, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e174) returned 0 [0066.700] PeekMessageA (in: lpMsg=0x18e174, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e174) returned 0 [0066.701] PeekMessageA (in: lpMsg=0x18e174, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e174) returned 0 [0068.253] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0068.253] GetCurrentThreadId () returned 0xa94 [0068.253] GetCurrentThreadId () returned 0xa94 [0068.254] GetCurrentThreadId () returned 0xa94 [0068.254] PeekMessageA (in: lpMsg=0x18e1e4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e1e4) returned 0 [0068.254] PeekMessageA (in: lpMsg=0x18e1e4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e1e4) returned 0 [0068.254] PeekMessageA (in: lpMsg=0x18e1e4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e1e4) returned 0 [0068.256] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0068.256] GetCurrentThreadId () returned 0xa94 [0068.257] GetCurrentThreadId () returned 0xa94 [0068.257] GetCurrentThreadId () returned 0xa94 [0068.257] PeekMessageA (in: lpMsg=0x18e1dc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e1dc) returned 0 [0068.257] PeekMessageA (in: lpMsg=0x18e1dc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e1dc) returned 0 [0068.257] PeekMessageA (in: lpMsg=0x18e1dc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e1dc) returned 0 [0068.401] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aecdc0 [0068.401] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aed698 [0068.401] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aed6f8 [0068.401] WbemLocator:IUnknown:QueryInterface (in: This=0x4aed684, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea08 | out: ppvObject=0x18ea08*=0x2f837c) returned 0x0 [0068.401] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x2f837c, pProxy=0x4aed684, pAuthnSvc=0x18e9f8, pAuthzSvc=0x18e9fc, pServerPrincName=0x0, pAuthnLevel=0x18ea24, pImpLevel=0x18ea20, pAuthInfo=0x0, pCapabilites=0x18ea10 | out: pAuthnSvc=0x18e9f8*=0xa, pAuthzSvc=0x18e9fc*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ea24*=0x6, pImpLevel=0x18ea20*=0x2, pAuthInfo=0x0, pCapabilites=0x18ea10*=0x1) returned 0x0 [0068.401] WbemLocator:IUnknown:Release (This=0x2f837c) returned 0x1 [0068.401] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0068.402] GetCurrentThreadId () returned 0xa94 [0068.436] WbemLocator:IUnknown:QueryInterface (in: This=0x4aed684, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea38 | out: ppvObject=0x18ea38*=0x2f837c) returned 0x0 [0068.436] WbemLocator:IClientSecurity:CopyProxy (in: This=0x2f837c, pProxy=0x4aed684, ppCopy=0x18ea3c | out: ppCopy=0x18ea3c*=0x4aed7f4) returned 0x0 [0068.436] WbemLocator:IUnknown:QueryInterface (in: This=0x4aed7f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e954 | out: ppvObject=0x18e954*=0x2f837c) returned 0x0 [0068.437] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x2f837c, pProxy=0x4aed7f4, pAuthnSvc=0x18e978, pAuthzSvc=0x18e968, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x18e978*=0xa, pAuthzSvc=0x18e968*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0068.437] WbemLocator:IUnknown:Release (This=0x2f837c) returned 0x3 [0068.437] WbemLocator:IUnknown:QueryInterface (in: This=0x4aed7f4, riid=0x753e34f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e92c | out: ppvObject=0x18e92c*=0x2f839c) returned 0x0 [0068.437] WbemLocator:IUnknown:QueryInterface (in: This=0x4aed7f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e930 | out: ppvObject=0x18e930*=0x2f837c) returned 0x0 [0068.437] WbemLocator:IClientSecurity:SetBlanket (This=0x2f837c, pProxy=0x4aed7f4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0068.438] WbemLocator:IUnknown:Release (This=0x2f837c) returned 0x4 [0068.438] WbemLocator:IUnknown:Release (This=0x2f839c) returned 0x3 [0068.438] WbemLocator:IUnknown:Release (This=0x2f837c) returned 0x2 [0068.438] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0068.438] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aed808 [0068.438] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece78 [0068.439] WbemLocator:IUnknown:Release (This=0x4aed684) returned 0x2 [0068.439] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0068.439] GetCurrentThreadId () returned 0xa94 [0068.440] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0068.440] GetCurrentThreadId () returned 0xa94 [0068.440] WbemLocator:IUnknown:QueryInterface (in: This=0x4aed7f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18eafc | out: ppvObject=0x18eafc*=0x2f837c) returned 0x0 [0068.440] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x2f837c, pProxy=0x4aed7f4, pAuthnSvc=0x18eaec, pAuthzSvc=0x18eaf0, pServerPrincName=0x0, pAuthnLevel=0x18eb1c, pImpLevel=0x18eb20, pAuthInfo=0x0, pCapabilites=0x18eb04 | out: pAuthnSvc=0x18eaec*=0xa, pAuthzSvc=0x18eaf0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18eb1c*=0x6, pImpLevel=0x18eb20*=0x3, pAuthInfo=0x0, pCapabilites=0x18eb04*=0x20) returned 0x0 [0068.441] WbemLocator:IUnknown:Release (This=0x2f837c) returned 0x2 [0068.441] WbemDefPath:IWbemPath:GetInfo (in: This=0x4ae09e0, uRequestedInfo=0x0, puResponse=0x18eb44 | out: puResponse=0x18eb44*=0x24e01) returned 0x0 [0068.441] WbemDefPath:IWbemPath:GetInfo (in: This=0x4ae09e0, uRequestedInfo=0x0, puResponse=0x18eb44 | out: puResponse=0x18eb44*=0x24e01) returned 0x0 [0068.441] CreatePointerMoniker (in: punk=0x4aecdc0, ppmk=0x18ecac | out: ppmk=0x18ecac*=0x34b920) returned 0x0 [0068.441] IUnknown:AddRef (This=0x4aecdc0) returned 0x2 [0068.442] WbemDefPath:IUnknown:Release (This=0x4ae09e0) returned 0x0 [0068.443] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0068.443] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0068.443] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0068.443] WbemLocator:IUnknown:Release (This=0x4ae08e8) returned 0x0 [0068.443] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0068.443] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0068.444] WinMGMTS:IUnknown:Release (This=0x4ae0850) returned 0x0 [0068.444] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0068.444] IUnknown:Release (This=0x2e4698) returned 0x0 [0068.445] BindMoniker (in: pmk=0x34b920, grfOpt=0x0, iidResult=0x7295a460*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvResult=0x18ed24 | out: ppvResult=0x18ed24*=0x4aecdc0) returned 0x0 [0068.445] IUnknown:QueryInterface (in: This=0x4aecdc0, riid=0x7295a460*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ed24 | out: ppvObject=0x18ed24*=0x4aecdc0) returned 0x0 [0068.445] IUnknown:Release (This=0x34b920) returned 0x0 [0068.445] IUnknown:Release (This=0x4aecdc0) returned 0x1 [0068.450] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec9c*=0x0 | out: pptlib=0x18ec9c*=0x2f9d40) returned 0x0 [0068.610] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x4aecdf4*(Data1=0xd2f68443, Data2=0x85dc, Data3=0x427e, Data4=([0]=0x91, [1]=0xd8, [2]=0x36, [3]=0x65, [4]=0x54, [5]=0xcc, [6]=0x75, [7]=0x4c)), ppTInfo=0x4aecde8 | out: ppTInfo=0x4aecde8*=0x2fb894) returned 0x0 [0068.610] IUnknown:Release (This=0x2f9d40) returned 0x1 [0068.610] IUnknown:AddRef (This=0x2fb894) returned 0x2 [0068.611] DispGetIDsOfNames (in: ptinfo=0x2fb894, rgszNames=0x18ecf8*="ExecQuery", cNames=0x1, rgdispid=0x18ecfc | out: rgdispid=0x18ecfc*=9) returned 0x0 [0068.613] IUnknown:Release (This=0x2fb894) returned 0x1 [0068.613] IUnknown:AddRef (This=0x2fb894) returned 0x2 [0068.613] ITypeInfo:LocalInvoke (This=0x2fb894) returned 0x0 [0068.613] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0068.614] GetCurrentThreadId () returned 0xa94 [0068.614] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0068.614] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0068.614] GetCurrentThreadId () returned 0xa94 [0068.614] IWbemServices:ExecQuery (in: This=0x4aed7f4, strQueryLanguage="WQL", strQuery="Select * from Win32_Process", lFlags=272, pCtx=0x0, ppEnum=0x18ea6c | out: ppEnum=0x18ea6c*=0x4ae08dc) returned 0x0 [0068.615] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0068.615] GetCurrentThreadId () returned 0xa94 [0068.615] GetCurrentThreadId () returned 0xa94 [0068.615] GetCurrentThreadId () returned 0xa94 [0068.615] PeekMessageA (in: lpMsg=0x18e26c, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e26c) returned 0 [0068.615] PeekMessageA (in: lpMsg=0x18e26c, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e26c) returned 0 [0068.615] PeekMessageA (in: lpMsg=0x18e26c, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e26c) returned 0 [0068.623] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0918 [0068.623] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0978 [0068.623] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae09d8 [0068.623] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece58 [0068.624] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0a38 [0068.624] IUnknown:QueryInterface (in: This=0x4ae08dc, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e984 | out: ppvObject=0x18e984*=0x4ae08e0) returned 0x0 [0068.624] IClientSecurity:QueryBlanket (in: This=0x4ae08e0, pProxy=0x4ae08dc, pAuthnSvc=0x18e974, pAuthzSvc=0x18e978, pServerPrincName=0x0, pAuthnLevel=0x18e9a0, pImpLevel=0x18e99c, pAuthInfo=0x0, pCapabilites=0x18e98c | out: pAuthnSvc=0x18e974*=0xa, pAuthzSvc=0x18e978*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18e9a0*=0x6, pImpLevel=0x18e99c*=0x2, pAuthInfo=0x0, pCapabilites=0x18e98c*=0x1) returned 0x0 [0068.624] IUnknown:Release (This=0x4ae08e0) returned 0x1 [0068.625] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0068.625] GetCurrentThreadId () returned 0xa94 [0068.625] WbemLocator:IUnknown:QueryInterface (in: This=0x4aed7f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e968 | out: ppvObject=0x18e968*=0x2f837c) returned 0x0 [0068.625] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x2f837c, pProxy=0x4aed7f4, pAuthnSvc=0x18e958, pAuthzSvc=0x18e95c, pServerPrincName=0x0, pAuthnLevel=0x18e988, pImpLevel=0x18e98c, pAuthInfo=0x0, pCapabilites=0x18e970 | out: pAuthnSvc=0x18e958*=0xa, pAuthzSvc=0x18e95c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18e988*=0x6, pImpLevel=0x18e98c*=0x3, pAuthInfo=0x0, pCapabilites=0x18e970*=0x20) returned 0x0 [0068.625] WbemLocator:IUnknown:Release (This=0x2f837c) returned 0x3 [0068.625] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0068.625] GetCurrentThreadId () returned 0xa94 [0068.626] WbemLocator:IUnknown:QueryInterface (in: This=0x4aed7f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e968 | out: ppvObject=0x18e968*=0x2f837c) returned 0x0 [0068.626] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x2f837c, pProxy=0x4aed7f4, pAuthnSvc=0x18e958, pAuthzSvc=0x18e95c, pServerPrincName=0x0, pAuthnLevel=0x18e98c, pImpLevel=0x18e988, pAuthInfo=0x0, pCapabilites=0x18e970 | out: pAuthnSvc=0x18e958*=0xa, pAuthzSvc=0x18e95c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18e98c*=0x6, pImpLevel=0x18e988*=0x3, pAuthInfo=0x0, pCapabilites=0x18e970*=0x20) returned 0x0 [0068.626] WbemLocator:IUnknown:Release (This=0x2f837c) returned 0x3 [0068.626] IUnknown:QueryInterface (in: This=0x4ae08dc, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9b4 | out: ppvObject=0x18e9b4*=0x4ae08e0) returned 0x0 [0068.626] IClientSecurity:CopyProxy (in: This=0x4ae08e0, pProxy=0x4ae08dc, ppCopy=0x18e9b8 | out: ppCopy=0x18e9b8*=0x4aed8f4) returned 0x0 [0068.626] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e8d0 | out: ppvObject=0x18e8d0*=0x4aed8f8) returned 0x0 [0068.627] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18e8f4, pAuthzSvc=0x18e8e4, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x18e8f4*=0xa, pAuthzSvc=0x18e8e4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0068.627] IUnknown:Release (This=0x4aed8f8) returned 0x3 [0068.627] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e34f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e8a8 | out: ppvObject=0x18e8a8*=0x2f5774) returned 0x0 [0068.627] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e8ac | out: ppvObject=0x18e8ac*=0x4aed8f8) returned 0x0 [0068.627] IClientSecurity:SetBlanket (This=0x4aed8f8, pProxy=0x4aed8f4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0068.627] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0068.628] GetCurrentThreadId () returned 0xa94 [0068.628] GetCurrentThreadId () returned 0xa94 [0068.628] GetCurrentThreadId () returned 0xa94 [0068.628] PeekMessageA (in: lpMsg=0x18df18, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18df18) returned 0 [0068.628] PeekMessageA (in: lpMsg=0x18df18, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18df18) returned 0 [0068.628] PeekMessageA (in: lpMsg=0x18df18, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18df18) returned 0 [0068.631] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0068.631] GetCurrentThreadId () returned 0xa94 [0068.631] GetCurrentThreadId () returned 0xa94 [0068.631] GetCurrentThreadId () returned 0xa94 [0068.631] PeekMessageA (in: lpMsg=0x18e064, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e064) returned 0 [0068.631] PeekMessageA (in: lpMsg=0x18e064, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e064) returned 0 [0068.632] PeekMessageA (in: lpMsg=0x18e064, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e064) returned 0 [0068.634] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0068.635] WbemLocator:IUnknown:Release (This=0x2f5774) returned 0x3 [0068.635] IUnknown:Release (This=0x4ae08e0) returned 0x2 [0068.635] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0068.635] IUnknown:Release (This=0x4ae08dc) returned 0x2 [0068.635] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ea24 | out: pperrinfo=0x18ea24*=0x0) returned 0x1 [0068.635] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0068.635] IUnknown:Release (This=0x2fb894) returned 0x1 [0068.636] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ebd4*=0x0 | out: pptlib=0x18ebd4*=0x2f9d40) returned 0x0 [0068.637] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x4ae0940*(Data1=0x76a6415f, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x4ae0934 | out: ppTInfo=0x4ae0934*=0x2fb944) returned 0x0 [0068.637] IUnknown:Release (This=0x2f9d40) returned 0x2 [0068.637] IUnknown:AddRef (This=0x2fb944) returned 0x2 [0068.637] ITypeInfo:LocalInvoke (This=0x2fb944) returned 0x0 [0068.637] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0068.638] GetCurrentThreadId () returned 0xa94 [0068.638] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeb458 [0068.638] IUnknown:Release (This=0x2fb944) returned 0x1 [0068.638] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0068.638] GetCurrentThreadId () returned 0xa94 [0068.638] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0068.638] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0068.638] GetCurrentThreadId () returned 0xa94 [0068.638] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec64, puReturned=0x18ec5c | out: apObjects=0x18ec64*=0x4aed930, puReturned=0x18ec5c*=0x1) returned 0x0 [0068.638] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0068.638] GetCurrentThreadId () returned 0xa94 [0068.638] GetCurrentThreadId () returned 0xa94 [0068.639] GetCurrentThreadId () returned 0xa94 [0068.639] PeekMessageA (in: lpMsg=0x18e454, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e454) returned 0 [0068.639] PeekMessageA (in: lpMsg=0x18e454, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e454) returned 0 [0068.639] PeekMessageA (in: lpMsg=0x18e454, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e454) returned 0 [0069.885] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0069.885] IUnknown:AddRef (This=0x4aed930) returned 0x2 [0069.885] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af22a0 [0069.885] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2310 [0069.885] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2370 [0069.885] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0069.885] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0069.885] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0069.885] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebc4 | out: ppvObject=0x18ebc4*=0x4aed8f8) returned 0x0 [0069.886] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebb4, pAuthzSvc=0x18ebb8, pServerPrincName=0x0, pAuthnLevel=0x18ebd4, pImpLevel=0x18ebe0, pAuthInfo=0x0, pCapabilites=0x18ebcc | out: pAuthnSvc=0x18ebb4*=0xa, pAuthzSvc=0x18ebb8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebd4*=0x6, pImpLevel=0x18ebe0*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebcc*=0x20) returned 0x0 [0069.886] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0069.886] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0069.886] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0069.886] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0069.886] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0069.886] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0069.886] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0069.886] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0069.886] IUnknown:AddRef (This=0x4aed930) returned 0x3 [0069.886] IUnknown:Release (This=0x4aed930) returned 0x2 [0069.886] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec18 | out: pperrinfo=0x18ec18*=0x0) returned 0x1 [0069.886] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0069.887] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec5c | out: pperrinfo=0x18ec5c*=0x0) returned 0x1 [0069.887] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0069.888] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0069.888] IUnknown:Release (This=0x2f9d40) returned 0x3 [0069.888] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0069.888] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0069.930] IUnknown:AddRef (This=0x4aed930) returned 0x3 [0069.930] IWbemClassObject:Get (in: This=0x4aed930, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=32) returned 0x0 [0069.930] IUnknown:Release (This=0x4aed930) returned 0x2 [0069.930] SysStringLen (param_1="ExecutablePath") returned 0xe [0069.930] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0069.930] SysStringLen (param_1="ExecutablePath") returned 0xe [0069.931] IUnknown:Release (This=0x2fb99c) returned 0x1 [0069.931] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0069.931] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0069.931] GetCurrentThreadId () returned 0xa94 [0069.931] SysStringLen (param_1="ExecutablePath") returned 0xe [0069.932] IWbemClassObject:Get (in: This=0x4aed930, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0069.932] IUnknown:Release (This=0x2fb99c) returned 0x1 [0069.932] IUnknown:Release (This=0x4aed930) returned 0x1 [0069.932] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0069.932] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.934] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.934] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.934] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.934] IUnknown:Release (This=0x4aed930) returned 0x0 [0069.934] IUnknown:Release (This=0x2fb99c) returned 0x0 [0069.934] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.934] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.934] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.934] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.934] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.935] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0069.935] GetCurrentThreadId () returned 0xa94 [0069.935] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0069.935] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0069.935] GetCurrentThreadId () returned 0xa94 [0069.935] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0069.935] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0069.935] GetCurrentThreadId () returned 0xa94 [0069.936] GetCurrentThreadId () returned 0xa94 [0069.936] GetCurrentThreadId () returned 0xa94 [0069.936] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0069.936] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0069.936] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0069.969] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0069.969] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0069.969] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2460 [0069.969] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24d0 [0069.969] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2530 [0069.969] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0069.969] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0069.969] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0069.969] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0069.970] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0069.970] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0069.970] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0069.970] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0069.970] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0069.970] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0069.970] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0069.970] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0069.970] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0069.970] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0069.970] IUnknown:Release (This=0x4af2010) returned 0x2 [0069.970] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0069.970] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0069.970] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0069.971] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0069.972] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0069.972] IUnknown:Release (This=0x2f9d40) returned 0x3 [0069.972] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0069.972] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0069.972] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0069.972] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=32) returned 0x0 [0069.972] IUnknown:Release (This=0x4af2010) returned 0x2 [0069.972] SysStringLen (param_1="ExecutablePath") returned 0xe [0069.972] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0069.972] SysStringLen (param_1="ExecutablePath") returned 0xe [0069.972] IUnknown:Release (This=0x2fb99c) returned 0x1 [0069.972] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0069.973] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0069.973] GetCurrentThreadId () returned 0xa94 [0069.973] SysStringLen (param_1="ExecutablePath") returned 0xe [0069.973] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0069.973] IUnknown:Release (This=0x2fb99c) returned 0x1 [0069.973] IUnknown:Release (This=0x4af2010) returned 0x1 [0069.973] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0069.973] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.973] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.973] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.973] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.973] IUnknown:Release (This=0x4af2010) returned 0x0 [0069.973] IUnknown:Release (This=0x2fb99c) returned 0x0 [0069.973] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.973] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.974] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.974] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.974] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.974] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0069.974] GetCurrentThreadId () returned 0xa94 [0069.974] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0069.974] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0069.974] GetCurrentThreadId () returned 0xa94 [0069.974] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0069.974] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0069.974] GetCurrentThreadId () returned 0xa94 [0069.974] GetCurrentThreadId () returned 0xa94 [0069.974] GetCurrentThreadId () returned 0xa94 [0069.974] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0069.974] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0069.974] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0069.982] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0069.982] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0069.982] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0069.982] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0069.982] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0069.982] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0069.983] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0069.983] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0069.983] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0069.983] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0069.983] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0069.983] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0069.983] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0069.983] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0069.983] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0069.983] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0069.983] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0069.983] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0069.983] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0069.983] IUnknown:Release (This=0x4af2010) returned 0x2 [0069.983] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0069.983] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0069.984] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0069.984] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0069.985] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0069.985] IUnknown:Release (This=0x2f9d40) returned 0x3 [0069.985] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0069.985] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0069.985] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0069.985] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=32) returned 0x0 [0069.985] IUnknown:Release (This=0x4af2010) returned 0x2 [0069.985] SysStringLen (param_1="ExecutablePath") returned 0xe [0069.985] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0069.985] SysStringLen (param_1="ExecutablePath") returned 0xe [0069.985] IUnknown:Release (This=0x2fb99c) returned 0x1 [0069.986] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0069.986] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0069.986] GetCurrentThreadId () returned 0xa94 [0069.986] SysStringLen (param_1="ExecutablePath") returned 0xe [0069.986] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0069.986] IUnknown:Release (This=0x2fb99c) returned 0x1 [0069.986] IUnknown:Release (This=0x4af2010) returned 0x1 [0069.986] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0069.986] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.986] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.986] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.986] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.987] IUnknown:Release (This=0x4af2010) returned 0x0 [0069.987] IUnknown:Release (This=0x2fb99c) returned 0x0 [0069.987] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.987] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.987] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.987] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.987] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.987] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0069.987] GetCurrentThreadId () returned 0xa94 [0069.987] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0069.987] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0069.987] GetCurrentThreadId () returned 0xa94 [0069.987] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0069.987] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0069.987] GetCurrentThreadId () returned 0xa94 [0069.987] GetCurrentThreadId () returned 0xa94 [0069.987] GetCurrentThreadId () returned 0xa94 [0069.988] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0069.988] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0069.988] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0069.991] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0069.991] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0069.991] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2698 [0069.991] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2708 [0069.991] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2768 [0069.992] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0069.992] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0069.992] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0069.992] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0069.992] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0069.992] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0069.992] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0069.992] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0069.992] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0069.992] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0069.993] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0069.993] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0069.993] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0069.993] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0069.993] IUnknown:Release (This=0x4af2010) returned 0x2 [0069.993] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0069.993] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0069.993] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0069.993] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0069.994] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0069.995] IUnknown:Release (This=0x2f9d40) returned 0x3 [0069.995] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0069.995] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0069.995] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0069.995] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0069.995] IUnknown:Release (This=0x4af2010) returned 0x2 [0069.995] SysStringLen (param_1="ExecutablePath") returned 0xe [0069.995] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0069.995] SysStringLen (param_1="ExecutablePath") returned 0xe [0069.995] IUnknown:Release (This=0x2fb99c) returned 0x1 [0069.995] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0069.995] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0069.995] GetCurrentThreadId () returned 0xa94 [0069.996] SysStringLen (param_1="ExecutablePath") returned 0xe [0069.996] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\csrss.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0069.996] IUnknown:Release (This=0x2fb99c) returned 0x1 [0069.996] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0069.996] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0069.996] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0069.996] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0069.996] IUnknown:Release (This=0x2fb99c) returned 0x1 [0069.996] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0069.996] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0069.996] GetCurrentThreadId () returned 0xa94 [0069.996] SysStringLen (param_1="ExecutablePath") returned 0xe [0069.997] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\csrss.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0069.997] IUnknown:Release (This=0x2fb99c) returned 0x1 [0069.997] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\csrss.exe", cchLength=0x1e | out: lpsz="c:\\windows\\system32\\csrss.exe") returned 0x1e [0069.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0069.997] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0069.997] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0069.997] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0069.997] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfb24, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0069.998] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0069.998] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0069.998] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0069.998] IUnknown:Release (This=0x4af2010) returned 0x1 [0069.999] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0069.999] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.999] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.999] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.999] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.999] IUnknown:Release (This=0x4af2010) returned 0x0 [0069.999] IUnknown:Release (This=0x2fb99c) returned 0x0 [0069.999] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.999] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.999] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.999] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.999] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0069.999] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0069.999] GetCurrentThreadId () returned 0xa94 [0070.000] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.000] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.000] GetCurrentThreadId () returned 0xa94 [0070.000] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.000] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.000] GetCurrentThreadId () returned 0xa94 [0070.000] GetCurrentThreadId () returned 0xa94 [0070.000] GetCurrentThreadId () returned 0xa94 [0070.001] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.001] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.001] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.002] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.002] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.002] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0070.002] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0070.002] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0070.002] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.003] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.003] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.003] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.003] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.003] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.003] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.003] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.003] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.003] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.003] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.003] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.003] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.003] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.003] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.004] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.004] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.004] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.004] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.006] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.006] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.006] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.006] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.006] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.006] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.006] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.006] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.006] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.006] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.006] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.007] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.007] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.007] GetCurrentThreadId () returned 0xa94 [0070.007] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.007] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wininit.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.007] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.008] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.008] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.008] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.008] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.008] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.008] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.008] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.008] GetCurrentThreadId () returned 0xa94 [0070.008] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.008] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wininit.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.009] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.009] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\wininit.exe", cchLength=0x20 | out: lpsz="c:\\windows\\system32\\wininit.exe") returned 0x20 [0070.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.009] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.009] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.009] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.009] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfb24, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.009] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.009] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.009] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.010] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.010] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.010] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.010] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.010] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.010] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.010] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.010] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.010] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.010] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.010] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.011] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.011] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.011] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.011] GetCurrentThreadId () returned 0xa94 [0070.011] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.011] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.011] GetCurrentThreadId () returned 0xa94 [0070.011] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.011] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.011] GetCurrentThreadId () returned 0xa94 [0070.011] GetCurrentThreadId () returned 0xa94 [0070.011] GetCurrentThreadId () returned 0xa94 [0070.012] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.012] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.012] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.015] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.015] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.015] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2698 [0070.015] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2708 [0070.015] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2768 [0070.015] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.015] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.015] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.015] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.016] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.016] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.016] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.016] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.016] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.016] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.016] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.016] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.016] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.016] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.016] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.016] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.016] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.016] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.017] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.018] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.018] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.018] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.018] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.018] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.018] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.018] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.018] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.018] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.018] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.018] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.018] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.018] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.018] GetCurrentThreadId () returned 0xa94 [0070.019] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.019] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\csrss.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.019] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.019] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.019] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.019] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.019] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.019] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.019] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.019] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.019] GetCurrentThreadId () returned 0xa94 [0070.019] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.019] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\csrss.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.020] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.020] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\csrss.exe", cchLength=0x1e | out: lpsz="c:\\windows\\system32\\csrss.exe") returned 0x1e [0070.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.020] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.020] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.020] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.020] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfb24, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.020] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.020] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.020] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.020] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.020] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.021] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.021] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.021] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.021] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.021] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.021] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.021] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.021] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.021] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.021] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.021] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.021] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.021] GetCurrentThreadId () returned 0xa94 [0070.021] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.021] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.021] GetCurrentThreadId () returned 0xa94 [0070.021] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.021] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.021] GetCurrentThreadId () returned 0xa94 [0070.022] GetCurrentThreadId () returned 0xa94 [0070.022] GetCurrentThreadId () returned 0xa94 [0070.022] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.022] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.022] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.023] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.023] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.023] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0070.023] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0070.023] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0070.023] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.023] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.023] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.023] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.024] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.024] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.024] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.024] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.024] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.024] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.024] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.024] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.024] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.024] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.024] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.024] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.024] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.024] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.024] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.026] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.026] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.026] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.026] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.026] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.026] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.026] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.026] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.026] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.026] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.026] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.026] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.026] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.026] GetCurrentThreadId () returned 0xa94 [0070.026] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.027] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\winlogon.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.027] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.027] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.027] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.027] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.027] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.027] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.027] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.027] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.027] GetCurrentThreadId () returned 0xa94 [0070.027] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.027] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\winlogon.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.028] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.028] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\winlogon.exe", cchLength=0x21 | out: lpsz="c:\\windows\\system32\\winlogon.exe") returned 0x21 [0070.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.028] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.028] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.028] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.028] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfe6c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.028] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.028] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.028] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.029] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.029] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.029] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.029] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.029] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.029] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.029] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.029] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.029] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.029] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.029] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.029] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.029] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.030] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.030] GetCurrentThreadId () returned 0xa94 [0070.030] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.030] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.030] GetCurrentThreadId () returned 0xa94 [0070.030] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.030] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.030] GetCurrentThreadId () returned 0xa94 [0070.030] GetCurrentThreadId () returned 0xa94 [0070.031] GetCurrentThreadId () returned 0xa94 [0070.031] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.031] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.031] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.033] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.033] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.033] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0070.033] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0070.033] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0070.033] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.034] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.034] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.034] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.034] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.034] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.034] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.034] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.035] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.035] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.035] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.035] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.035] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.035] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.035] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.036] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.036] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.036] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.036] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.038] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.038] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.038] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.038] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.039] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.039] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.039] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.039] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.039] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.039] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.039] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.040] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.040] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.040] GetCurrentThreadId () returned 0xa94 [0070.040] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.040] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\services.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.041] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.041] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.041] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.042] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.042] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.042] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.042] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.042] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.042] GetCurrentThreadId () returned 0xa94 [0070.043] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.043] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\services.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.043] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.043] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\services.exe", cchLength=0x21 | out: lpsz="c:\\windows\\system32\\services.exe") returned 0x21 [0070.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.044] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.044] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.044] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.044] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfb24, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.044] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.044] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.045] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.045] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.045] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.045] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.045] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.045] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.046] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.046] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.046] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.046] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.046] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.046] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.046] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.046] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.046] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.046] GetCurrentThreadId () returned 0xa94 [0070.046] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.046] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.046] GetCurrentThreadId () returned 0xa94 [0070.047] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.047] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.047] GetCurrentThreadId () returned 0xa94 [0070.047] GetCurrentThreadId () returned 0xa94 [0070.047] GetCurrentThreadId () returned 0xa94 [0070.047] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.047] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.047] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.050] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.050] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.050] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2460 [0070.050] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24d0 [0070.050] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2530 [0070.050] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.050] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.050] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.050] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.051] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.051] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.051] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.051] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.051] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.051] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.051] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.051] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.051] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.051] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.052] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.052] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.052] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.052] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.052] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.054] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.054] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.054] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.054] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.055] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.055] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.055] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.055] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.055] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.055] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.055] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.055] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.056] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.056] GetCurrentThreadId () returned 0xa94 [0070.056] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.056] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\lsass.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.057] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.057] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.057] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.057] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.058] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.058] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.058] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.058] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.058] GetCurrentThreadId () returned 0xa94 [0070.058] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.059] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\lsass.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.059] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.059] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\lsass.exe", cchLength=0x1e | out: lpsz="c:\\windows\\system32\\lsass.exe") returned 0x1e [0070.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.059] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.059] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.059] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.060] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfe6c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.060] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.060] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.060] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.060] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.061] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.061] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.061] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.061] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.062] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.062] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.062] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.062] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.062] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.062] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.062] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.062] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.062] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.062] GetCurrentThreadId () returned 0xa94 [0070.063] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.063] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.063] GetCurrentThreadId () returned 0xa94 [0070.063] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.064] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.064] GetCurrentThreadId () returned 0xa94 [0070.064] GetCurrentThreadId () returned 0xa94 [0070.064] GetCurrentThreadId () returned 0xa94 [0070.064] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.065] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.065] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.066] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.066] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.066] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0070.067] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0070.067] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0070.067] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.067] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.068] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.068] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.068] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.068] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.068] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.068] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.068] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.069] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.069] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.069] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.069] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.069] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.069] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.070] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.070] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.070] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.071] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.072] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.072] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.072] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.073] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.073] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.073] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.073] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.073] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.073] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.073] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.073] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.073] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.073] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.073] GetCurrentThreadId () returned 0xa94 [0070.073] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.074] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\lsm.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.074] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.074] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.074] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.074] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.074] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.074] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.074] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.074] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.075] GetCurrentThreadId () returned 0xa94 [0070.075] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.075] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\lsm.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.075] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.075] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\lsm.exe", cchLength=0x1c | out: lpsz="c:\\windows\\system32\\lsm.exe") returned 0x1c [0070.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.075] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.075] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.075] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfb24, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.075] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.075] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.076] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.076] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.076] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.076] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.076] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.076] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.076] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.076] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.076] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.076] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.076] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.076] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.076] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.076] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.076] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.076] GetCurrentThreadId () returned 0xa94 [0070.077] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.077] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.077] GetCurrentThreadId () returned 0xa94 [0070.077] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.077] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.077] GetCurrentThreadId () returned 0xa94 [0070.077] GetCurrentThreadId () returned 0xa94 [0070.077] GetCurrentThreadId () returned 0xa94 [0070.077] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.077] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.077] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.078] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.078] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.078] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0070.078] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0070.078] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0070.078] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.078] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.079] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.079] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.079] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.079] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.079] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.079] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.079] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.079] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.079] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.079] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.079] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.079] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.079] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.079] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.079] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.079] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.080] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.081] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.081] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.081] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.081] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.081] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.081] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.081] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.081] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.081] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.081] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.081] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.082] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.082] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.082] GetCurrentThreadId () returned 0xa94 [0070.082] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.082] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\svchost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.082] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.082] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.082] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.082] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.083] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.083] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.083] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.083] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.083] GetCurrentThreadId () returned 0xa94 [0070.083] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.083] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\svchost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.083] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.084] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\svchost.exe", cchLength=0x20 | out: lpsz="c:\\windows\\system32\\svchost.exe") returned 0x20 [0070.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.084] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.084] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.084] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfe6c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.084] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.084] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.084] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.085] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.085] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.085] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.085] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.085] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.085] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.085] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.085] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.085] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.085] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.085] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.086] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.086] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.086] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.086] GetCurrentThreadId () returned 0xa94 [0070.086] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.086] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.086] GetCurrentThreadId () returned 0xa94 [0070.086] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.086] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.086] GetCurrentThreadId () returned 0xa94 [0070.086] GetCurrentThreadId () returned 0xa94 [0070.087] GetCurrentThreadId () returned 0xa94 [0070.087] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.087] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.087] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.088] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.088] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.088] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0070.088] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0070.088] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0070.088] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.089] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.089] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.089] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.089] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.089] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.089] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.089] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.089] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.089] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.089] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.089] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.089] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.089] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.090] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.090] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.090] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.090] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.090] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.091] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.091] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.091] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.091] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.091] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.091] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.092] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.092] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.092] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.092] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.092] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.092] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.092] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.092] GetCurrentThreadId () returned 0xa94 [0070.092] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.092] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\svchost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.092] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.092] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.093] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.093] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.093] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.093] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.093] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.093] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.093] GetCurrentThreadId () returned 0xa94 [0070.093] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.093] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\svchost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.093] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.093] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\svchost.exe", cchLength=0x20 | out: lpsz="c:\\windows\\system32\\svchost.exe") returned 0x20 [0070.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.094] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.094] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.094] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfb24, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.094] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.094] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.094] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.095] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.095] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.095] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.095] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.095] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.095] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.095] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.095] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.095] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.095] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.095] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.095] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.095] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.096] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.096] GetCurrentThreadId () returned 0xa94 [0070.096] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.096] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.096] GetCurrentThreadId () returned 0xa94 [0070.096] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.096] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.096] GetCurrentThreadId () returned 0xa94 [0070.096] GetCurrentThreadId () returned 0xa94 [0070.096] GetCurrentThreadId () returned 0xa94 [0070.096] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.096] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.097] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.098] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.098] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.098] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0070.098] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0070.098] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0070.098] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.098] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.099] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.099] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.099] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.099] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.099] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.099] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.099] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.099] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.099] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.099] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.099] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.099] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.100] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.100] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.100] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.100] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.100] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.102] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.102] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.102] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.102] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.103] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.103] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.103] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.103] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.103] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.103] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.104] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.104] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.104] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.104] GetCurrentThreadId () returned 0xa94 [0070.105] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.105] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\System32\\svchost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.105] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.106] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.106] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.106] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.106] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.106] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.107] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.107] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.107] GetCurrentThreadId () returned 0xa94 [0070.107] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.107] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\System32\\svchost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.108] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.108] CharLowerBuffW (in: lpsz="C:\\Windows\\System32\\svchost.exe", cchLength=0x20 | out: lpsz="c:\\windows\\system32\\svchost.exe") returned 0x20 [0070.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.109] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.109] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.109] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.109] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfe6c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.109] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.110] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.110] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.110] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.111] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.111] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.111] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.111] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.111] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.112] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.112] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.112] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.112] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.112] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.112] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.112] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.112] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.112] GetCurrentThreadId () returned 0xa94 [0070.113] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.113] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.113] GetCurrentThreadId () returned 0xa94 [0070.113] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.113] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.114] GetCurrentThreadId () returned 0xa94 [0070.114] GetCurrentThreadId () returned 0xa94 [0070.114] GetCurrentThreadId () returned 0xa94 [0070.115] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.115] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.115] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.118] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.118] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.118] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0070.118] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0070.118] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0070.118] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.118] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.119] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.119] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.119] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.119] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.119] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.119] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.119] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.119] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.120] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.120] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.120] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.120] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.120] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.120] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.120] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.120] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.121] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.122] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.122] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.122] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.122] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.123] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.123] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.123] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.123] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.123] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.123] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.123] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.123] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.123] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.123] GetCurrentThreadId () returned 0xa94 [0070.123] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.123] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\System32\\svchost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.124] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.124] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.124] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.124] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.124] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.124] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.124] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.124] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.124] GetCurrentThreadId () returned 0xa94 [0070.125] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.125] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\System32\\svchost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.125] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.125] CharLowerBuffW (in: lpsz="C:\\Windows\\System32\\svchost.exe", cchLength=0x20 | out: lpsz="c:\\windows\\system32\\svchost.exe") returned 0x20 [0070.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.125] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.125] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.125] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.125] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfb24, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.125] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.126] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.126] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.126] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.126] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.126] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.126] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.126] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.126] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.126] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.126] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.127] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.127] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.127] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.127] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.127] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.127] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.127] GetCurrentThreadId () returned 0xa94 [0070.127] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.127] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.127] GetCurrentThreadId () returned 0xa94 [0070.127] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.127] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.127] GetCurrentThreadId () returned 0xa94 [0070.127] GetCurrentThreadId () returned 0xa94 [0070.127] GetCurrentThreadId () returned 0xa94 [0070.128] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.128] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.128] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.129] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.129] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.129] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0070.129] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0070.129] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0070.129] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.129] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.129] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.130] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.130] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.130] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.130] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.130] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.130] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.130] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.130] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.130] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.130] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.130] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.130] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.130] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.131] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.131] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.131] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.133] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.133] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.133] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.134] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.134] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.134] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.134] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.134] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.134] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.134] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.134] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.134] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.134] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.134] GetCurrentThreadId () returned 0xa94 [0070.134] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.135] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\svchost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.135] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.135] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.135] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.135] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.135] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.135] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.136] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.136] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.136] GetCurrentThreadId () returned 0xa94 [0070.136] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.136] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\svchost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.136] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.136] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\svchost.exe", cchLength=0x20 | out: lpsz="c:\\windows\\system32\\svchost.exe") returned 0x20 [0070.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.137] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.137] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.137] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfe6c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.137] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.137] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.137] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.137] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.138] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.138] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.138] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.138] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.138] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.138] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.138] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.138] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.138] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.138] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.138] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.138] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.138] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.138] GetCurrentThreadId () returned 0xa94 [0070.139] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.139] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.139] GetCurrentThreadId () returned 0xa94 [0070.139] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.139] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.139] GetCurrentThreadId () returned 0xa94 [0070.139] GetCurrentThreadId () returned 0xa94 [0070.139] GetCurrentThreadId () returned 0xa94 [0070.139] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.139] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.139] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.141] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.141] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.141] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0070.141] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0070.141] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0070.141] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.141] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.141] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.141] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.141] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.142] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.142] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.142] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.142] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.142] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.142] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.142] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.142] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.142] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.142] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.142] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.143] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.143] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.143] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.145] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.145] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.145] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.145] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.146] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.146] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=32) returned 0x0 [0070.146] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.146] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.146] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.146] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.146] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.147] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.147] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.147] GetCurrentThreadId () returned 0xa94 [0070.147] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.147] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.147] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.148] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.148] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.148] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.148] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.149] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.149] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.149] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.149] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.149] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.149] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.149] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.149] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.149] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.149] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.150] GetCurrentThreadId () returned 0xa94 [0070.150] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.150] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.150] GetCurrentThreadId () returned 0xa94 [0070.150] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.151] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.151] GetCurrentThreadId () returned 0xa94 [0070.151] GetCurrentThreadId () returned 0xa94 [0070.151] GetCurrentThreadId () returned 0xa94 [0070.151] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.151] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.152] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.153] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.153] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.153] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0070.153] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0070.153] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0070.153] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.153] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.154] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.154] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.154] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.154] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.154] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.154] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.154] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.154] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.154] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.154] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.154] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.154] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.155] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.155] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.155] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.155] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.155] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.157] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.157] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.157] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.157] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.157] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.157] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.157] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.158] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.158] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.158] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.158] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.158] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.158] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.158] GetCurrentThreadId () returned 0xa94 [0070.158] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.159] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\svchost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.159] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.159] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.159] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.159] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.159] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.159] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.160] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.160] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.160] GetCurrentThreadId () returned 0xa94 [0070.160] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.160] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\svchost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.160] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.161] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\svchost.exe", cchLength=0x20 | out: lpsz="c:\\windows\\system32\\svchost.exe") returned 0x20 [0070.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.161] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.161] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.161] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.161] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfb24, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.162] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.162] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.162] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.162] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.163] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.163] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.163] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.163] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.163] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.164] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.164] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.164] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.164] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.164] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.164] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.164] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.164] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.164] GetCurrentThreadId () returned 0xa94 [0070.164] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.164] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.165] GetCurrentThreadId () returned 0xa94 [0070.165] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.165] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.165] GetCurrentThreadId () returned 0xa94 [0070.165] GetCurrentThreadId () returned 0xa94 [0070.166] GetCurrentThreadId () returned 0xa94 [0070.166] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.166] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.166] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.169] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.169] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.169] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0070.169] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0070.169] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0070.169] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.170] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.170] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.170] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.170] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.170] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.170] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.170] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.170] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.171] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.171] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.171] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.171] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.171] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.171] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.172] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.172] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.172] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.173] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.174] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.175] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.175] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.175] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.175] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.175] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.175] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.175] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.175] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.175] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.176] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.176] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.176] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.176] GetCurrentThreadId () returned 0xa94 [0070.176] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.177] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\svchost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.177] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.177] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.178] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.178] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.178] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.178] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.180] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.180] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.181] GetCurrentThreadId () returned 0xa94 [0070.181] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.181] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\svchost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.181] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.182] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\svchost.exe", cchLength=0x20 | out: lpsz="c:\\windows\\system32\\svchost.exe") returned 0x20 [0070.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.182] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.182] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.182] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.182] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfe6c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.182] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.182] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.183] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.183] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.183] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.184] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.184] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.184] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.184] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.184] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.184] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.184] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.184] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.184] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.184] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.184] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.185] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.185] GetCurrentThreadId () returned 0xa94 [0070.185] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.185] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.185] GetCurrentThreadId () returned 0xa94 [0070.185] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.185] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.185] GetCurrentThreadId () returned 0xa94 [0070.186] GetCurrentThreadId () returned 0xa94 [0070.186] GetCurrentThreadId () returned 0xa94 [0070.186] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.186] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.186] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.209] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.209] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.209] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0070.209] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0070.209] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0070.209] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.210] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.210] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.210] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.210] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.210] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.210] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.211] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.211] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.211] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.211] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.211] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.211] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.212] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.212] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.212] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.212] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.212] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.213] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.214] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.215] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.215] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.215] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.215] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.215] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.215] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.215] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.215] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.215] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.216] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.216] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.216] GetCurrentThreadId () returned 0xa94 [0070.216] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.216] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\Dwm.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.216] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.216] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.217] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.217] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.217] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.217] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.217] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.217] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.217] GetCurrentThreadId () returned 0xa94 [0070.217] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.217] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\Dwm.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.217] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.217] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\Dwm.exe", cchLength=0x1c | out: lpsz="c:\\windows\\system32\\dwm.exe") returned 0x1c [0070.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.218] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.218] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.218] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfb24, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.218] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.218] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.218] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.218] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.218] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.218] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.219] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.219] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.219] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.219] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.219] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.219] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.219] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.219] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.219] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.219] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.219] GetCurrentThreadId () returned 0xa94 [0070.219] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.219] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.219] GetCurrentThreadId () returned 0xa94 [0070.220] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.220] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.220] GetCurrentThreadId () returned 0xa94 [0070.220] GetCurrentThreadId () returned 0xa94 [0070.220] GetCurrentThreadId () returned 0xa94 [0070.220] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.220] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.220] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.224] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.224] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.224] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0070.224] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0070.224] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0070.224] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.224] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.224] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.224] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.225] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.225] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.225] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.225] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.225] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.225] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.225] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.225] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.225] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.226] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.226] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.226] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.226] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.226] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.226] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.228] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.228] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.228] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.228] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.228] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.228] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.228] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.228] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.228] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.228] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.229] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.229] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.229] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.229] GetCurrentThreadId () returned 0xa94 [0070.229] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.229] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\Explorer.EXE", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.229] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.230] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.230] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.230] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.230] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.230] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.230] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.230] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.230] GetCurrentThreadId () returned 0xa94 [0070.230] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.230] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\Explorer.EXE", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.231] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.231] CharLowerBuffW (in: lpsz="C:\\Windows\\Explorer.EXE", cchLength=0x18 | out: lpsz="c:\\windows\\explorer.exe") returned 0x18 [0070.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.231] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.231] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.231] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.231] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfe6c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.231] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.231] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.231] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.232] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.232] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.232] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.232] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.232] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.232] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.232] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.232] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.232] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.232] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.232] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.232] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.232] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.232] GetCurrentThreadId () returned 0xa94 [0070.232] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.232] GetCurrentThreadId () returned 0xa94 [0070.232] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.233] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.233] GetCurrentThreadId () returned 0xa94 [0070.233] GetCurrentThreadId () returned 0xa94 [0070.233] GetCurrentThreadId () returned 0xa94 [0070.233] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.233] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.233] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.234] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.234] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.234] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0070.235] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0070.235] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0070.235] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.235] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.235] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.235] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.235] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.235] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.235] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.235] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.235] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.235] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.235] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.235] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.235] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.235] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.235] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.236] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.236] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.236] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.236] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.237] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.237] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.237] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.237] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.238] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.238] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.238] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.238] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.238] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.238] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.238] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.238] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.238] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.238] GetCurrentThreadId () returned 0xa94 [0070.238] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.238] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\System32\\spoolsv.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.238] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.239] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.239] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.239] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.239] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.239] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.239] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.239] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.239] GetCurrentThreadId () returned 0xa94 [0070.239] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.239] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\System32\\spoolsv.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.239] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.240] CharLowerBuffW (in: lpsz="C:\\Windows\\System32\\spoolsv.exe", cchLength=0x20 | out: lpsz="c:\\windows\\system32\\spoolsv.exe") returned 0x20 [0070.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.240] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.240] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.240] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfb24, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.240] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.240] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.240] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.240] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.240] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.241] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.241] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.241] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.241] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.241] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.241] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.241] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.241] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.241] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.241] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.241] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.241] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.241] GetCurrentThreadId () returned 0xa94 [0070.241] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.241] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.241] GetCurrentThreadId () returned 0xa94 [0070.242] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.242] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.242] GetCurrentThreadId () returned 0xa94 [0070.242] GetCurrentThreadId () returned 0xa94 [0070.242] GetCurrentThreadId () returned 0xa94 [0070.242] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.242] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.242] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.243] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.243] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.243] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0070.244] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0070.244] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0070.244] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.244] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.244] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.244] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.244] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.244] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.244] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.244] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.244] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.244] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.244] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.244] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.244] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.244] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.245] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.245] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.245] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.245] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.245] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.246] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.247] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.247] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.247] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.247] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.247] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.247] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.247] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.247] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.247] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.247] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.247] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.247] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.247] GetCurrentThreadId () returned 0xa94 [0070.248] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.248] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\svchost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.248] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.248] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.248] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.249] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.249] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.249] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.249] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.249] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.249] GetCurrentThreadId () returned 0xa94 [0070.249] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.249] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\svchost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.250] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.250] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\svchost.exe", cchLength=0x20 | out: lpsz="c:\\windows\\system32\\svchost.exe") returned 0x20 [0070.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.250] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.250] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.250] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.250] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfe6c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.250] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.250] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.250] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.251] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.251] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.251] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.251] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.251] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.251] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.251] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.251] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.251] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.251] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.251] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.251] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.251] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.251] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.251] GetCurrentThreadId () returned 0xa94 [0070.252] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.252] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.252] GetCurrentThreadId () returned 0xa94 [0070.252] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.252] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.252] GetCurrentThreadId () returned 0xa94 [0070.252] GetCurrentThreadId () returned 0xa94 [0070.252] GetCurrentThreadId () returned 0xa94 [0070.252] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.252] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.253] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.255] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.255] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.255] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0070.255] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0070.255] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0070.255] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.255] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.255] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.255] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.256] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.256] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.256] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.256] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.256] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.256] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.256] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.256] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.256] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.256] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.256] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.256] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.257] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.257] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.257] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.259] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.259] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.259] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.259] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.260] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.260] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.260] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.260] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.260] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.260] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.260] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.260] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.260] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.261] GetCurrentThreadId () returned 0xa94 [0070.261] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.261] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\taskhost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.261] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.261] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.262] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.262] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.262] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.262] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.262] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.262] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.263] GetCurrentThreadId () returned 0xa94 [0070.263] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.263] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\taskhost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.263] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.263] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\taskhost.exe", cchLength=0x21 | out: lpsz="c:\\windows\\system32\\taskhost.exe") returned 0x21 [0070.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.264] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.264] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.264] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfb24, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.264] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.265] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.265] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.265] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.265] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.265] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.266] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.266] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.266] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.266] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.266] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.266] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.266] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.266] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.266] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.266] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.266] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.267] GetCurrentThreadId () returned 0xa94 [0070.267] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.267] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.267] GetCurrentThreadId () returned 0xa94 [0070.267] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.268] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.268] GetCurrentThreadId () returned 0xa94 [0070.268] GetCurrentThreadId () returned 0xa94 [0070.268] GetCurrentThreadId () returned 0xa94 [0070.269] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.269] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.269] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.271] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.271] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.271] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0070.272] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0070.272] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0070.272] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.272] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.272] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.272] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.272] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.273] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.273] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.273] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.273] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.273] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.273] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.273] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.273] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.273] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.273] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.273] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.273] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.273] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.274] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.275] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.275] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.275] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.276] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.276] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.276] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.276] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.276] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.276] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.276] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.277] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.277] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.277] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.277] GetCurrentThreadId () returned 0xa94 [0070.278] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.278] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\taskeng.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.278] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.278] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.279] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.279] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.279] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.279] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.279] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.279] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.280] GetCurrentThreadId () returned 0xa94 [0070.280] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.280] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\taskeng.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.281] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.281] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\taskeng.exe", cchLength=0x20 | out: lpsz="c:\\windows\\system32\\taskeng.exe") returned 0x20 [0070.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.281] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.282] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.282] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.282] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfe6c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.282] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.282] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.283] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.283] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.284] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.284] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.284] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.284] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.284] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.284] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.284] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.285] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.285] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.285] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.285] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.285] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.285] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.285] GetCurrentThreadId () returned 0xa94 [0070.285] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.286] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.286] GetCurrentThreadId () returned 0xa94 [0070.286] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.286] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.286] GetCurrentThreadId () returned 0xa94 [0070.287] GetCurrentThreadId () returned 0xa94 [0070.287] GetCurrentThreadId () returned 0xa94 [0070.287] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.287] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.287] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.289] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.289] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.289] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2498 [0070.289] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2508 [0070.290] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2568 [0070.290] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.290] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.290] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.290] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.290] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.290] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.290] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.290] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.291] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.291] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.291] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.291] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.291] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.291] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.291] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.291] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.291] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.291] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.292] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.293] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.293] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.294] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.294] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.294] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.294] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.294] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.294] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.294] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.294] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.294] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.294] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.294] GetCurrentThreadId () returned 0xa94 [0070.295] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.295] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Mozilla Firefox\\dynamics_diversity.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.295] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.295] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.295] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.295] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.295] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.296] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.296] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.296] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.296] GetCurrentThreadId () returned 0xa94 [0070.296] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.296] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Mozilla Firefox\\dynamics_diversity.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.296] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.297] CharLowerBuffW (in: lpsz="C:\\Program Files (x86)\\Mozilla Firefox\\dynamics_diversity.exe", cchLength=0x3e | out: lpsz="c:\\program files (x86)\\mozilla firefox\\dynamics_diversity.exe") returned 0x3e [0070.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.297] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.297] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.297] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.297] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfb24, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.297] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.297] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.297] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.298] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18eb84, nSize=0x104 | out: lpFilename="C:\\ProgramData\\zhang.exe" (normalized: "c:\\programdata\\zhang.exe")) returned 0x18 [0070.298] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0070.298] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0070.298] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0070.298] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0070.298] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0070.299] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x6) returned 0x1677628 [0070.299] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167c638 | out: hHeap=0x1660000) returned 1 [0070.299] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167c610 | out: hHeap=0x1660000) returned 1 [0070.299] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0070.300] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x2dfe44, cchWideChar=6 | out: lpWideCharStr="zhang") returned 6 [0070.300] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1677628 | out: hHeap=0x1660000) returned 1 [0070.300] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.300] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.300] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0070.300] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0070.300] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.300] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.300] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.300] SysStringLen (param_1="Name") returned 0x4 [0070.300] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0070.300] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25c8 [0070.301] SysStringLen (param_1="Name") returned 0x4 [0070.301] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.301] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.301] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.301] GetCurrentThreadId () returned 0xa94 [0070.301] SysStringLen (param_1="Name") returned 0x4 [0070.301] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="dynamics_diversity.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.301] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.302] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.302] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.302] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.302] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0070.302] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0070.302] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0070.302] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.303] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.303] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.303] GetCurrentThreadId () returned 0xa94 [0070.303] SysStringLen (param_1="Name") returned 0x4 [0070.303] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="dynamics_diversity.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.303] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0070.304] SetErrorMode (uMode=0x8001) returned 0x8001 [0070.304] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0070.305] SetErrorMode (uMode=0x8001) returned 0x8001 [0070.305] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersionExA") returned 0x76d43519 [0070.305] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0070.305] GetLastError () returned 0x0 [0070.305] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpWideCharStr=0x18eb7c, cchWideChar=128 | out: lpWideCharStr="Service Pack 1") returned 128 [0070.306] SetErrorMode (uMode=0x8001) returned 0x8001 [0070.306] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0070.306] SetErrorMode (uMode=0x8001) returned 0x8001 [0070.306] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0070.306] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0070.311] GetLastError () returned 0x0 [0070.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=260, lpMultiByteStr=0x18e8d8, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 260 [0070.311] SetErrorMode (uMode=0x8001) returned 0x8001 [0070.311] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0070.312] SetErrorMode (uMode=0x8001) returned 0x8001 [0070.312] GetProcAddress (hModule=0x76d30000, lpProcName="Process32First") returned 0x76d68ae7 [0070.312] Process32First (in: hSnapshot=0x1b4, lppe=0x18e8b4 | out: lppe=0x18e8b4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0070.313] GetLastError () returned 0x0 [0070.313] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e8d8, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="[System Process]") returned 260 [0070.313] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.313] CharLowerBuffW (in: lpsz="[System Process]", cchLength=0x11 | out: lpsz="[system process]") returned 0x11 [0070.314] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.314] VarBstrCmp (bstrLeft="[system process]", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="[System Process]", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[System Process]", lpUsedDefaultChar=0x0) returned 260 [0070.314] SetErrorMode (uMode=0x8001) returned 0x8001 [0070.314] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0070.314] SetErrorMode (uMode=0x8001) returned 0x8001 [0070.315] GetProcAddress (hModule=0x76d30000, lpProcName="Process32Next") returned 0x76d688a4 [0070.315] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0070.315] GetLastError () returned 0x0 [0070.315] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="System") returned 260 [0070.315] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.316] CharLowerBuffW (in: lpsz="System", cchLength=0x7 | out: lpsz="system") returned 0x7 [0070.316] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.316] VarBstrCmp (bstrLeft="system", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="System", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="System", lpUsedDefaultChar=0x0) returned 260 [0070.316] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0070.317] GetLastError () returned 0x0 [0070.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="smss.exe") returned 260 [0070.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.317] CharLowerBuffW (in: lpsz="smss.exe", cchLength=0x9 | out: lpsz="smss.exe") returned 0x9 [0070.317] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.317] VarBstrCmp (bstrLeft="smss.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smss.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="smss.exe", lpUsedDefaultChar=0x0) returned 260 [0070.318] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.318] GetLastError () returned 0x0 [0070.318] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0070.318] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.319] CharLowerBuffW (in: lpsz="csrss.exe", cchLength=0xa | out: lpsz="csrss.exe") returned 0xa [0070.319] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.320] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csrss.exe", lpUsedDefaultChar=0x0) returned 260 [0070.320] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0070.320] GetLastError () returned 0x0 [0070.321] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="wininit.exe") returned 260 [0070.321] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.321] CharLowerBuffW (in: lpsz="wininit.exe", cchLength=0xc | out: lpsz="wininit.exe") returned 0xc [0070.321] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.321] VarBstrCmp (bstrLeft="wininit.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wininit.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wininit.exe", lpUsedDefaultChar=0x0) returned 260 [0070.322] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.322] GetLastError () returned 0x0 [0070.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0070.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.323] CharLowerBuffW (in: lpsz="csrss.exe", cchLength=0xa | out: lpsz="csrss.exe") returned 0xa [0070.323] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.323] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csrss.exe", lpUsedDefaultChar=0x0) returned 260 [0070.323] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0070.323] GetLastError () returned 0x0 [0070.323] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="winlogon.exe") returned 260 [0070.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.324] CharLowerBuffW (in: lpsz="winlogon.exe", cchLength=0xd | out: lpsz="winlogon.exe") returned 0xd [0070.324] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.324] VarBstrCmp (bstrLeft="winlogon.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winlogon.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="winlogon.exe", lpUsedDefaultChar=0x0) returned 260 [0070.324] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0070.324] GetLastError () returned 0x0 [0070.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="services.exe") returned 260 [0070.325] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.325] CharLowerBuffW (in: lpsz="services.exe", cchLength=0xd | out: lpsz="services.exe") returned 0xd [0070.325] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.325] VarBstrCmp (bstrLeft="services.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services.exe", lpUsedDefaultChar=0x0) returned 260 [0070.325] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0070.326] GetLastError () returned 0x0 [0070.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="lsass.exe") returned 260 [0070.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.326] CharLowerBuffW (in: lpsz="lsass.exe", cchLength=0xa | out: lpsz="lsass.exe") returned 0xa [0070.327] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.327] VarBstrCmp (bstrLeft="lsass.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsass.exe", lpUsedDefaultChar=0x0) returned 260 [0070.327] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0070.327] GetLastError () returned 0x0 [0070.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="lsm.exe") returned 260 [0070.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.327] CharLowerBuffW (in: lpsz="lsm.exe", cchLength=0x8 | out: lpsz="lsm.exe") returned 0x8 [0070.328] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.328] VarBstrCmp (bstrLeft="lsm.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsm.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsm.exe", lpUsedDefaultChar=0x0) returned 260 [0070.328] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.328] GetLastError () returned 0x0 [0070.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.329] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0070.329] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.329] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0070.329] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.329] GetLastError () returned 0x0 [0070.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.330] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0070.330] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.330] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0070.330] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.330] GetLastError () returned 0x0 [0070.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.331] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0070.331] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.331] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0070.331] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.331] GetLastError () returned 0x0 [0070.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.332] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0070.332] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.332] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0070.332] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.332] GetLastError () returned 0x0 [0070.333] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.333] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.333] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0070.333] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.333] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0070.334] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0070.334] GetLastError () returned 0x0 [0070.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="audiodg.exe") returned 260 [0070.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.334] CharLowerBuffW (in: lpsz="audiodg.exe", cchLength=0xc | out: lpsz="audiodg.exe") returned 0xc [0070.344] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.344] VarBstrCmp (bstrLeft="audiodg.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiodg.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiodg.exe", lpUsedDefaultChar=0x0) returned 260 [0070.345] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.345] GetLastError () returned 0x0 [0070.345] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.345] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.346] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0070.346] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.346] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0070.347] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.347] GetLastError () returned 0x0 [0070.347] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.347] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.348] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0070.348] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.348] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0070.349] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0070.349] GetLastError () returned 0x0 [0070.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="dwm.exe") returned 260 [0070.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.350] CharLowerBuffW (in: lpsz="dwm.exe", cchLength=0x8 | out: lpsz="dwm.exe") returned 0x8 [0070.351] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.351] VarBstrCmp (bstrLeft="dwm.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dwm.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwm.exe", lpUsedDefaultChar=0x0) returned 260 [0070.351] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0070.351] GetLastError () returned 0x0 [0070.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="explorer.exe") returned 260 [0070.352] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.352] CharLowerBuffW (in: lpsz="explorer.exe", cchLength=0xd | out: lpsz="explorer.exe") returned 0xd [0070.352] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.352] VarBstrCmp (bstrLeft="explorer.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer.exe", lpUsedDefaultChar=0x0) returned 260 [0070.352] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0070.353] GetLastError () returned 0x0 [0070.353] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="spoolsv.exe") returned 260 [0070.353] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.354] CharLowerBuffW (in: lpsz="spoolsv.exe", cchLength=0xc | out: lpsz="spoolsv.exe") returned 0xc [0070.354] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.354] VarBstrCmp (bstrLeft="spoolsv.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="spoolsv.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spoolsv.exe", lpUsedDefaultChar=0x0) returned 260 [0070.354] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.355] GetLastError () returned 0x0 [0070.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.355] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0070.356] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.356] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0070.356] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.356] GetLastError () returned 0x0 [0070.356] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0070.356] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.357] CharLowerBuffW (in: lpsz="taskhost.exe", cchLength=0xd | out: lpsz="taskhost.exe") returned 0xd [0070.357] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.357] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskhost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskhost.exe", lpUsedDefaultChar=0x0) returned 260 [0070.357] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0070.357] GetLastError () returned 0x0 [0070.357] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="taskeng.exe") returned 260 [0070.357] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.358] CharLowerBuffW (in: lpsz="taskeng.exe", cchLength=0xc | out: lpsz="taskeng.exe") returned 0xc [0070.358] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.358] VarBstrCmp (bstrLeft="taskeng.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskeng.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskeng.exe", lpUsedDefaultChar=0x0) returned 260 [0070.358] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dynamics_diversity.exe")) returned 1 [0070.358] GetLastError () returned 0x0 [0070.358] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="dynamics_diversity.exe") returned 260 [0070.358] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.359] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.359] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.359] VarBstrCmp (bstrLeft="dynamics_diversity.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x1 [0070.359] SetErrorMode (uMode=0x8001) returned 0x8001 [0070.359] LoadLibraryA (lpLibFileName="Kernel32.dll") returned 0x76d30000 [0070.360] SetErrorMode (uMode=0x8001) returned 0x8001 [0070.360] GetProcAddress (hModule=0x76d30000, lpProcName="OpenProcess") returned 0x76d41986 [0070.360] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=1, dwProcessId=0x43c) returned 0x1b8 [0070.360] GetLastError () returned 0x0 [0070.360] SetErrorMode (uMode=0x8001) returned 0x8001 [0070.360] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0070.361] SetErrorMode (uMode=0x8001) returned 0x8001 [0070.361] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0070.361] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0070.366] GetLastError () returned 0x0 [0070.367] SetErrorMode (uMode=0x8001) returned 0x8001 [0070.367] LoadLibraryA (lpLibFileName="Kernel32.dll") returned 0x76d30000 [0070.367] SetErrorMode (uMode=0x8001) returned 0x8001 [0070.368] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0070.368] CloseHandle (hObject=0x1b8) returned 1 [0070.368] GetLastError () returned 0x0 [0070.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dynamics_diversity.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dynamics_diversity.exe", lpUsedDefaultChar=0x0) returned 260 [0070.368] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="building.exe")) returned 1 [0070.369] GetLastError () returned 0x0 [0070.369] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="building.exe") returned 260 [0070.369] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.370] CharLowerBuffW (in: lpsz="building.exe", cchLength=0xd | out: lpsz="building.exe") returned 0xd [0070.370] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.370] VarBstrCmp (bstrLeft="building.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="building.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="building.exe", lpUsedDefaultChar=0x0) returned 260 [0070.371] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ap_chuck.exe")) returned 1 [0070.371] GetLastError () returned 0x0 [0070.371] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="ap_chuck.exe") returned 260 [0070.371] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.372] CharLowerBuffW (in: lpsz="ap_chuck.exe", cchLength=0xd | out: lpsz="ap_chuck.exe") returned 0xd [0070.372] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.372] VarBstrCmp (bstrLeft="ap_chuck.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ap_chuck.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ap_chuck.exe", lpUsedDefaultChar=0x0) returned 260 [0070.373] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bathroom.exe")) returned 1 [0070.373] GetLastError () returned 0x0 [0070.373] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="bathroom.exe") returned 260 [0070.373] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.374] CharLowerBuffW (in: lpsz="bathroom.exe", cchLength=0xd | out: lpsz="bathroom.exe") returned 0xd [0070.374] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.374] VarBstrCmp (bstrLeft="bathroom.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bathroom.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bathroom.exe", lpUsedDefaultChar=0x0) returned 260 [0070.374] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="differ.exe")) returned 1 [0070.375] GetLastError () returned 0x0 [0070.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="differ.exe") returned 260 [0070.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.375] CharLowerBuffW (in: lpsz="differ.exe", cchLength=0xb | out: lpsz="differ.exe") returned 0xb [0070.376] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.376] VarBstrCmp (bstrLeft="differ.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="differ.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="differ.exe", lpUsedDefaultChar=0x0) returned 260 [0070.376] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="criticismhopkins.exe")) returned 1 [0070.377] GetLastError () returned 0x0 [0070.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="criticismhopkins.exe") returned 260 [0070.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.378] CharLowerBuffW (in: lpsz="criticismhopkins.exe", cchLength=0x15 | out: lpsz="criticismhopkins.exe") returned 0x15 [0070.378] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.379] VarBstrCmp (bstrLeft="criticismhopkins.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="criticismhopkins.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="criticismhopkins.exe", lpUsedDefaultChar=0x0) returned 260 [0070.379] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="season_robinson.exe")) returned 1 [0070.379] GetLastError () returned 0x0 [0070.379] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="season_robinson.exe") returned 260 [0070.380] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.380] CharLowerBuffW (in: lpsz="season_robinson.exe", cchLength=0x14 | out: lpsz="season_robinson.exe") returned 0x14 [0070.381] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.381] VarBstrCmp (bstrLeft="season_robinson.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="season_robinson.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="season_robinson.exe", lpUsedDefaultChar=0x0) returned 260 [0070.381] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="septemberderived.exe")) returned 1 [0070.410] GetLastError () returned 0x0 [0070.410] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="septemberderived.exe") returned 260 [0070.410] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.411] CharLowerBuffW (in: lpsz="septemberderived.exe", cchLength=0x15 | out: lpsz="septemberderived.exe") returned 0x15 [0070.411] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.411] VarBstrCmp (bstrLeft="septemberderived.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="septemberderived.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="septemberderived.exe", lpUsedDefaultChar=0x0) returned 260 [0070.411] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coffee.exe")) returned 1 [0070.411] GetLastError () returned 0x0 [0070.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="coffee.exe") returned 260 [0070.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.412] CharLowerBuffW (in: lpsz="coffee.exe", cchLength=0xb | out: lpsz="coffee.exe") returned 0xb [0070.412] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.412] VarBstrCmp (bstrLeft="coffee.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="coffee.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="coffee.exe", lpUsedDefaultChar=0x0) returned 260 [0070.412] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="analyzed.exe")) returned 1 [0070.412] GetLastError () returned 0x0 [0070.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="analyzed.exe") returned 260 [0070.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.413] CharLowerBuffW (in: lpsz="analyzed.exe", cchLength=0xd | out: lpsz="analyzed.exe") returned 0xd [0070.413] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.413] VarBstrCmp (bstrLeft="analyzed.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="analyzed.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="analyzed.exe", lpUsedDefaultChar=0x0) returned 260 [0070.413] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="speaks deborah period.exe")) returned 1 [0070.413] GetLastError () returned 0x0 [0070.413] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="speaks deborah period.exe") returned 260 [0070.413] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.414] CharLowerBuffW (in: lpsz="speaks deborah period.exe", cchLength=0x1a | out: lpsz="speaks deborah period.exe") returned 0x1a [0070.414] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.414] VarBstrCmp (bstrLeft="aks deborah period.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="speaks deborah period.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="speaks deborah period.exe", lpUsedDefaultChar=0x0) returned 260 [0070.414] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="carlo equipment linux.exe")) returned 1 [0070.415] GetLastError () returned 0x0 [0070.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="carlo equipment linux.exe") returned 260 [0070.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.415] CharLowerBuffW (in: lpsz="carlo equipment linux.exe", cchLength=0x1a | out: lpsz="carlo equipment linux.exe") returned 0x1a [0070.415] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.415] VarBstrCmp (bstrLeft="lo equipment linux.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="carlo equipment linux.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="carlo equipment linux.exe", lpUsedDefaultChar=0x0) returned 260 [0070.415] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hungaccounting.exe")) returned 1 [0070.416] GetLastError () returned 0x0 [0070.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="hungaccounting.exe") returned 260 [0070.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.416] CharLowerBuffW (in: lpsz="hungaccounting.exe", cchLength=0x13 | out: lpsz="hungaccounting.exe") returned 0x13 [0070.417] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.417] VarBstrCmp (bstrLeft="hungaccounting.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hungaccounting.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hungaccounting.exe", lpUsedDefaultChar=0x0) returned 260 [0070.417] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="astrologylooksmartwidely.exe")) returned 1 [0070.417] GetLastError () returned 0x0 [0070.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="astrologylooksmartwidely.exe") returned 260 [0070.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.421] CharLowerBuffW (in: lpsz="astrologylooksmartwidely.exe", cchLength=0x1d | out: lpsz="astrologylooksmartwidely.exe") returned 0x1d [0070.421] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.421] VarBstrCmp (bstrLeft="ogylooksmartwidely.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="astrologylooksmartwidely.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="astrologylooksmartwidely.exe", lpUsedDefaultChar=0x0) returned 260 [0070.421] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0070.421] GetLastError () returned 0x0 [0070.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="suburban.exe") returned 260 [0070.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.422] CharLowerBuffW (in: lpsz="suburban.exe", cchLength=0xd | out: lpsz="suburban.exe") returned 0xd [0070.422] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.422] VarBstrCmp (bstrLeft="suburban.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="suburban.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="suburban.exe", lpUsedDefaultChar=0x0) returned 260 [0070.422] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="triangle.exe")) returned 1 [0070.422] GetLastError () returned 0x0 [0070.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="triangle.exe") returned 260 [0070.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.423] CharLowerBuffW (in: lpsz="triangle.exe", cchLength=0xd | out: lpsz="triangle.exe") returned 0xd [0070.423] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.423] VarBstrCmp (bstrLeft="triangle.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="triangle.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="triangle.exe", lpUsedDefaultChar=0x0) returned 260 [0070.423] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mild.exe")) returned 1 [0070.423] GetLastError () returned 0x0 [0070.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="mild.exe") returned 260 [0070.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.423] CharLowerBuffW (in: lpsz="mild.exe", cchLength=0x9 | out: lpsz="mild.exe") returned 0x9 [0070.424] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.424] VarBstrCmp (bstrLeft="mild.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mild.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mild.exe", lpUsedDefaultChar=0x0) returned 260 [0070.424] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="by-bubble-hi.exe")) returned 1 [0070.424] GetLastError () returned 0x0 [0070.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="by-bubble-hi.exe") returned 260 [0070.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.424] CharLowerBuffW (in: lpsz="by-bubble-hi.exe", cchLength=0x11 | out: lpsz="by-bubble-hi.exe") returned 0x11 [0070.425] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.425] VarBstrCmp (bstrLeft="by-bubble-hi.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="by-bubble-hi.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="by-bubble-hi.exe", lpUsedDefaultChar=0x0) returned 260 [0070.425] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0070.425] GetLastError () returned 0x0 [0070.425] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="3dftp.exe") returned 260 [0070.425] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.425] CharLowerBuffW (in: lpsz="3dftp.exe", cchLength=0xa | out: lpsz="3dftp.exe") returned 0xa [0070.426] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.426] VarBstrCmp (bstrLeft="3dftp.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="3dftp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3dftp.exe", lpUsedDefaultChar=0x0) returned 260 [0070.426] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0070.426] GetLastError () returned 0x0 [0070.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="absolutetelnet.exe") returned 260 [0070.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.427] CharLowerBuffW (in: lpsz="absolutetelnet.exe", cchLength=0x13 | out: lpsz="absolutetelnet.exe") returned 0x13 [0070.427] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.427] VarBstrCmp (bstrLeft="absolutetelnet.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="absolutetelnet.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="absolutetelnet.exe", lpUsedDefaultChar=0x0) returned 260 [0070.427] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0070.428] GetLastError () returned 0x0 [0070.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="alftp.exe") returned 260 [0070.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.429] CharLowerBuffW (in: lpsz="alftp.exe", cchLength=0xa | out: lpsz="alftp.exe") returned 0xa [0070.429] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.429] VarBstrCmp (bstrLeft="alftp.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alftp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alftp.exe", lpUsedDefaultChar=0x0) returned 260 [0070.429] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0070.429] GetLastError () returned 0x0 [0070.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="barca.exe") returned 260 [0070.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.430] CharLowerBuffW (in: lpsz="barca.exe", cchLength=0xa | out: lpsz="barca.exe") returned 0xa [0070.430] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.430] VarBstrCmp (bstrLeft="barca.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="barca.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="barca.exe", lpUsedDefaultChar=0x0) returned 260 [0070.431] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0070.431] GetLastError () returned 0x0 [0070.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="bitkinex.exe") returned 260 [0070.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.432] CharLowerBuffW (in: lpsz="bitkinex.exe", cchLength=0xd | out: lpsz="bitkinex.exe") returned 0xd [0070.432] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.432] VarBstrCmp (bstrLeft="bitkinex.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitkinex.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bitkinex.exe", lpUsedDefaultChar=0x0) returned 260 [0070.432] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x670, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0070.433] GetLastError () returned 0x0 [0070.433] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="coreftp.exe") returned 260 [0070.433] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.433] CharLowerBuffW (in: lpsz="coreftp.exe", cchLength=0xc | out: lpsz="coreftp.exe") returned 0xc [0070.434] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.434] VarBstrCmp (bstrLeft="coreftp.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="coreftp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="coreftp.exe", lpUsedDefaultChar=0x0) returned 260 [0070.434] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0070.434] GetLastError () returned 0x0 [0070.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="far.exe") returned 260 [0070.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.435] CharLowerBuffW (in: lpsz="far.exe", cchLength=0x8 | out: lpsz="far.exe") returned 0x8 [0070.436] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.436] VarBstrCmp (bstrLeft="far.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="far.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="far.exe", lpUsedDefaultChar=0x0) returned 260 [0070.436] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0070.437] GetLastError () returned 0x0 [0070.437] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="filezilla.exe") returned 260 [0070.437] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.437] CharLowerBuffW (in: lpsz="filezilla.exe", cchLength=0xe | out: lpsz="filezilla.exe") returned 0xe [0070.438] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.438] VarBstrCmp (bstrLeft="filezilla.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.438] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filezilla.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filezilla.exe", lpUsedDefaultChar=0x0) returned 260 [0070.438] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0070.439] GetLastError () returned 0x0 [0070.439] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="flashfxp.exe") returned 260 [0070.439] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.440] CharLowerBuffW (in: lpsz="flashfxp.exe", cchLength=0xd | out: lpsz="flashfxp.exe") returned 0xd [0070.440] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.440] VarBstrCmp (bstrLeft="flashfxp.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashfxp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashfxp.exe", lpUsedDefaultChar=0x0) returned 260 [0070.440] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0070.441] GetLastError () returned 0x0 [0070.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="fling.exe") returned 260 [0070.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.441] CharLowerBuffW (in: lpsz="fling.exe", cchLength=0xa | out: lpsz="fling.exe") returned 0xa [0070.442] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.442] VarBstrCmp (bstrLeft="fling.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fling.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fling.exe", lpUsedDefaultChar=0x0) returned 260 [0070.442] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0070.443] GetLastError () returned 0x0 [0070.443] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="foxmailincmail.exe") returned 260 [0070.443] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.443] CharLowerBuffW (in: lpsz="foxmailincmail.exe", cchLength=0x13 | out: lpsz="foxmailincmail.exe") returned 0x13 [0070.443] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.443] VarBstrCmp (bstrLeft="foxmailincmail.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="foxmailincmail.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="foxmailincmail.exe", lpUsedDefaultChar=0x0) returned 260 [0070.452] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0070.453] GetLastError () returned 0x0 [0070.453] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="gmailnotifierpro.exe") returned 260 [0070.453] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.453] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0070.453] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.453] VarBstrCmp (bstrLeft="gmailnotifierpro.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gmailnotifierpro.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gmailnotifierpro.exe", lpUsedDefaultChar=0x0) returned 260 [0070.453] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0070.454] GetLastError () returned 0x0 [0070.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="icq.exe") returned 260 [0070.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.639] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0070.639] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.639] VarBstrCmp (bstrLeft="icq.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="icq.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icq.exe", lpUsedDefaultChar=0x0) returned 260 [0070.639] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0070.639] GetLastError () returned 0x0 [0070.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="leechftp.exe") returned 260 [0070.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.640] CharLowerBuffW (in: lpsz="leechftp.exe", cchLength=0xd | out: lpsz="leechftp.exe") returned 0xd [0070.640] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.640] VarBstrCmp (bstrLeft="leechftp.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="leechftp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="leechftp.exe", lpUsedDefaultChar=0x0) returned 260 [0070.640] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0070.640] GetLastError () returned 0x0 [0070.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="ncftp.exe") returned 260 [0070.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.641] CharLowerBuffW (in: lpsz="ncftp.exe", cchLength=0xa | out: lpsz="ncftp.exe") returned 0xa [0070.641] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.641] VarBstrCmp (bstrLeft="ncftp.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ncftp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ncftp.exe", lpUsedDefaultChar=0x0) returned 260 [0070.641] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0070.641] GetLastError () returned 0x0 [0070.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="notepad.exe") returned 260 [0070.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.641] CharLowerBuffW (in: lpsz="notepad.exe", cchLength=0xc | out: lpsz="notepad.exe") returned 0xc [0070.642] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.642] VarBstrCmp (bstrLeft="notepad.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad.exe", lpUsedDefaultChar=0x0) returned 260 [0070.642] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0070.642] GetLastError () returned 0x0 [0070.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="operamail.exe") returned 260 [0070.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.643] CharLowerBuffW (in: lpsz="operamail.exe", cchLength=0xe | out: lpsz="operamail.exe") returned 0xe [0070.643] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.643] VarBstrCmp (bstrLeft="operamail.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="operamail.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="operamail.exe", lpUsedDefaultChar=0x0) returned 260 [0070.643] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0070.644] GetLastError () returned 0x0 [0070.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="outlook.exe") returned 260 [0070.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.645] CharLowerBuffW (in: lpsz="outlook.exe", cchLength=0xc | out: lpsz="outlook.exe") returned 0xc [0070.645] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.645] VarBstrCmp (bstrLeft="outlook.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="outlook.exe", lpUsedDefaultChar=0x0) returned 260 [0070.645] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0070.646] GetLastError () returned 0x0 [0070.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="pidgin.exe") returned 260 [0070.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.646] CharLowerBuffW (in: lpsz="pidgin.exe", cchLength=0xb | out: lpsz="pidgin.exe") returned 0xb [0070.647] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.647] VarBstrCmp (bstrLeft="pidgin.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pidgin.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pidgin.exe", lpUsedDefaultChar=0x0) returned 260 [0070.647] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0070.648] GetLastError () returned 0x0 [0070.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="scriptftp.exe") returned 260 [0070.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.648] CharLowerBuffW (in: lpsz="scriptftp.exe", cchLength=0xe | out: lpsz="scriptftp.exe") returned 0xe [0070.648] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.648] VarBstrCmp (bstrLeft="scriptftp.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="scriptftp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scriptftp.exe", lpUsedDefaultChar=0x0) returned 260 [0070.648] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0070.649] GetLastError () returned 0x0 [0070.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="skype.exe") returned 260 [0070.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.649] CharLowerBuffW (in: lpsz="skype.exe", cchLength=0xa | out: lpsz="skype.exe") returned 0xa [0070.649] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.649] VarBstrCmp (bstrLeft="skype.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.649] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0070.650] GetLastError () returned 0x0 [0070.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="smartftp.exe") returned 260 [0070.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.650] CharLowerBuffW (in: lpsz="smartftp.exe", cchLength=0xd | out: lpsz="smartftp.exe") returned 0xd [0070.650] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.650] VarBstrCmp (bstrLeft="smartftp.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.650] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0070.651] GetLastError () returned 0x0 [0070.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="thunderbird.exe") returned 260 [0070.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.651] CharLowerBuffW (in: lpsz="thunderbird.exe", cchLength=0x10 | out: lpsz="thunderbird.exe") returned 0x10 [0070.651] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.651] VarBstrCmp (bstrLeft="thunderbird.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.651] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0070.652] GetLastError () returned 0x0 [0070.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="totalcmd.exe") returned 260 [0070.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.652] CharLowerBuffW (in: lpsz="totalcmd.exe", cchLength=0xd | out: lpsz="totalcmd.exe") returned 0xd [0070.652] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.652] VarBstrCmp (bstrLeft="totalcmd.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.652] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0070.653] GetLastError () returned 0x0 [0070.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="trillian.exe") returned 260 [0070.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.653] CharLowerBuffW (in: lpsz="trillian.exe", cchLength=0xd | out: lpsz="trillian.exe") returned 0xd [0070.653] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.653] VarBstrCmp (bstrLeft="trillian.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.653] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0070.654] GetLastError () returned 0x0 [0070.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="webdrive.exe") returned 260 [0070.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.654] CharLowerBuffW (in: lpsz="webdrive.exe", cchLength=0xd | out: lpsz="webdrive.exe") returned 0xd [0070.654] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.654] VarBstrCmp (bstrLeft="webdrive.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.654] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0070.654] GetLastError () returned 0x0 [0070.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="whatsapp.exe") returned 260 [0070.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.655] CharLowerBuffW (in: lpsz="whatsapp.exe", cchLength=0xd | out: lpsz="whatsapp.exe") returned 0xd [0070.655] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.655] VarBstrCmp (bstrLeft="whatsapp.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.655] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0070.655] GetLastError () returned 0x0 [0070.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="winscp.exe") returned 260 [0070.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.656] CharLowerBuffW (in: lpsz="winscp.exe", cchLength=0xb | out: lpsz="winscp.exe") returned 0xb [0070.656] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.656] VarBstrCmp (bstrLeft="winscp.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.656] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0070.656] GetLastError () returned 0x0 [0070.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="yahoomessenger.exe") returned 260 [0070.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.656] CharLowerBuffW (in: lpsz="yahoomessenger.exe", cchLength=0x13 | out: lpsz="yahoomessenger.exe") returned 0x13 [0070.657] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.657] VarBstrCmp (bstrLeft="yahoomessenger.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.657] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0070.657] GetLastError () returned 0x0 [0070.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="active-charge.exe") returned 260 [0070.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.657] CharLowerBuffW (in: lpsz="active-charge.exe", cchLength=0x12 | out: lpsz="active-charge.exe") returned 0x12 [0070.658] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.658] VarBstrCmp (bstrLeft="active-charge.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.658] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0070.658] GetLastError () returned 0x0 [0070.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="accupos.exe") returned 260 [0070.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.659] CharLowerBuffW (in: lpsz="accupos.exe", cchLength=0xc | out: lpsz="accupos.exe") returned 0xc [0070.659] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.659] VarBstrCmp (bstrLeft="accupos.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.659] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0070.659] GetLastError () returned 0x0 [0070.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="afr38.exe") returned 260 [0070.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.660] CharLowerBuffW (in: lpsz="afr38.exe", cchLength=0xa | out: lpsz="afr38.exe") returned 0xa [0070.660] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.660] VarBstrCmp (bstrLeft="afr38.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.660] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0070.660] GetLastError () returned 0x0 [0070.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="aldelo.exe") returned 260 [0070.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.661] CharLowerBuffW (in: lpsz="aldelo.exe", cchLength=0xb | out: lpsz="aldelo.exe") returned 0xb [0070.661] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.661] VarBstrCmp (bstrLeft="aldelo.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.661] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0070.661] GetLastError () returned 0x0 [0070.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="ccv_server.exe") returned 260 [0070.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.661] CharLowerBuffW (in: lpsz="ccv_server.exe", cchLength=0xf | out: lpsz="ccv_server.exe") returned 0xf [0070.662] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.662] VarBstrCmp (bstrLeft="ccv_server.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.662] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0070.662] GetLastError () returned 0x0 [0070.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="centralcreditcard.exe") returned 260 [0070.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.662] CharLowerBuffW (in: lpsz="centralcreditcard.exe", cchLength=0x16 | out: lpsz="centralcreditcard.exe") returned 0x16 [0070.663] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.663] VarBstrCmp (bstrLeft="centralcreditcard.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.663] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0070.663] GetLastError () returned 0x0 [0070.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="creditservice.exe") returned 260 [0070.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.663] CharLowerBuffW (in: lpsz="creditservice.exe", cchLength=0x12 | out: lpsz="creditservice.exe") returned 0x12 [0070.663] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.663] VarBstrCmp (bstrLeft="creditservice.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.663] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0070.664] GetLastError () returned 0x0 [0070.664] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="edcsvr.exe") returned 260 [0070.664] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.664] CharLowerBuffW (in: lpsz="edcsvr.exe", cchLength=0xb | out: lpsz="edcsvr.exe") returned 0xb [0070.664] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.664] VarBstrCmp (bstrLeft="edcsvr.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.664] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0070.665] GetLastError () returned 0x0 [0070.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="fpos.exe") returned 260 [0070.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.665] CharLowerBuffW (in: lpsz="fpos.exe", cchLength=0x9 | out: lpsz="fpos.exe") returned 0x9 [0070.665] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.665] VarBstrCmp (bstrLeft="fpos.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.665] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0070.666] GetLastError () returned 0x0 [0070.666] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="isspos.exe") returned 260 [0070.666] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.666] CharLowerBuffW (in: lpsz="isspos.exe", cchLength=0xb | out: lpsz="isspos.exe") returned 0xb [0070.666] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.666] VarBstrCmp (bstrLeft="isspos.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.666] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0070.667] GetLastError () returned 0x0 [0070.667] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="mxslipstream.exe") returned 260 [0070.667] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.667] CharLowerBuffW (in: lpsz="mxslipstream.exe", cchLength=0x11 | out: lpsz="mxslipstream.exe") returned 0x11 [0070.667] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.667] VarBstrCmp (bstrLeft="mxslipstream.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.667] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0070.668] GetLastError () returned 0x0 [0070.668] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="omnipos.exe") returned 260 [0070.668] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.668] CharLowerBuffW (in: lpsz="omnipos.exe", cchLength=0xc | out: lpsz="omnipos.exe") returned 0xc [0070.668] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.668] VarBstrCmp (bstrLeft="omnipos.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.668] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0070.668] GetLastError () returned 0x0 [0070.668] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="spcwin.exe") returned 260 [0070.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.669] CharLowerBuffW (in: lpsz="spcwin.exe", cchLength=0xb | out: lpsz="spcwin.exe") returned 0xb [0070.669] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.669] VarBstrCmp (bstrLeft="spcwin.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.669] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0070.669] GetLastError () returned 0x0 [0070.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="spgagentservice.exe") returned 260 [0070.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.669] CharLowerBuffW (in: lpsz="spgagentservice.exe", cchLength=0x14 | out: lpsz="spgagentservice.exe") returned 0x14 [0070.670] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.670] VarBstrCmp (bstrLeft="spgagentservice.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.670] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0070.670] GetLastError () returned 0x0 [0070.670] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="utg2.exe") returned 260 [0070.670] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.670] CharLowerBuffW (in: lpsz="utg2.exe", cchLength=0x9 | out: lpsz="utg2.exe") returned 0x9 [0070.670] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.670] VarBstrCmp (bstrLeft="utg2.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.670] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notify native.exe")) returned 1 [0070.671] GetLastError () returned 0x0 [0070.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="notify native.exe") returned 260 [0070.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.671] CharLowerBuffW (in: lpsz="notify native.exe", cchLength=0x12 | out: lpsz="notify native.exe") returned 0x12 [0070.671] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.671] VarBstrCmp (bstrLeft="notify native.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.671] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="holland_resulted_plot.exe")) returned 1 [0070.672] GetLastError () returned 0x0 [0070.672] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="holland_resulted_plot.exe") returned 260 [0070.672] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.672] CharLowerBuffW (in: lpsz="holland_resulted_plot.exe", cchLength=0x1a | out: lpsz="holland_resulted_plot.exe") returned 0x1a [0070.672] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.672] VarBstrCmp (bstrLeft="land_resulted_plot.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.672] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0070.672] GetLastError () returned 0x0 [0070.672] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0070.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.673] CharLowerBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xd | out: lpsz="wmiprvse.exe") returned 0xd [0070.673] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.673] VarBstrCmp (bstrLeft="wmiprvse.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.673] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0070.673] GetLastError () returned 0x0 [0070.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0070.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.673] CharLowerBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xd | out: lpsz="wmiprvse.exe") returned 0xd [0070.673] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.674] VarBstrCmp (bstrLeft="wmiprvse.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.674] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.674] GetLastError () returned 0x0 [0070.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0070.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.674] CharLowerBuffW (in: lpsz="taskhost.exe", cchLength=0xd | out: lpsz="taskhost.exe") returned 0xd [0070.674] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.674] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.674] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zhang.exe")) returned 1 [0070.675] GetLastError () returned 0x0 [0070.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="zhang.exe") returned 260 [0070.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.675] CharLowerBuffW (in: lpsz="zhang.exe", cchLength=0xa | out: lpsz="zhang.exe") returned 0xa [0070.675] CharLowerBuffW (in: lpsz="dynamics_diversity.exe", cchLength=0x17 | out: lpsz="dynamics_diversity.exe") returned 0x17 [0070.675] VarBstrCmp (bstrLeft="zhang.exe", bstrRight="dynamics_diversity.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.675] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zhang.exe")) returned 0 [0070.675] GetLastError () returned 0x12 [0070.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="zhang.exe") returned 260 [0070.676] CloseHandle (hObject=0x1b4) returned 1 [0070.676] GetLastError () returned 0x0 [0070.676] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.676] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.676] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.676] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.676] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.676] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.676] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.676] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.676] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.676] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.676] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.676] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.676] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.677] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.677] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.677] GetCurrentThreadId () returned 0xa94 [0070.677] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.677] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.677] GetCurrentThreadId () returned 0xa94 [0070.677] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.677] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.677] GetCurrentThreadId () returned 0xa94 [0070.677] GetCurrentThreadId () returned 0xa94 [0070.677] GetCurrentThreadId () returned 0xa94 [0070.677] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.677] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.678] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.727] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.727] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.727] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0070.727] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0070.727] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0070.727] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.727] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.727] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.727] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.727] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.727] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.727] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.728] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.728] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.728] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.728] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.728] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.728] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.728] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.728] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.728] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.728] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.728] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.729] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.730] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.730] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.730] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.730] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.730] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.730] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.730] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.731] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.731] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.731] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.731] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.731] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.731] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.731] GetCurrentThreadId () returned 0xa94 [0070.731] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.731] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Photo Viewer\\building.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.731] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.731] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.732] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.732] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.732] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.732] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.732] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.732] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.732] GetCurrentThreadId () returned 0xa94 [0070.732] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.732] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Photo Viewer\\building.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.732] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.732] CharLowerBuffW (in: lpsz="C:\\Program Files (x86)\\Windows Photo Viewer\\building.exe", cchLength=0x39 | out: lpsz="c:\\program files (x86)\\windows photo viewer\\building.exe") returned 0x39 [0070.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0070.734] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.734] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.734] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.734] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfb24, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.734] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.734] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.734] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0070.734] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0070.734] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0070.734] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0070.735] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0070.735] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0070.736] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x6) returned 0x1677628 [0070.736] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167c638 | out: hHeap=0x1660000) returned 1 [0070.736] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167c610 | out: hHeap=0x1660000) returned 1 [0070.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0070.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x2f86e4, cchWideChar=6 | out: lpWideCharStr="zhang") returned 6 [0070.736] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1677628 | out: hHeap=0x1660000) returned 1 [0070.736] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.736] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.736] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0070.736] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0070.736] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.736] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.736] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.736] SysStringLen (param_1="Name") returned 0x4 [0070.737] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0070.737] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0070.737] SysStringLen (param_1="Name") returned 0x4 [0070.737] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.737] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.737] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.737] GetCurrentThreadId () returned 0xa94 [0070.737] SysStringLen (param_1="Name") returned 0x4 [0070.737] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="building.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.737] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.738] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.738] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.738] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.738] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0070.738] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0070.738] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0070.738] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.738] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.738] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.738] GetCurrentThreadId () returned 0xa94 [0070.738] SysStringLen (param_1="Name") returned 0x4 [0070.739] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="building.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.739] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0070.739] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0070.739] GetLastError () returned 0x0 [0070.739] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpWideCharStr=0x18eb7c, cchWideChar=128 | out: lpWideCharStr="Service Pack 1") returned 128 [0070.739] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0070.744] GetLastError () returned 0x0 [0070.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=260, lpMultiByteStr=0x18e8d8, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 260 [0070.744] Process32First (in: hSnapshot=0x1b4, lppe=0x18e8b4 | out: lppe=0x18e8b4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0070.744] GetLastError () returned 0x0 [0070.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e8d8, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="[System Process]") returned 260 [0070.745] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.745] CharLowerBuffW (in: lpsz="[System Process]", cchLength=0x11 | out: lpsz="[system process]") returned 0x11 [0070.745] CharLowerBuffW (in: lpsz="building.exe", cchLength=0xd | out: lpsz="building.exe") returned 0xd [0070.745] VarBstrCmp (bstrLeft="tem process]", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.745] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0070.745] GetLastError () returned 0x0 [0070.745] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="System") returned 260 [0070.745] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.745] CharLowerBuffW (in: lpsz="System", cchLength=0x7 | out: lpsz="system") returned 0x7 [0070.746] CharLowerBuffW (in: lpsz="building.exe", cchLength=0xd | out: lpsz="building.exe") returned 0xd [0070.746] VarBstrCmp (bstrLeft="system", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.746] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0070.746] GetLastError () returned 0x0 [0070.746] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="smss.exe") returned 260 [0070.746] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.746] CharLowerBuffW (in: lpsz="smss.exe", cchLength=0x9 | out: lpsz="smss.exe") returned 0x9 [0070.746] CharLowerBuffW (in: lpsz="building.exe", cchLength=0xd | out: lpsz="building.exe") returned 0xd [0070.746] VarBstrCmp (bstrLeft="smss.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.746] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.747] GetLastError () returned 0x0 [0070.747] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0070.747] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.747] CharLowerBuffW (in: lpsz="csrss.exe", cchLength=0xa | out: lpsz="csrss.exe") returned 0xa [0070.747] CharLowerBuffW (in: lpsz="building.exe", cchLength=0xd | out: lpsz="building.exe") returned 0xd [0070.747] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.747] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0070.748] GetLastError () returned 0x0 [0070.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="wininit.exe") returned 260 [0070.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.748] CharLowerBuffW (in: lpsz="wininit.exe", cchLength=0xc | out: lpsz="wininit.exe") returned 0xc [0070.748] CharLowerBuffW (in: lpsz="building.exe", cchLength=0xd | out: lpsz="building.exe") returned 0xd [0070.748] VarBstrCmp (bstrLeft="wininit.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.748] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.748] GetLastError () returned 0x0 [0070.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0070.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.749] CharLowerBuffW (in: lpsz="csrss.exe", cchLength=0xa | out: lpsz="csrss.exe") returned 0xa [0070.749] CharLowerBuffW (in: lpsz="building.exe", cchLength=0xd | out: lpsz="building.exe") returned 0xd [0070.749] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.749] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0070.749] GetLastError () returned 0x0 [0070.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="winlogon.exe") returned 260 [0070.750] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.750] CharLowerBuffW (in: lpsz="winlogon.exe", cchLength=0xd | out: lpsz="winlogon.exe") returned 0xd [0070.750] CharLowerBuffW (in: lpsz="building.exe", cchLength=0xd | out: lpsz="building.exe") returned 0xd [0070.750] VarBstrCmp (bstrLeft="winlogon.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.750] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0070.750] GetLastError () returned 0x0 [0070.750] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="services.exe") returned 260 [0070.750] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.750] CharLowerBuffW (in: lpsz="services.exe", cchLength=0xd | out: lpsz="services.exe") returned 0xd [0070.751] CharLowerBuffW (in: lpsz="building.exe", cchLength=0xd | out: lpsz="building.exe") returned 0xd [0070.751] VarBstrCmp (bstrLeft="services.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.751] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0070.751] GetLastError () returned 0x0 [0070.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="lsass.exe") returned 260 [0070.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.751] CharLowerBuffW (in: lpsz="lsass.exe", cchLength=0xa | out: lpsz="lsass.exe") returned 0xa [0070.751] CharLowerBuffW (in: lpsz="building.exe", cchLength=0xd | out: lpsz="building.exe") returned 0xd [0070.751] VarBstrCmp (bstrLeft="lsass.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.752] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0070.752] GetLastError () returned 0x0 [0070.752] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="lsm.exe") returned 260 [0070.752] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.752] CharLowerBuffW (in: lpsz="lsm.exe", cchLength=0x8 | out: lpsz="lsm.exe") returned 0x8 [0070.752] CharLowerBuffW (in: lpsz="building.exe", cchLength=0xd | out: lpsz="building.exe") returned 0xd [0070.752] VarBstrCmp (bstrLeft="lsm.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.752] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.753] GetLastError () returned 0x0 [0070.753] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.753] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.753] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0070.753] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.753] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.754] GetLastError () returned 0x0 [0070.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.754] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.754] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.755] GetLastError () returned 0x0 [0070.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.755] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.755] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.755] GetLastError () returned 0x0 [0070.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.756] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.756] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.757] GetLastError () returned 0x0 [0070.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.757] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.757] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0070.757] GetLastError () returned 0x0 [0070.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="audiodg.exe") returned 260 [0070.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.758] VarBstrCmp (bstrLeft="audiodg.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.758] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.758] GetLastError () returned 0x0 [0070.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.759] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.759] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.759] GetLastError () returned 0x0 [0070.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.760] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.760] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0070.760] GetLastError () returned 0x0 [0070.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="dwm.exe") returned 260 [0070.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.761] VarBstrCmp (bstrLeft="dwm.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.761] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0070.761] GetLastError () returned 0x0 [0070.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="explorer.exe") returned 260 [0070.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.762] VarBstrCmp (bstrLeft="explorer.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.762] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0070.762] GetLastError () returned 0x0 [0070.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="spoolsv.exe") returned 260 [0070.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.762] VarBstrCmp (bstrLeft="spoolsv.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.762] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.763] GetLastError () returned 0x0 [0070.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.763] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.763] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.764] GetLastError () returned 0x0 [0070.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0070.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.764] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.764] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0070.764] GetLastError () returned 0x0 [0070.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="taskeng.exe") returned 260 [0070.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.765] VarBstrCmp (bstrLeft="taskeng.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.765] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="building.exe")) returned 1 [0070.765] GetLastError () returned 0x0 [0070.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="building.exe") returned 260 [0070.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.765] VarBstrCmp (bstrLeft="building.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x1 [0070.766] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0070.769] GetLastError () returned 0x0 [0070.769] CloseHandle (hObject=0x1b8) returned 1 [0070.769] GetLastError () returned 0x0 [0070.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="building.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="building.exe", lpUsedDefaultChar=0x0) returned 260 [0070.769] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ap_chuck.exe")) returned 1 [0070.769] GetLastError () returned 0x0 [0070.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="ap_chuck.exe") returned 260 [0070.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.770] VarBstrCmp (bstrLeft="ap_chuck.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.770] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bathroom.exe")) returned 1 [0070.770] GetLastError () returned 0x0 [0070.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="bathroom.exe") returned 260 [0070.771] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.771] VarBstrCmp (bstrLeft="bathroom.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.771] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="differ.exe")) returned 1 [0070.771] GetLastError () returned 0x0 [0070.771] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="differ.exe") returned 260 [0070.772] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.772] VarBstrCmp (bstrLeft="differ.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.772] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="criticismhopkins.exe")) returned 1 [0070.772] GetLastError () returned 0x0 [0070.772] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="criticismhopkins.exe") returned 260 [0070.773] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.773] VarBstrCmp (bstrLeft="mhopkins.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.773] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="season_robinson.exe")) returned 1 [0070.773] GetLastError () returned 0x0 [0070.773] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="season_robinson.exe") returned 260 [0070.773] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.773] VarBstrCmp (bstrLeft="robinson.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.774] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="septemberderived.exe")) returned 1 [0070.774] GetLastError () returned 0x0 [0070.774] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="septemberderived.exe") returned 260 [0070.774] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.774] VarBstrCmp (bstrLeft="rderived.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.774] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coffee.exe")) returned 1 [0070.775] GetLastError () returned 0x0 [0070.775] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="coffee.exe") returned 260 [0070.775] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.775] VarBstrCmp (bstrLeft="coffee.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.775] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="analyzed.exe")) returned 1 [0070.776] GetLastError () returned 0x0 [0070.776] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="analyzed.exe") returned 260 [0070.776] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.776] VarBstrCmp (bstrLeft="analyzed.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.776] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="speaks deborah period.exe")) returned 1 [0070.777] GetLastError () returned 0x0 [0070.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="speaks deborah period.exe") returned 260 [0070.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.777] VarBstrCmp (bstrLeft="h period.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.777] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="carlo equipment linux.exe")) returned 1 [0070.778] GetLastError () returned 0x0 [0070.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="carlo equipment linux.exe") returned 260 [0070.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.778] VarBstrCmp (bstrLeft="nt linux.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.778] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hungaccounting.exe")) returned 1 [0070.779] GetLastError () returned 0x0 [0070.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="hungaccounting.exe") returned 260 [0070.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.779] VarBstrCmp (bstrLeft="counting.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.779] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="astrologylooksmartwidely.exe")) returned 1 [0070.779] GetLastError () returned 0x0 [0070.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="astrologylooksmartwidely.exe") returned 260 [0070.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.780] VarBstrCmp (bstrLeft="rtwidely.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.780] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0070.780] GetLastError () returned 0x0 [0070.780] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="suburban.exe") returned 260 [0070.780] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.780] VarBstrCmp (bstrLeft="suburban.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.780] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="triangle.exe")) returned 1 [0070.781] GetLastError () returned 0x0 [0070.781] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="triangle.exe") returned 260 [0070.781] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.781] VarBstrCmp (bstrLeft="triangle.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.781] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mild.exe")) returned 1 [0070.782] GetLastError () returned 0x0 [0070.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="mild.exe") returned 260 [0070.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.782] VarBstrCmp (bstrLeft="mild.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.782] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="by-bubble-hi.exe")) returned 1 [0070.782] GetLastError () returned 0x0 [0070.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="by-bubble-hi.exe") returned 260 [0070.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.783] VarBstrCmp (bstrLeft="ubble-hi.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.783] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0070.783] GetLastError () returned 0x0 [0070.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="3dftp.exe") returned 260 [0070.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.783] VarBstrCmp (bstrLeft="3dftp.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.784] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0070.784] GetLastError () returned 0x0 [0070.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="absolutetelnet.exe") returned 260 [0070.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.784] VarBstrCmp (bstrLeft="tetelnet.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.784] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0070.785] GetLastError () returned 0x0 [0070.785] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="alftp.exe") returned 260 [0070.785] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.785] VarBstrCmp (bstrLeft="alftp.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.785] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0070.785] GetLastError () returned 0x0 [0070.785] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="barca.exe") returned 260 [0070.786] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.786] VarBstrCmp (bstrLeft="barca.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.786] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0070.786] GetLastError () returned 0x0 [0070.786] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="bitkinex.exe") returned 260 [0070.786] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.786] VarBstrCmp (bstrLeft="bitkinex.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.786] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x670, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0070.787] GetLastError () returned 0x0 [0070.787] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="coreftp.exe") returned 260 [0070.787] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.787] VarBstrCmp (bstrLeft="coreftp.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.787] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0070.787] GetLastError () returned 0x0 [0070.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="far.exe") returned 260 [0070.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.788] VarBstrCmp (bstrLeft="far.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.788] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0070.788] GetLastError () returned 0x0 [0070.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="filezilla.exe") returned 260 [0070.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.788] VarBstrCmp (bstrLeft="ilezilla.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.788] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0070.789] GetLastError () returned 0x0 [0070.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="flashfxp.exe") returned 260 [0070.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.789] VarBstrCmp (bstrLeft="flashfxp.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.789] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0070.790] GetLastError () returned 0x0 [0070.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="fling.exe") returned 260 [0070.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.790] VarBstrCmp (bstrLeft="fling.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.790] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0070.790] GetLastError () returned 0x0 [0070.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="foxmailincmail.exe") returned 260 [0070.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.791] VarBstrCmp (bstrLeft="lincmail.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.791] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0070.791] GetLastError () returned 0x0 [0070.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="gmailnotifierpro.exe") returned 260 [0070.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.791] VarBstrCmp (bstrLeft="ifierpro.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.791] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0070.792] GetLastError () returned 0x0 [0070.792] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="icq.exe") returned 260 [0070.792] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.792] VarBstrCmp (bstrLeft="icq.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.792] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0070.792] GetLastError () returned 0x0 [0070.792] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="leechftp.exe") returned 260 [0070.792] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.792] VarBstrCmp (bstrLeft="leechftp.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.792] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0070.793] GetLastError () returned 0x0 [0070.793] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="ncftp.exe") returned 260 [0070.793] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.793] VarBstrCmp (bstrLeft="ncftp.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.793] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0070.793] GetLastError () returned 0x0 [0070.793] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="notepad.exe") returned 260 [0070.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.794] VarBstrCmp (bstrLeft="notepad.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.794] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0070.794] GetLastError () returned 0x0 [0070.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="operamail.exe") returned 260 [0070.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.794] VarBstrCmp (bstrLeft="peramail.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.794] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0070.795] GetLastError () returned 0x0 [0070.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="outlook.exe") returned 260 [0070.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.795] VarBstrCmp (bstrLeft="outlook.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.795] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0070.796] GetLastError () returned 0x0 [0070.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="pidgin.exe") returned 260 [0070.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.796] VarBstrCmp (bstrLeft="pidgin.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.796] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0070.796] GetLastError () returned 0x0 [0070.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="scriptftp.exe") returned 260 [0070.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.797] VarBstrCmp (bstrLeft="criptftp.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.797] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0070.797] GetLastError () returned 0x0 [0070.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="skype.exe") returned 260 [0070.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.797] VarBstrCmp (bstrLeft="skype.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.797] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0070.798] GetLastError () returned 0x0 [0070.798] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="smartftp.exe") returned 260 [0070.798] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.798] VarBstrCmp (bstrLeft="smartftp.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.798] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0070.799] GetLastError () returned 0x0 [0070.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="thunderbird.exe") returned 260 [0070.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.799] VarBstrCmp (bstrLeft="nderbird.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.799] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0070.799] GetLastError () returned 0x0 [0070.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="totalcmd.exe") returned 260 [0070.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.800] VarBstrCmp (bstrLeft="totalcmd.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.800] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0070.800] GetLastError () returned 0x0 [0070.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="trillian.exe") returned 260 [0070.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.800] VarBstrCmp (bstrLeft="trillian.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.801] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0070.801] GetLastError () returned 0x0 [0070.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="webdrive.exe") returned 260 [0070.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.801] VarBstrCmp (bstrLeft="webdrive.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.801] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0070.802] GetLastError () returned 0x0 [0070.802] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="whatsapp.exe") returned 260 [0070.802] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.802] VarBstrCmp (bstrLeft="whatsapp.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.802] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0070.802] GetLastError () returned 0x0 [0070.809] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="winscp.exe") returned 260 [0070.809] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.809] VarBstrCmp (bstrLeft="winscp.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.809] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0070.810] GetLastError () returned 0x0 [0070.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="yahoomessenger.exe") returned 260 [0070.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.810] VarBstrCmp (bstrLeft="essenger.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.810] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0070.810] GetLastError () returned 0x0 [0070.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="active-charge.exe") returned 260 [0070.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.811] VarBstrCmp (bstrLeft="e-charge.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.811] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0070.811] GetLastError () returned 0x0 [0070.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="accupos.exe") returned 260 [0070.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.812] VarBstrCmp (bstrLeft="accupos.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.812] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0070.812] GetLastError () returned 0x0 [0070.812] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="afr38.exe") returned 260 [0070.812] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.812] VarBstrCmp (bstrLeft="afr38.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.812] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0070.813] GetLastError () returned 0x0 [0070.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="aldelo.exe") returned 260 [0070.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.813] VarBstrCmp (bstrLeft="aldelo.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.813] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0070.814] GetLastError () returned 0x0 [0070.814] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="ccv_server.exe") returned 260 [0070.814] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.814] VarBstrCmp (bstrLeft="v_server.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.814] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0070.814] GetLastError () returned 0x0 [0070.814] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="centralcreditcard.exe") returned 260 [0070.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.815] VarBstrCmp (bstrLeft="editcard.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.815] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0070.815] GetLastError () returned 0x0 [0070.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="creditservice.exe") returned 260 [0070.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.815] VarBstrCmp (bstrLeft="tservice.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.815] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0070.816] GetLastError () returned 0x0 [0070.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="edcsvr.exe") returned 260 [0070.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.816] VarBstrCmp (bstrLeft="edcsvr.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.816] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0070.817] GetLastError () returned 0x0 [0070.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="fpos.exe") returned 260 [0070.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.817] VarBstrCmp (bstrLeft="fpos.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.817] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0070.818] GetLastError () returned 0x0 [0070.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="isspos.exe") returned 260 [0070.818] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.818] VarBstrCmp (bstrLeft="isspos.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.818] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0070.818] GetLastError () returned 0x0 [0070.819] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="mxslipstream.exe") returned 260 [0070.819] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.819] VarBstrCmp (bstrLeft="ipstream.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.819] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0070.819] GetLastError () returned 0x0 [0070.819] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="omnipos.exe") returned 260 [0070.819] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.820] VarBstrCmp (bstrLeft="omnipos.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.820] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0070.820] GetLastError () returned 0x0 [0070.820] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="spcwin.exe") returned 260 [0070.820] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.820] VarBstrCmp (bstrLeft="spcwin.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.820] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0070.821] GetLastError () returned 0x0 [0070.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="spgagentservice.exe") returned 260 [0070.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.821] VarBstrCmp (bstrLeft="tservice.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.821] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0070.821] GetLastError () returned 0x0 [0070.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="utg2.exe") returned 260 [0070.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.822] VarBstrCmp (bstrLeft="utg2.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.822] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notify native.exe")) returned 1 [0070.822] GetLastError () returned 0x0 [0070.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="notify native.exe") returned 260 [0070.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.822] VarBstrCmp (bstrLeft="y native.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.822] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="holland_resulted_plot.exe")) returned 1 [0070.823] GetLastError () returned 0x0 [0070.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="holland_resulted_plot.exe") returned 260 [0070.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.823] VarBstrCmp (bstrLeft="ted_plot.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.823] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0070.823] GetLastError () returned 0x0 [0070.823] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0070.824] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.824] VarBstrCmp (bstrLeft="wmiprvse.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.824] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0070.824] GetLastError () returned 0x0 [0070.824] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0070.824] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.824] VarBstrCmp (bstrLeft="wmiprvse.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.824] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.825] GetLastError () returned 0x0 [0070.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0070.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.825] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.825] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zhang.exe")) returned 1 [0070.825] GetLastError () returned 0x0 [0070.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="zhang.exe") returned 260 [0070.826] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f8714, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.826] VarBstrCmp (bstrLeft="zhang.exe", bstrRight="building.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.826] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zhang.exe")) returned 0 [0070.826] GetLastError () returned 0x12 [0070.826] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="zhang.exe") returned 260 [0070.826] CloseHandle (hObject=0x1b4) returned 1 [0070.826] GetLastError () returned 0x0 [0070.826] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.826] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.826] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.827] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.827] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.827] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.827] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.827] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.827] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.827] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.827] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.827] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.827] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.827] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.827] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.827] GetCurrentThreadId () returned 0xa94 [0070.827] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.827] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.827] GetCurrentThreadId () returned 0xa94 [0070.827] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.827] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.828] GetCurrentThreadId () returned 0xa94 [0070.828] GetCurrentThreadId () returned 0xa94 [0070.828] GetCurrentThreadId () returned 0xa94 [0070.828] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.828] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.828] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.830] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.830] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.830] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0070.830] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0070.830] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0070.830] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.830] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.830] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.830] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.830] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.830] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.830] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.830] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.830] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.831] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.831] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.831] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.831] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.831] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.831] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.831] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.831] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.831] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.831] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.833] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.833] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.833] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.833] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.833] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.833] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.833] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.833] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.833] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.833] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.833] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.834] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.834] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.834] GetCurrentThreadId () returned 0xa94 [0070.834] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.834] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\ap_chuck.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.834] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.834] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.834] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.835] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.835] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.835] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.835] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.835] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.835] GetCurrentThreadId () returned 0xa94 [0070.835] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.835] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\ap_chuck.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.835] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.835] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.835] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.835] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.836] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfb24, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.836] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.836] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.836] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0070.836] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0070.836] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0070.836] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0070.836] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0070.837] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x6) returned 0x1677628 [0070.837] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167c638 | out: hHeap=0x1660000) returned 1 [0070.837] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167c610 | out: hHeap=0x1660000) returned 1 [0070.837] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0070.837] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x2fd054, cchWideChar=6 | out: lpWideCharStr="zhang") returned 6 [0070.837] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1677628 | out: hHeap=0x1660000) returned 1 [0070.837] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.837] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.838] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0070.838] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0070.838] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.838] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.838] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.838] SysStringLen (param_1="Name") returned 0x4 [0070.838] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0070.838] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0070.838] SysStringLen (param_1="Name") returned 0x4 [0070.838] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.838] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.838] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.838] GetCurrentThreadId () returned 0xa94 [0070.838] SysStringLen (param_1="Name") returned 0x4 [0070.839] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ap_chuck.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.839] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.839] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.839] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.839] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.839] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0070.839] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0070.839] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0070.839] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.839] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.839] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.839] GetCurrentThreadId () returned 0xa94 [0070.839] SysStringLen (param_1="Name") returned 0x4 [0070.840] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ap_chuck.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.840] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0070.840] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0070.840] GetLastError () returned 0x0 [0070.840] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpWideCharStr=0x18eb7c, cchWideChar=128 | out: lpWideCharStr="Service Pack 1") returned 128 [0070.840] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0070.843] GetLastError () returned 0x0 [0070.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=260, lpMultiByteStr=0x18e8d8, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 260 [0070.844] Process32First (in: hSnapshot=0x1b4, lppe=0x18e8b4 | out: lppe=0x18e8b4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0070.844] GetLastError () returned 0x0 [0070.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e8d8, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="[System Process]") returned 260 [0070.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.844] VarBstrCmp (bstrLeft="tem process]", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.852] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0070.853] GetLastError () returned 0x0 [0070.853] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="System") returned 260 [0070.853] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.853] VarBstrCmp (bstrLeft="system", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.853] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0070.854] GetLastError () returned 0x0 [0070.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="smss.exe") returned 260 [0070.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.854] VarBstrCmp (bstrLeft="smss.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.854] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.855] GetLastError () returned 0x0 [0070.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0070.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.855] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.855] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0070.855] GetLastError () returned 0x0 [0070.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="wininit.exe") returned 260 [0070.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.856] VarBstrCmp (bstrLeft="wininit.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.856] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.856] GetLastError () returned 0x0 [0070.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0070.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.856] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.856] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0070.857] GetLastError () returned 0x0 [0070.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="winlogon.exe") returned 260 [0070.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.857] VarBstrCmp (bstrLeft="winlogon.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.857] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0070.857] GetLastError () returned 0x0 [0070.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="services.exe") returned 260 [0070.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.858] VarBstrCmp (bstrLeft="services.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.858] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0070.858] GetLastError () returned 0x0 [0070.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="lsass.exe") returned 260 [0070.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.858] VarBstrCmp (bstrLeft="lsass.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.858] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0070.859] GetLastError () returned 0x0 [0070.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="lsm.exe") returned 260 [0070.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.859] VarBstrCmp (bstrLeft="lsm.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.859] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.859] GetLastError () returned 0x0 [0070.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.859] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.859] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.860] GetLastError () returned 0x0 [0070.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.860] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.860] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.860] GetLastError () returned 0x0 [0070.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.861] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.861] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.861] GetLastError () returned 0x0 [0070.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.861] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.861] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.862] GetLastError () returned 0x0 [0070.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.862] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.862] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0070.862] GetLastError () returned 0x0 [0070.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="audiodg.exe") returned 260 [0070.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0070.863] VarBstrCmp (bstrLeft="audiodg.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.863] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.863] GetLastError () returned 0x0 [0070.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.863] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.863] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.863] GetLastError () returned 0x0 [0070.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.864] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.864] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0070.864] GetLastError () returned 0x0 [0070.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="dwm.exe") returned 260 [0070.864] VarBstrCmp (bstrLeft="dwm.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.864] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0070.864] GetLastError () returned 0x0 [0070.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="explorer.exe") returned 260 [0070.865] VarBstrCmp (bstrLeft="explorer.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.865] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0070.865] GetLastError () returned 0x0 [0070.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="spoolsv.exe") returned 260 [0070.865] VarBstrCmp (bstrLeft="spoolsv.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.865] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.866] GetLastError () returned 0x0 [0070.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0070.866] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.866] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.866] GetLastError () returned 0x0 [0070.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0070.866] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.866] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0070.867] GetLastError () returned 0x0 [0070.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="taskeng.exe") returned 260 [0070.867] VarBstrCmp (bstrLeft="taskeng.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.867] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ap_chuck.exe")) returned 1 [0070.867] GetLastError () returned 0x0 [0070.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="ap_chuck.exe") returned 260 [0070.867] VarBstrCmp (bstrLeft="ap_chuck.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x1 [0070.867] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0070.872] GetLastError () returned 0x0 [0070.872] CloseHandle (hObject=0x1b8) returned 1 [0070.872] GetLastError () returned 0x0 [0070.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ap_chuck.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ap_chuck.exe", lpUsedDefaultChar=0x0) returned 260 [0070.872] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bathroom.exe")) returned 1 [0070.872] GetLastError () returned 0x0 [0070.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="bathroom.exe") returned 260 [0070.872] VarBstrCmp (bstrLeft="bathroom.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.872] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="differ.exe")) returned 1 [0070.873] GetLastError () returned 0x0 [0070.873] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="differ.exe") returned 260 [0070.873] VarBstrCmp (bstrLeft="differ.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.873] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="criticismhopkins.exe")) returned 1 [0070.873] GetLastError () returned 0x0 [0070.873] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="criticismhopkins.exe") returned 260 [0070.873] VarBstrCmp (bstrLeft="mhopkins.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.873] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="season_robinson.exe")) returned 1 [0070.874] GetLastError () returned 0x0 [0070.874] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="season_robinson.exe") returned 260 [0070.874] VarBstrCmp (bstrLeft="robinson.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.874] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="septemberderived.exe")) returned 1 [0070.874] GetLastError () returned 0x0 [0070.874] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="septemberderived.exe") returned 260 [0070.874] VarBstrCmp (bstrLeft="rderived.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.874] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coffee.exe")) returned 1 [0070.875] GetLastError () returned 0x0 [0070.875] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="coffee.exe") returned 260 [0070.875] VarBstrCmp (bstrLeft="coffee.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.875] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="analyzed.exe")) returned 1 [0070.875] GetLastError () returned 0x0 [0070.875] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="analyzed.exe") returned 260 [0070.875] VarBstrCmp (bstrLeft="analyzed.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.875] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="speaks deborah period.exe")) returned 1 [0070.876] GetLastError () returned 0x0 [0070.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="speaks deborah period.exe") returned 260 [0070.876] VarBstrCmp (bstrLeft="h period.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.876] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="carlo equipment linux.exe")) returned 1 [0070.876] GetLastError () returned 0x0 [0070.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="carlo equipment linux.exe") returned 260 [0070.876] VarBstrCmp (bstrLeft="nt linux.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.876] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hungaccounting.exe")) returned 1 [0070.877] GetLastError () returned 0x0 [0070.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="hungaccounting.exe") returned 260 [0070.877] VarBstrCmp (bstrLeft="counting.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.877] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="astrologylooksmartwidely.exe")) returned 1 [0070.877] GetLastError () returned 0x0 [0070.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="astrologylooksmartwidely.exe") returned 260 [0070.877] VarBstrCmp (bstrLeft="rtwidely.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.877] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suburban.exe")) returned 1 [0070.878] GetLastError () returned 0x0 [0070.878] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="suburban.exe") returned 260 [0070.878] VarBstrCmp (bstrLeft="suburban.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.878] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="triangle.exe")) returned 1 [0070.878] GetLastError () returned 0x0 [0070.878] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="triangle.exe") returned 260 [0070.878] VarBstrCmp (bstrLeft="triangle.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.878] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mild.exe")) returned 1 [0070.879] GetLastError () returned 0x0 [0070.879] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="mild.exe") returned 260 [0070.879] VarBstrCmp (bstrLeft="mild.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.879] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="by-bubble-hi.exe")) returned 1 [0070.879] GetLastError () returned 0x0 [0070.879] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="by-bubble-hi.exe") returned 260 [0070.879] VarBstrCmp (bstrLeft="ubble-hi.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.879] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0070.880] GetLastError () returned 0x0 [0070.880] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="3dftp.exe") returned 260 [0070.880] VarBstrCmp (bstrLeft="3dftp.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.880] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0070.880] GetLastError () returned 0x0 [0070.880] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="absolutetelnet.exe") returned 260 [0070.880] VarBstrCmp (bstrLeft="tetelnet.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.880] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0070.880] GetLastError () returned 0x0 [0070.881] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="alftp.exe") returned 260 [0070.881] VarBstrCmp (bstrLeft="alftp.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.881] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0070.881] GetLastError () returned 0x0 [0070.881] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="barca.exe") returned 260 [0070.881] VarBstrCmp (bstrLeft="barca.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.881] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0070.882] GetLastError () returned 0x0 [0070.882] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="bitkinex.exe") returned 260 [0070.882] VarBstrCmp (bstrLeft="bitkinex.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.882] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x670, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0070.882] GetLastError () returned 0x0 [0070.882] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="coreftp.exe") returned 260 [0070.882] VarBstrCmp (bstrLeft="coreftp.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.882] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0070.883] GetLastError () returned 0x0 [0070.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="far.exe") returned 260 [0070.883] VarBstrCmp (bstrLeft="far.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.883] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0070.883] GetLastError () returned 0x0 [0070.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="filezilla.exe") returned 260 [0070.883] VarBstrCmp (bstrLeft="ilezilla.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.883] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0070.884] GetLastError () returned 0x0 [0070.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="flashfxp.exe") returned 260 [0070.884] VarBstrCmp (bstrLeft="flashfxp.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.884] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0070.884] VarBstrCmp (bstrLeft="fling.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.884] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0070.885] VarBstrCmp (bstrLeft="lincmail.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.885] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0070.885] VarBstrCmp (bstrLeft="ifierpro.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.885] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0070.885] VarBstrCmp (bstrLeft="icq.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.886] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0070.886] VarBstrCmp (bstrLeft="leechftp.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.886] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0070.886] VarBstrCmp (bstrLeft="ncftp.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.886] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0070.887] VarBstrCmp (bstrLeft="notepad.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.887] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0070.887] VarBstrCmp (bstrLeft="peramail.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.887] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0070.888] VarBstrCmp (bstrLeft="outlook.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.888] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0070.888] VarBstrCmp (bstrLeft="pidgin.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.888] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0070.889] VarBstrCmp (bstrLeft="criptftp.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.889] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0070.889] VarBstrCmp (bstrLeft="skype.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.889] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0070.890] VarBstrCmp (bstrLeft="smartftp.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.890] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0070.890] VarBstrCmp (bstrLeft="nderbird.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.890] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0070.891] VarBstrCmp (bstrLeft="totalcmd.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.891] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0070.891] VarBstrCmp (bstrLeft="trillian.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.891] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0070.892] VarBstrCmp (bstrLeft="webdrive.exe", bstrRight="ap_chuck.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0070.892] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0070.892] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0070.918] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.918] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.918] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.919] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.919] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.919] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.919] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.919] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.919] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.919] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.919] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.919] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.919] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.919] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.919] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.919] GetCurrentThreadId () returned 0xa94 [0070.919] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.919] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.919] GetCurrentThreadId () returned 0xa94 [0070.920] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.920] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.920] GetCurrentThreadId () returned 0xa94 [0070.920] GetCurrentThreadId () returned 0xa94 [0070.920] GetCurrentThreadId () returned 0xa94 [0070.920] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.920] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.920] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.922] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.922] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.922] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0070.922] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0070.922] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0070.922] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.922] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.922] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.922] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.923] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.923] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.923] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.923] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.923] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.923] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.923] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.923] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.923] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.923] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.923] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.923] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.924] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.924] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.924] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.925] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.926] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.926] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.926] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.926] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.926] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.926] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.926] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.926] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.926] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.926] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.927] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.927] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.927] GetCurrentThreadId () returned 0xa94 [0070.927] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.927] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\bathroom.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.927] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.927] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.928] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.928] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.928] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.928] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.928] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.928] GetCurrentThreadId () returned 0xa94 [0070.928] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.928] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\bathroom.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.929] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.929] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.929] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.929] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfb24, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.929] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.929] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.929] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0070.930] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0070.930] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0070.930] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0070.930] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0070.931] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x6) returned 0x1677628 [0070.931] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167c638 | out: hHeap=0x1660000) returned 1 [0070.931] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167c610 | out: hHeap=0x1660000) returned 1 [0070.931] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0070.931] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x2fd0a4, cchWideChar=6 | out: lpWideCharStr="zhang") returned 6 [0070.931] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1677628 | out: hHeap=0x1660000) returned 1 [0070.931] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.931] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.932] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0070.932] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0070.932] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.932] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.932] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.932] SysStringLen (param_1="Name") returned 0x4 [0070.932] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0070.932] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0070.932] SysStringLen (param_1="Name") returned 0x4 [0070.932] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.932] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.932] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.932] GetCurrentThreadId () returned 0xa94 [0070.933] SysStringLen (param_1="Name") returned 0x4 [0070.933] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bathroom.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.933] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.933] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.933] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.934] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0070.934] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0070.934] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0070.934] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.934] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.934] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.934] GetCurrentThreadId () returned 0xa94 [0070.934] SysStringLen (param_1="Name") returned 0x4 [0070.934] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bathroom.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.935] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0070.935] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0070.935] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0070.945] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0070.972] IUnknown:Release (This=0x4af2010) returned 0x1 [0070.972] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.972] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.972] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.972] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.972] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.972] IUnknown:Release (This=0x4af2010) returned 0x0 [0070.972] IUnknown:Release (This=0x2fb99c) returned 0x0 [0070.972] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.972] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.972] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.972] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.973] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.973] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0070.973] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.973] GetCurrentThreadId () returned 0xa94 [0070.973] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0070.973] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.973] GetCurrentThreadId () returned 0xa94 [0070.973] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0070.973] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0070.973] GetCurrentThreadId () returned 0xa94 [0070.973] GetCurrentThreadId () returned 0xa94 [0070.974] GetCurrentThreadId () returned 0xa94 [0070.974] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.974] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.974] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0070.976] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0070.976] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0070.976] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2468 [0070.976] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24d8 [0070.976] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2538 [0070.976] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0070.977] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.977] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0070.977] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0070.977] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0070.977] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0070.977] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0070.977] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0070.977] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0070.977] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0070.977] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0070.977] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0070.977] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0070.977] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.977] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.978] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0070.978] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0070.978] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0070.978] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0070.979] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0070.980] IUnknown:Release (This=0x2f9d40) returned 0x3 [0070.980] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.980] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.980] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.980] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.980] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.980] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.980] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0070.980] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.980] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.981] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.981] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.981] GetCurrentThreadId () returned 0xa94 [0070.981] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.981] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Microsoft Analysis Services\\differ.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.981] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.981] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.981] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.981] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0070.981] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.982] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.982] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.982] GetCurrentThreadId () returned 0xa94 [0070.982] SysStringLen (param_1="ExecutablePath") returned 0xe [0070.982] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Microsoft Analysis Services\\differ.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.982] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.982] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.982] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0070.983] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0070.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd02c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0070.983] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0070.983] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0070.983] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0070.983] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0070.983] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0070.983] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0070.983] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0070.985] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x6) returned 0x1677628 [0070.985] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167c638 | out: hHeap=0x1660000) returned 1 [0070.985] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167c610 | out: hHeap=0x1660000) returned 1 [0070.985] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0070.985] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x2dfe6c, cchWideChar=6 | out: lpWideCharStr="zhang") returned 6 [0070.985] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1677628 | out: hHeap=0x1660000) returned 1 [0070.985] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.985] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.986] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0070.986] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0070.986] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0070.986] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0070.986] IUnknown:Release (This=0x4af2010) returned 0x2 [0070.986] SysStringLen (param_1="Name") returned 0x4 [0070.986] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0070.986] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2598 [0070.986] SysStringLen (param_1="Name") returned 0x4 [0070.986] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.986] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.986] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.986] GetCurrentThreadId () returned 0xa94 [0070.987] SysStringLen (param_1="Name") returned 0x4 [0070.987] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="differ.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.987] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.987] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0070.987] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0070.987] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0070.987] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0070.987] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0070.987] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.987] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0070.987] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0070.988] GetCurrentThreadId () returned 0xa94 [0070.988] SysStringLen (param_1="Name") returned 0x4 [0070.988] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="differ.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0070.988] IUnknown:Release (This=0x2fb99c) returned 0x1 [0070.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0070.988] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0070.988] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0070.997] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.022] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.022] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.022] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.022] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.022] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.022] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.022] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.022] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.022] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.023] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.023] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.023] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.023] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.023] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.023] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.023] GetCurrentThreadId () returned 0xa94 [0071.023] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.023] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.023] GetCurrentThreadId () returned 0xa94 [0071.023] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.023] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.023] GetCurrentThreadId () returned 0xa94 [0071.023] GetCurrentThreadId () returned 0xa94 [0071.024] GetCurrentThreadId () returned 0xa94 [0071.024] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.024] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.024] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.025] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.025] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.025] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2490 [0071.025] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2500 [0071.026] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2560 [0071.026] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.026] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.026] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.026] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.026] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.026] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.026] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.026] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.026] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.026] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.027] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.027] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.027] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.027] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.027] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.027] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.027] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.027] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.027] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.029] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.029] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.029] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.029] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.029] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.029] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.029] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.029] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.029] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.029] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.030] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.030] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.030] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.030] GetCurrentThreadId () returned 0xa94 [0071.030] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.030] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Mozilla Firefox\\criticismhopkins.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.030] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.030] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.031] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.031] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.031] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.031] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.031] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.031] GetCurrentThreadId () returned 0xa94 [0071.031] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.031] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Mozilla Firefox\\criticismhopkins.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.031] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.032] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.032] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.032] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.032] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfb24, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.032] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.032] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.032] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.032] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.032] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.032] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.032] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.032] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.032] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.033] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.033] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.033] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.033] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.033] SysStringLen (param_1="Name") returned 0x4 [0071.033] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.033] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25c0 [0071.033] SysStringLen (param_1="Name") returned 0x4 [0071.033] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.033] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.033] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.033] GetCurrentThreadId () returned 0xa94 [0071.033] SysStringLen (param_1="Name") returned 0x4 [0071.033] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="criticismhopkins.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.033] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.034] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.034] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.034] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.034] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.034] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.034] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.034] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.034] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.034] GetCurrentThreadId () returned 0xa94 [0071.034] SysStringLen (param_1="Name") returned 0x4 [0071.034] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="criticismhopkins.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.035] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.035] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.035] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.044] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.073] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.073] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.074] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.074] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.074] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.074] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.074] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.074] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.074] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.074] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.074] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.074] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.074] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.074] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.074] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.074] GetCurrentThreadId () returned 0xa94 [0071.074] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.075] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.075] GetCurrentThreadId () returned 0xa94 [0071.075] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.075] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.075] GetCurrentThreadId () returned 0xa94 [0071.075] GetCurrentThreadId () returned 0xa94 [0071.075] GetCurrentThreadId () returned 0xa94 [0071.075] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.076] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.076] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.078] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.078] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.078] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2480 [0071.078] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24f0 [0071.078] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2550 [0071.078] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.078] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.078] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.078] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.078] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.079] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.079] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.079] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.079] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.079] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.079] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.079] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.079] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.079] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.079] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.079] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.079] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.079] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.079] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.081] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.081] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.081] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.081] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.081] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.082] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.082] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.082] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.082] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.082] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.082] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.082] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.082] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.082] GetCurrentThreadId () returned 0xa94 [0071.082] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.082] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Media Player\\season_robinson.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.083] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.083] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.083] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.083] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.083] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.083] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.083] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.083] GetCurrentThreadId () returned 0xa94 [0071.084] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.084] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Media Player\\season_robinson.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.084] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.084] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.084] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.084] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfe6c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.085] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.085] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.085] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.085] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.085] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.085] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.085] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.085] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.085] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.085] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.086] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.086] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.086] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.086] SysStringLen (param_1="Name") returned 0x4 [0071.086] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.086] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25b0 [0071.086] SysStringLen (param_1="Name") returned 0x4 [0071.086] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.086] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.086] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.086] GetCurrentThreadId () returned 0xa94 [0071.086] SysStringLen (param_1="Name") returned 0x4 [0071.087] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="season_robinson.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.087] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.087] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.087] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.087] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.087] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.087] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.087] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.088] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.088] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.088] GetCurrentThreadId () returned 0xa94 [0071.088] SysStringLen (param_1="Name") returned 0x4 [0071.088] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="season_robinson.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.088] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.088] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.088] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.097] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.116] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.116] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.116] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.116] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.116] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.117] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.117] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.117] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.117] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.117] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.117] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.117] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.117] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.117] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.117] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.117] GetCurrentThreadId () returned 0xa94 [0071.117] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.117] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.117] GetCurrentThreadId () returned 0xa94 [0071.117] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.118] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.118] GetCurrentThreadId () returned 0xa94 [0071.119] GetCurrentThreadId () returned 0xa94 [0071.119] GetCurrentThreadId () returned 0xa94 [0071.119] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.119] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.119] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.126] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.126] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.126] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2488 [0071.126] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24f8 [0071.126] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2558 [0071.126] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.126] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.126] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.126] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.126] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.127] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.127] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.127] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.127] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.127] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.127] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.127] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.127] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.127] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.127] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.127] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.127] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.127] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.128] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.129] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.129] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.129] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.129] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.129] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.129] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.129] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.129] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.130] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.130] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.130] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.130] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.130] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.130] GetCurrentThreadId () returned 0xa94 [0071.130] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.130] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Windows Defender\\septemberderived.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.130] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.131] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.131] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.131] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.131] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.131] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.131] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.131] GetCurrentThreadId () returned 0xa94 [0071.131] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.131] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Windows Defender\\septemberderived.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.131] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.131] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.132] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.132] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfe6c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.132] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.132] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.132] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.132] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.132] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.132] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.132] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.132] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.132] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.132] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.132] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.132] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.133] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.133] SysStringLen (param_1="Name") returned 0x4 [0071.133] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.133] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25b8 [0071.133] SysStringLen (param_1="Name") returned 0x4 [0071.133] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.133] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.133] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.133] GetCurrentThreadId () returned 0xa94 [0071.133] SysStringLen (param_1="Name") returned 0x4 [0071.133] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="septemberderived.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.133] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.134] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.134] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.134] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.134] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.134] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.134] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.134] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.134] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.134] GetCurrentThreadId () returned 0xa94 [0071.134] SysStringLen (param_1="Name") returned 0x4 [0071.134] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="septemberderived.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.135] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.135] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.135] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.143] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.168] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.168] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.168] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.168] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.168] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.168] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.168] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.168] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.168] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.168] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.168] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.168] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.168] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.168] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.168] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.168] GetCurrentThreadId () returned 0xa94 [0071.168] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.168] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.168] GetCurrentThreadId () returned 0xa94 [0071.169] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.169] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.169] GetCurrentThreadId () returned 0xa94 [0071.169] GetCurrentThreadId () returned 0xa94 [0071.169] GetCurrentThreadId () returned 0xa94 [0071.169] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.169] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.169] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.171] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.171] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.171] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2468 [0071.171] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24d8 [0071.171] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2538 [0071.172] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.172] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.172] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.172] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.172] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.172] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.172] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.172] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.172] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.172] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.173] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.173] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.173] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.173] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.173] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.173] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.174] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.174] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.174] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.176] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.176] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.176] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.176] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.176] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.176] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.176] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.177] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.177] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.177] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.177] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.178] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.178] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.178] GetCurrentThreadId () returned 0xa94 [0071.178] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.179] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Sidebar\\coffee.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.179] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.179] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.179] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.179] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.179] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.179] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.180] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.180] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.180] GetCurrentThreadId () returned 0xa94 [0071.180] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.180] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Sidebar\\coffee.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.180] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.180] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.180] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.180] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.181] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfe6c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.181] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.181] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.181] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.181] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.181] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.181] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.181] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.182] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.182] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.182] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.182] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.182] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.182] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.182] SysStringLen (param_1="Name") returned 0x4 [0071.182] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.182] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2598 [0071.182] SysStringLen (param_1="Name") returned 0x4 [0071.182] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.182] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.183] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.183] GetCurrentThreadId () returned 0xa94 [0071.183] SysStringLen (param_1="Name") returned 0x4 [0071.183] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="coffee.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.183] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.183] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.184] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.184] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.184] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.184] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.184] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.184] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.185] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.185] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.185] GetCurrentThreadId () returned 0xa94 [0071.185] SysStringLen (param_1="Name") returned 0x4 [0071.185] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="coffee.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.185] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.185] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.186] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.194] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.212] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.212] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.212] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.212] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.212] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.212] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.212] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.212] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.212] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.212] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.212] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.212] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.212] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.212] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.213] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.213] GetCurrentThreadId () returned 0xa94 [0071.213] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.213] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.213] GetCurrentThreadId () returned 0xa94 [0071.213] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.214] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.214] GetCurrentThreadId () returned 0xa94 [0071.214] GetCurrentThreadId () returned 0xa94 [0071.214] GetCurrentThreadId () returned 0xa94 [0071.214] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.214] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.214] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.221] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.221] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.221] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0071.221] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0071.221] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0071.221] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.222] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.222] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.222] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.222] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.222] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.222] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.222] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.222] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.222] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.222] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.222] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.222] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.222] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.222] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.223] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.223] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.223] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.223] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.224] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.225] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.225] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.225] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.225] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.225] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.225] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.225] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.225] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.225] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.225] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.225] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.225] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.225] GetCurrentThreadId () returned 0xa94 [0071.226] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.226] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Common Files\\analyzed.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.226] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.226] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.226] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.226] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.226] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.226] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.226] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.226] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.226] GetCurrentThreadId () returned 0xa94 [0071.227] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.227] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Common Files\\analyzed.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.227] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.227] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.227] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.227] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd02c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.227] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.227] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.228] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.228] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.228] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.228] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.228] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.228] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.228] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.228] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.228] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.228] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.228] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.228] SysStringLen (param_1="Name") returned 0x4 [0071.229] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.229] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0071.229] SysStringLen (param_1="Name") returned 0x4 [0071.229] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.229] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.229] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.229] GetCurrentThreadId () returned 0xa94 [0071.229] SysStringLen (param_1="Name") returned 0x4 [0071.229] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="analyzed.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.229] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.230] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.230] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.230] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.230] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.230] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.230] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.230] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.231] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.231] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.231] GetCurrentThreadId () returned 0xa94 [0071.231] SysStringLen (param_1="Name") returned 0x4 [0071.231] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="analyzed.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.231] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.232] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.232] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.241] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.259] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.259] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.259] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.259] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.259] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.259] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.259] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.260] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.260] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.260] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.260] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.260] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.260] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.260] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.260] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.260] GetCurrentThreadId () returned 0xa94 [0071.260] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.260] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.260] GetCurrentThreadId () returned 0xa94 [0071.260] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.261] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.261] GetCurrentThreadId () returned 0xa94 [0071.261] GetCurrentThreadId () returned 0xa94 [0071.261] GetCurrentThreadId () returned 0xa94 [0071.261] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.261] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.261] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.269] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.269] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.269] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24a8 [0071.269] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2518 [0071.269] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2578 [0071.269] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.269] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.269] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.269] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.270] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.270] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.270] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.270] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.270] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.270] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.270] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.270] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.270] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.270] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.270] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.270] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.271] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.271] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.271] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.273] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.273] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.273] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.273] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.273] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.273] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.274] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.274] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.274] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.274] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.274] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.274] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.274] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.274] GetCurrentThreadId () returned 0xa94 [0071.274] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.275] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Microsoft Analysis Services\\speaks deborah period.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.275] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.275] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.275] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.275] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.275] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.275] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.276] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.276] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.276] GetCurrentThreadId () returned 0xa94 [0071.276] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.276] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Microsoft Analysis Services\\speaks deborah period.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.276] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.276] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.276] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.276] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.277] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd02c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.277] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.277] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.277] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.277] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.277] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.277] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.277] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.277] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.277] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.277] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.277] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.278] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.278] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.278] SysStringLen (param_1="Name") returned 0x4 [0071.278] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.278] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25d8 [0071.278] SysStringLen (param_1="Name") returned 0x4 [0071.278] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.278] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.278] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.278] GetCurrentThreadId () returned 0xa94 [0071.279] SysStringLen (param_1="Name") returned 0x4 [0071.279] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="speaks deborah period.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.279] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.279] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.279] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.279] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.279] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.279] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.279] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.280] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.280] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.280] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.280] GetCurrentThreadId () returned 0xa94 [0071.280] SysStringLen (param_1="Name") returned 0x4 [0071.280] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="speaks deborah period.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.280] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.280] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.281] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.289] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.306] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.306] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.306] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.307] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.307] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.307] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.307] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.307] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.307] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.307] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.307] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.307] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.307] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.307] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.307] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.307] GetCurrentThreadId () returned 0xa94 [0071.307] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.307] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.307] GetCurrentThreadId () returned 0xa94 [0071.308] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.308] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.308] GetCurrentThreadId () returned 0xa94 [0071.308] GetCurrentThreadId () returned 0xa94 [0071.309] GetCurrentThreadId () returned 0xa94 [0071.309] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.309] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.309] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.316] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.316] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.316] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24a8 [0071.316] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2518 [0071.317] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2578 [0071.317] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.317] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.317] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.317] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.317] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.317] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.318] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.318] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.318] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.318] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.319] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.319] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.319] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.319] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.319] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.319] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.319] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.319] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.320] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.322] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.322] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.322] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.322] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.323] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.323] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.323] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.323] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.323] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.323] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.324] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.324] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.324] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.324] GetCurrentThreadId () returned 0xa94 [0071.325] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.325] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\carlo equipment linux.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.325] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.326] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.326] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.326] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.326] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.327] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.327] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.327] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.327] GetCurrentThreadId () returned 0xa94 [0071.328] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.328] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\carlo equipment linux.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.328] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.329] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.329] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.329] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd054, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.329] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.329] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.330] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.330] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.330] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.330] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.330] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.330] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.331] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.331] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.331] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.331] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.331] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.331] SysStringLen (param_1="Name") returned 0x4 [0071.331] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.331] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25d8 [0071.331] SysStringLen (param_1="Name") returned 0x4 [0071.332] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.332] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.332] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.332] GetCurrentThreadId () returned 0xa94 [0071.332] SysStringLen (param_1="Name") returned 0x4 [0071.333] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="carlo equipment linux.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.334] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.334] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.334] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.334] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.335] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.335] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.335] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.335] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.335] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.335] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.335] GetCurrentThreadId () returned 0xa94 [0071.336] SysStringLen (param_1="Name") returned 0x4 [0071.336] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="carlo equipment linux.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.336] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.337] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.337] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.346] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.363] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.363] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.363] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.363] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.363] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.363] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.363] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.363] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.363] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.363] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.363] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.363] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.363] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.363] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.364] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.364] GetCurrentThreadId () returned 0xa94 [0071.364] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.364] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.364] GetCurrentThreadId () returned 0xa94 [0071.364] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.365] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0071.365] GetCurrentThreadId () returned 0xa94 [0071.365] GetCurrentThreadId () returned 0xa94 [0071.365] GetCurrentThreadId () returned 0xa94 [0071.365] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.365] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.365] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.372] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.372] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.372] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2480 [0071.372] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24f0 [0071.372] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2550 [0071.373] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.373] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.373] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.373] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.373] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.373] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.373] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.373] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.373] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.373] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.373] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.373] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.373] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.373] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.374] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.374] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.374] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.374] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.374] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.375] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.376] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.376] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.376] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.376] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.376] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.376] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.376] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.376] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.376] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.376] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.376] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.376] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.376] GetCurrentThreadId () returned 0xa94 [0071.377] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.377] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Reference Assemblies\\hungaccounting.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.377] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.377] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.377] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.377] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.377] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.377] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.377] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.378] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.378] GetCurrentThreadId () returned 0xa94 [0071.378] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.378] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Reference Assemblies\\hungaccounting.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.378] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.378] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.378] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.378] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.378] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd054, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.378] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.378] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.379] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.379] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.379] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.379] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.379] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.379] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.379] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.379] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.379] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.379] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.379] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.379] SysStringLen (param_1="Name") returned 0x4 [0071.379] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.379] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25b0 [0071.379] SysStringLen (param_1="Name") returned 0x4 [0071.380] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.380] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.380] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.380] GetCurrentThreadId () returned 0xa94 [0071.380] SysStringLen (param_1="Name") returned 0x4 [0071.380] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="hungaccounting.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.380] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.380] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.381] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.381] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.381] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.381] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.381] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.381] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.381] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.381] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.381] GetCurrentThreadId () returned 0xa94 [0071.381] SysStringLen (param_1="Name") returned 0x4 [0071.382] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="hungaccounting.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.382] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.382] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.382] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.390] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.412] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.412] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.412] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.412] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.412] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.412] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.412] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.412] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.412] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.413] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.413] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.413] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.413] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.413] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.413] GetCurrentThreadId () returned 0xa94 [0071.413] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.413] GetCurrentThreadId () returned 0xa94 [0071.413] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.413] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.413] GetCurrentThreadId () returned 0xa94 [0071.414] GetCurrentThreadId () returned 0xa94 [0071.414] GetCurrentThreadId () returned 0xa94 [0071.414] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.414] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.414] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.416] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.416] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.416] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24c0 [0071.416] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2530 [0071.416] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2590 [0071.416] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.416] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.416] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.416] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.416] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.416] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.416] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.417] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.417] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.417] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.417] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.417] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.417] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.417] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.417] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.417] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.417] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.417] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.417] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.419] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.419] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.419] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.419] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.419] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.419] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.419] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.419] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.419] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.419] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.420] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.420] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.420] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.420] GetCurrentThreadId () returned 0xa94 [0071.420] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.420] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\astrologylooksmartwidely.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.420] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.420] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.420] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.421] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.421] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.421] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.421] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.421] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.421] GetCurrentThreadId () returned 0xa94 [0071.421] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.421] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\astrologylooksmartwidely.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.421] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.422] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.422] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.422] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd054, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.422] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.422] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.422] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.422] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.422] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.422] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.422] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.422] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.422] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.423] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.423] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.423] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.423] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.423] SysStringLen (param_1="Name") returned 0x4 [0071.423] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.423] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25f0 [0071.423] SysStringLen (param_1="Name") returned 0x4 [0071.423] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.423] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.423] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.423] GetCurrentThreadId () returned 0xa94 [0071.424] SysStringLen (param_1="Name") returned 0x4 [0071.424] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="astrologylooksmartwidely.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.424] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.424] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.424] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.424] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.424] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.425] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.425] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.425] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.425] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.425] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.425] GetCurrentThreadId () returned 0xa94 [0071.425] SysStringLen (param_1="Name") returned 0x4 [0071.425] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="astrologylooksmartwidely.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.425] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.426] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.426] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.434] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.456] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.456] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.456] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.456] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.456] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.456] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.456] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.456] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.456] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.456] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.456] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.456] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.456] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.457] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.457] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.457] GetCurrentThreadId () returned 0xa94 [0071.457] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.457] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.457] GetCurrentThreadId () returned 0xa94 [0071.457] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.457] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.457] GetCurrentThreadId () returned 0xa94 [0071.457] GetCurrentThreadId () returned 0xa94 [0071.458] GetCurrentThreadId () returned 0xa94 [0071.458] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.458] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.458] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.460] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.460] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.460] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0071.460] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0071.460] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0071.460] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.460] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.460] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.460] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.460] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.461] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.461] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.461] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.461] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.461] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.461] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.461] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.461] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.461] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.461] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.461] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.461] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.461] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.462] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.463] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.463] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.463] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.463] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.463] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.463] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.463] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.464] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.464] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.464] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.464] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.464] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.464] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.464] GetCurrentThreadId () returned 0xa94 [0071.464] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.464] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft Analysis Services\\suburban.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.464] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.465] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.465] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.465] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.465] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.465] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.465] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.465] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.465] GetCurrentThreadId () returned 0xa94 [0071.465] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.465] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft Analysis Services\\suburban.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.466] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.466] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.466] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.466] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.466] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd054, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.466] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.466] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.466] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.466] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.466] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.466] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.467] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.467] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.467] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.467] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.467] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.467] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.467] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.467] SysStringLen (param_1="Name") returned 0x4 [0071.467] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.467] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0071.467] SysStringLen (param_1="Name") returned 0x4 [0071.467] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.467] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.467] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.468] GetCurrentThreadId () returned 0xa94 [0071.468] SysStringLen (param_1="Name") returned 0x4 [0071.468] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="suburban.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.468] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.468] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.468] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.468] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.468] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.468] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.468] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.469] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.469] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.469] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.469] GetCurrentThreadId () returned 0xa94 [0071.469] SysStringLen (param_1="Name") returned 0x4 [0071.469] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="suburban.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.469] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.469] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.469] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.477] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.499] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.499] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.499] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.499] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.499] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.499] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.499] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.499] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.499] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.499] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.499] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.499] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.499] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.500] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.500] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.500] GetCurrentThreadId () returned 0xa94 [0071.500] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.500] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.500] GetCurrentThreadId () returned 0xa94 [0071.500] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.500] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.500] GetCurrentThreadId () returned 0xa94 [0071.500] GetCurrentThreadId () returned 0xa94 [0071.500] GetCurrentThreadId () returned 0xa94 [0071.500] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.501] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.501] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.503] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.503] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.503] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0071.503] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0071.503] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0071.503] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.503] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.503] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.503] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.503] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.503] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.503] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.503] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.504] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.504] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.504] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.504] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.504] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.504] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.504] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.504] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.504] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.504] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.504] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.506] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.507] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.507] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.507] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.507] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.507] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.507] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.507] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.507] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.507] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.507] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.507] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.507] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.508] GetCurrentThreadId () returned 0xa94 [0071.508] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.508] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Windows Media Player\\triangle.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.508] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.508] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.508] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.508] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.508] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.508] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.509] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.509] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.509] GetCurrentThreadId () returned 0xa94 [0071.509] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.509] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Windows Media Player\\triangle.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.509] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.509] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.509] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.510] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfe44, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.510] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.510] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.510] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.510] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.510] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.510] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.510] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.510] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.510] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.510] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.511] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.511] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.511] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.511] SysStringLen (param_1="Name") returned 0x4 [0071.511] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.511] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0071.511] SysStringLen (param_1="Name") returned 0x4 [0071.511] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.511] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.511] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.511] GetCurrentThreadId () returned 0xa94 [0071.511] SysStringLen (param_1="Name") returned 0x4 [0071.511] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="triangle.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.512] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.512] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.512] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.512] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.512] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.512] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.512] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.512] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.513] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.513] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.513] GetCurrentThreadId () returned 0xa94 [0071.513] SysStringLen (param_1="Name") returned 0x4 [0071.513] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="triangle.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.513] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.513] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.513] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.522] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.546] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.546] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.546] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.546] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.546] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.546] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.546] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.546] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.546] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.546] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.546] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.546] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.546] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.546] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.546] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.547] GetCurrentThreadId () returned 0xa94 [0071.547] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.547] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.547] GetCurrentThreadId () returned 0xa94 [0071.547] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.547] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.547] GetCurrentThreadId () returned 0xa94 [0071.547] GetCurrentThreadId () returned 0xa94 [0071.548] GetCurrentThreadId () returned 0xa94 [0071.548] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.548] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.548] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.550] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.550] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.550] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0071.550] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0071.550] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0071.550] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.550] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.550] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.550] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.551] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.551] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.551] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.551] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.551] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.551] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.551] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.551] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.552] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.552] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.552] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.552] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.552] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.552] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.553] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.554] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.554] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.554] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.554] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.554] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.554] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.554] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.554] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.555] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.555] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.555] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.555] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.555] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.555] GetCurrentThreadId () returned 0xa94 [0071.555] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.555] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Uninstall Information\\mild.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.555] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.555] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.556] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.556] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.556] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.556] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.556] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.556] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.556] GetCurrentThreadId () returned 0xa94 [0071.556] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.556] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Uninstall Information\\mild.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.556] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.557] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.557] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.557] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd02c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.557] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.557] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.557] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18eb84, nSize=0x104 | out: lpFilename="C:\\ProgramData\\zhang.exe" (normalized: "c:\\programdata\\zhang.exe")) returned 0x18 [0071.557] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.557] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.557] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.557] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.557] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.558] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.558] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.558] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.558] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.558] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.558] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.558] SysStringLen (param_1="Name") returned 0x4 [0071.558] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.558] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0071.558] SysStringLen (param_1="Name") returned 0x4 [0071.558] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.558] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.559] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.559] GetCurrentThreadId () returned 0xa94 [0071.559] SysStringLen (param_1="Name") returned 0x4 [0071.559] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="mild.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.559] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.559] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.560] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.560] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.560] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.560] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.560] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.560] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.560] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.560] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.560] GetCurrentThreadId () returned 0xa94 [0071.560] SysStringLen (param_1="Name") returned 0x4 [0071.561] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="mild.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.561] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.561] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.561] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="[System Process]", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[System Process]", lpUsedDefaultChar=0x0) returned 260 [0071.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="System", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="System", lpUsedDefaultChar=0x0) returned 260 [0071.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smss.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="smss.exe", lpUsedDefaultChar=0x0) returned 260 [0071.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csrss.exe", lpUsedDefaultChar=0x0) returned 260 [0071.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wininit.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wininit.exe", lpUsedDefaultChar=0x0) returned 260 [0071.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csrss.exe", lpUsedDefaultChar=0x0) returned 260 [0071.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winlogon.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="winlogon.exe", lpUsedDefaultChar=0x0) returned 260 [0071.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services.exe", lpUsedDefaultChar=0x0) returned 260 [0071.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsass.exe", lpUsedDefaultChar=0x0) returned 260 [0071.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsm.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsm.exe", lpUsedDefaultChar=0x0) returned 260 [0071.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0071.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0071.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0071.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0071.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0071.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiodg.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiodg.exe", lpUsedDefaultChar=0x0) returned 260 [0071.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0071.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0071.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dwm.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwm.exe", lpUsedDefaultChar=0x0) returned 260 [0071.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer.exe", lpUsedDefaultChar=0x0) returned 260 [0071.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="spoolsv.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spoolsv.exe", lpUsedDefaultChar=0x0) returned 260 [0071.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0071.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskhost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskhost.exe", lpUsedDefaultChar=0x0) returned 260 [0071.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskeng.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskeng.exe", lpUsedDefaultChar=0x0) returned 260 [0071.578] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=1, dwProcessId=0x5c4) returned 0x1b8 [0071.578] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="by-bubble-hi.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="by-bubble-hi.exe", lpUsedDefaultChar=0x0) returned 260 [0071.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="3dftp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3dftp.exe", lpUsedDefaultChar=0x0) returned 260 [0071.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="absolutetelnet.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="absolutetelnet.exe", lpUsedDefaultChar=0x0) returned 260 [0071.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="alftp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alftp.exe", lpUsedDefaultChar=0x0) returned 260 [0071.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="barca.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="barca.exe", lpUsedDefaultChar=0x0) returned 260 [0071.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bitkinex.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bitkinex.exe", lpUsedDefaultChar=0x0) returned 260 [0071.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="coreftp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="coreftp.exe", lpUsedDefaultChar=0x0) returned 260 [0071.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="far.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="far.exe", lpUsedDefaultChar=0x0) returned 260 [0071.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="filezilla.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filezilla.exe", lpUsedDefaultChar=0x0) returned 260 [0071.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="flashfxp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashfxp.exe", lpUsedDefaultChar=0x0) returned 260 [0071.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fling.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fling.exe", lpUsedDefaultChar=0x0) returned 260 [0071.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="foxmailincmail.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="foxmailincmail.exe", lpUsedDefaultChar=0x0) returned 260 [0071.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gmailnotifierpro.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gmailnotifierpro.exe", lpUsedDefaultChar=0x0) returned 260 [0071.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="icq.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icq.exe", lpUsedDefaultChar=0x0) returned 260 [0071.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="leechftp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="leechftp.exe", lpUsedDefaultChar=0x0) returned 260 [0071.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ncftp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ncftp.exe", lpUsedDefaultChar=0x0) returned 260 [0071.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad.exe", lpUsedDefaultChar=0x0) returned 260 [0071.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="operamail.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="operamail.exe", lpUsedDefaultChar=0x0) returned 260 [0071.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="outlook.exe", lpUsedDefaultChar=0x0) returned 260 [0071.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pidgin.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pidgin.exe", lpUsedDefaultChar=0x0) returned 260 [0071.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="scriptftp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scriptftp.exe", lpUsedDefaultChar=0x0) returned 260 [0071.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="skype.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="skype.exe", lpUsedDefaultChar=0x0) returned 260 [0071.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smartftp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="smartftp.exe", lpUsedDefaultChar=0x0) returned 260 [0071.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="thunderbird.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="thunderbird.exe", lpUsedDefaultChar=0x0) returned 260 [0071.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="totalcmd.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="totalcmd.exe", lpUsedDefaultChar=0x0) returned 260 [0071.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="trillian.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trillian.exe", lpUsedDefaultChar=0x0) returned 260 [0071.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="webdrive.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="webdrive.exe", lpUsedDefaultChar=0x0) returned 260 [0071.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="whatsapp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="whatsapp.exe", lpUsedDefaultChar=0x0) returned 260 [0071.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winscp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="winscp.exe", lpUsedDefaultChar=0x0) returned 260 [0071.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="yahoomessenger.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yahoomessenger.exe", lpUsedDefaultChar=0x0) returned 260 [0071.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active-charge.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active-charge.exe", lpUsedDefaultChar=0x0) returned 260 [0071.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="accupos.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accupos.exe", lpUsedDefaultChar=0x0) returned 260 [0071.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afr38.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afr38.exe", lpUsedDefaultChar=0x0) returned 260 [0071.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aldelo.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aldelo.exe", lpUsedDefaultChar=0x0) returned 260 [0071.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ccv_server.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ccv_server.exe", lpUsedDefaultChar=0x0) returned 260 [0071.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="centralcreditcard.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="centralcreditcard.exe", lpUsedDefaultChar=0x0) returned 260 [0071.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="creditservice.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="creditservice.exe", lpUsedDefaultChar=0x0) returned 260 [0071.606] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.606] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.606] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.606] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.606] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.606] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.606] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.606] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.606] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.606] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.606] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.606] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.606] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.606] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.606] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.606] GetCurrentThreadId () returned 0xa94 [0071.606] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.606] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.606] GetCurrentThreadId () returned 0xa94 [0071.607] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.608] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.608] GetCurrentThreadId () returned 0xa94 [0071.608] GetCurrentThreadId () returned 0xa94 [0071.608] GetCurrentThreadId () returned 0xa94 [0071.608] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.608] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.608] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.634] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.634] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.634] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0071.634] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0071.634] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0071.634] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.634] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.634] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.635] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.635] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.635] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.635] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.635] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.635] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.635] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.635] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.635] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.635] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.635] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.635] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.635] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.636] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.636] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.636] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.638] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.638] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.638] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.638] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.638] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.638] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.638] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.638] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.638] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.638] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.638] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.639] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.639] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.639] GetCurrentThreadId () returned 0xa94 [0071.639] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.639] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Adobe\\by-bubble-hi.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.639] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.639] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.639] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.639] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.640] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.640] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.640] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.640] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.640] GetCurrentThreadId () returned 0xa94 [0071.640] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.640] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Adobe\\by-bubble-hi.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.640] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.641] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.641] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.641] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd02c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.641] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.641] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.641] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.641] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.641] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.641] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.641] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.641] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.642] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.642] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.642] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.642] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.642] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.642] SysStringLen (param_1="Name") returned 0x4 [0071.642] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.642] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a0 [0071.642] SysStringLen (param_1="Name") returned 0x4 [0071.642] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.642] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.642] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.642] GetCurrentThreadId () returned 0xa94 [0071.642] SysStringLen (param_1="Name") returned 0x4 [0071.643] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="by-bubble-hi.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.643] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.643] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.643] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.643] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.643] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.643] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.643] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.644] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.644] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.644] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.644] GetCurrentThreadId () returned 0xa94 [0071.644] SysStringLen (param_1="Name") returned 0x4 [0071.644] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="by-bubble-hi.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.644] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.645] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.645] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.653] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.691] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.691] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.691] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.691] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.691] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.691] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.691] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.691] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.691] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.691] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.691] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.691] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.691] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.691] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.691] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.692] GetCurrentThreadId () returned 0xa94 [0071.692] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.692] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.692] GetCurrentThreadId () returned 0xa94 [0071.692] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.692] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.692] GetCurrentThreadId () returned 0xa94 [0071.693] GetCurrentThreadId () returned 0xa94 [0071.693] GetCurrentThreadId () returned 0xa94 [0071.693] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.693] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.693] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.695] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.695] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.695] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2460 [0071.695] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24d0 [0071.696] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2530 [0071.696] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.696] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.696] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.696] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.696] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.697] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.697] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.697] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.697] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.697] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.697] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.697] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.698] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.698] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.698] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.698] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.698] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.698] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.699] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.701] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.701] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.701] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.701] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.701] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.701] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.701] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.702] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.702] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.702] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.702] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.702] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.702] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.703] GetCurrentThreadId () returned 0xa94 [0071.703] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.703] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\3dftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.703] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.704] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.704] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.704] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.704] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.704] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.704] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.704] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.705] GetCurrentThreadId () returned 0xa94 [0071.705] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.705] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\3dftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.705] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.706] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.706] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.706] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfb24, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.706] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.706] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.706] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.706] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.706] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.707] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.707] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.707] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.707] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.707] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.707] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.707] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.707] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.707] SysStringLen (param_1="Name") returned 0x4 [0071.707] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.708] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2590 [0071.708] SysStringLen (param_1="Name") returned 0x4 [0071.708] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.709] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.709] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.709] GetCurrentThreadId () returned 0xa94 [0071.709] SysStringLen (param_1="Name") returned 0x4 [0071.709] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="3dftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.709] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.709] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.710] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.710] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.710] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.710] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.710] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.710] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.710] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.710] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.710] GetCurrentThreadId () returned 0xa94 [0071.711] SysStringLen (param_1="Name") returned 0x4 [0071.711] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="3dftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.711] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.711] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.711] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.719] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.735] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.735] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.735] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.736] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.736] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.736] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.736] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.736] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.736] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.736] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.736] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.736] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.736] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.736] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.736] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.736] GetCurrentThreadId () returned 0xa94 [0071.736] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.736] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.736] GetCurrentThreadId () returned 0xa94 [0071.736] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.737] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.737] GetCurrentThreadId () returned 0xa94 [0071.737] GetCurrentThreadId () returned 0xa94 [0071.737] GetCurrentThreadId () returned 0xa94 [0071.738] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.738] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.738] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.745] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.745] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.745] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2480 [0071.746] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24f0 [0071.746] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2550 [0071.746] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.746] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.746] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.746] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.746] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.746] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.746] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.746] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.746] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.746] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.746] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.746] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.746] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.747] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.747] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.747] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.747] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.747] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.747] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.749] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.749] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.749] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.749] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.749] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.749] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.749] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.749] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.749] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.749] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.749] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.749] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.749] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.749] GetCurrentThreadId () returned 0xa94 [0071.750] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.750] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Reference Assemblies\\absolutetelnet.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.750] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.750] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.750] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.750] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.750] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.750] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.750] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.750] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.750] GetCurrentThreadId () returned 0xa94 [0071.751] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.751] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Reference Assemblies\\absolutetelnet.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.751] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.751] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.751] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.751] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfe44, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.751] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.751] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.751] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.752] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.752] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.752] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.752] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.752] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.752] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.752] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.752] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.752] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.752] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.752] SysStringLen (param_1="Name") returned 0x4 [0071.752] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.752] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25b0 [0071.752] SysStringLen (param_1="Name") returned 0x4 [0071.752] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.753] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.753] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.753] GetCurrentThreadId () returned 0xa94 [0071.753] SysStringLen (param_1="Name") returned 0x4 [0071.753] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="absolutetelnet.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.753] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.753] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.753] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.753] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.753] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.754] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.754] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.754] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.754] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.754] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.754] GetCurrentThreadId () returned 0xa94 [0071.754] SysStringLen (param_1="Name") returned 0x4 [0071.754] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="absolutetelnet.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.754] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.755] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.755] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.762] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.782] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.782] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.782] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.782] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.782] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.782] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.782] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.782] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.782] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.783] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.783] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.783] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.783] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.783] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.783] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.783] GetCurrentThreadId () returned 0xa94 [0071.783] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.783] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.783] GetCurrentThreadId () returned 0xa94 [0071.783] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.783] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.783] GetCurrentThreadId () returned 0xa94 [0071.784] GetCurrentThreadId () returned 0xa94 [0071.784] GetCurrentThreadId () returned 0xa94 [0071.784] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.784] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.784] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.786] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.786] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.786] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2460 [0071.786] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24d0 [0071.786] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2530 [0071.786] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.786] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.786] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.786] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.787] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.787] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.787] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.787] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.787] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.787] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.787] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.787] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.787] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.787] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.787] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.787] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.787] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.788] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.788] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.789] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.790] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.790] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.790] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.790] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.790] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.790] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.790] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.790] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.790] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.790] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.791] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.791] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.791] GetCurrentThreadId () returned 0xa94 [0071.791] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.791] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Uninstall Information\\alftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.791] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.791] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.791] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.792] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.792] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.792] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.792] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.792] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.792] GetCurrentThreadId () returned 0xa94 [0071.792] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.792] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Uninstall Information\\alftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.793] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.793] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.793] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.793] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.793] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2dfe6c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.793] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.793] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.793] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.793] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.793] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.793] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.793] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.794] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.794] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.794] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.794] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.794] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.794] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.794] SysStringLen (param_1="Name") returned 0x4 [0071.794] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.794] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2590 [0071.794] SysStringLen (param_1="Name") returned 0x4 [0071.795] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.795] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.795] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.795] GetCurrentThreadId () returned 0xa94 [0071.795] SysStringLen (param_1="Name") returned 0x4 [0071.795] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="alftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.795] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.795] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.796] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.796] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.796] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.796] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.796] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.796] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.796] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.796] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.796] GetCurrentThreadId () returned 0xa94 [0071.796] SysStringLen (param_1="Name") returned 0x4 [0071.797] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="alftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.797] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.797] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.797] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.806] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.826] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.826] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.826] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.826] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.826] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.826] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.826] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.826] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.827] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.827] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.827] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.827] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.827] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.827] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.827] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.827] GetCurrentThreadId () returned 0xa94 [0071.827] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.827] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.827] GetCurrentThreadId () returned 0xa94 [0071.827] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.827] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.828] GetCurrentThreadId () returned 0xa94 [0071.828] GetCurrentThreadId () returned 0xa94 [0071.828] GetCurrentThreadId () returned 0xa94 [0071.828] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.828] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.828] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.830] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.830] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.830] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2460 [0071.830] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24d0 [0071.830] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2530 [0071.830] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.830] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.830] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.830] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.830] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.831] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.831] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.831] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.831] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.831] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.831] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.831] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.831] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.831] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.831] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.831] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.831] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.832] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.832] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.834] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.834] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.834] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.834] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.834] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.834] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.834] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.834] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.835] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.835] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.835] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.835] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.835] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.835] GetCurrentThreadId () returned 0xa94 [0071.835] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.836] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Microsoft Synchronization Services\\barca.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.836] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.836] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.836] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.837] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.837] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.837] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.837] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.837] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.837] GetCurrentThreadId () returned 0xa94 [0071.837] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.838] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Microsoft Synchronization Services\\barca.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.839] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.840] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.840] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.840] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.841] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd02c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.841] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.841] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.841] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.841] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.841] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.841] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.842] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.842] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.842] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.842] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.842] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.843] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.843] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.843] SysStringLen (param_1="Name") returned 0x4 [0071.843] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.843] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2590 [0071.843] SysStringLen (param_1="Name") returned 0x4 [0071.843] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.844] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.844] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.844] GetCurrentThreadId () returned 0xa94 [0071.844] SysStringLen (param_1="Name") returned 0x4 [0071.844] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="barca.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.845] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.845] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.845] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.846] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.846] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.846] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.846] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.846] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.847] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.847] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.847] GetCurrentThreadId () returned 0xa94 [0071.847] SysStringLen (param_1="Name") returned 0x4 [0071.847] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="barca.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.848] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.848] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.849] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.857] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.870] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.870] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.870] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.870] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.871] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.871] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.871] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.871] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.871] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.871] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.871] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.871] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.871] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.871] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.871] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.871] GetCurrentThreadId () returned 0xa94 [0071.871] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.871] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.871] GetCurrentThreadId () returned 0xa94 [0071.871] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.872] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.872] GetCurrentThreadId () returned 0xa94 [0071.872] GetCurrentThreadId () returned 0xa94 [0071.872] GetCurrentThreadId () returned 0xa94 [0071.872] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.872] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.872] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.878] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.878] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.878] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0071.878] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0071.878] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0071.878] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.878] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.878] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.878] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.878] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.878] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.878] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.878] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.879] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.879] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.879] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.879] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.879] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.879] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.879] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.879] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.879] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.879] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.879] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.880] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.881] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.881] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.881] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.881] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.881] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.881] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.881] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.881] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.881] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.881] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.881] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.881] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.881] GetCurrentThreadId () returned 0xa94 [0071.881] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.881] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft.NET\\bitkinex.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.882] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.882] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.882] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.882] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.882] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.882] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.882] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.882] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.882] GetCurrentThreadId () returned 0xa94 [0071.882] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.882] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft.NET\\bitkinex.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.882] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.882] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.883] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.883] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd07c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.883] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.883] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.883] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.883] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.883] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.883] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.883] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.883] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.883] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.883] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.883] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.883] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.883] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.883] SysStringLen (param_1="Name") returned 0x4 [0071.883] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.884] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0071.884] SysStringLen (param_1="Name") returned 0x4 [0071.884] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.884] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.884] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.884] GetCurrentThreadId () returned 0xa94 [0071.884] SysStringLen (param_1="Name") returned 0x4 [0071.884] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bitkinex.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.884] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.884] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.884] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.884] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.884] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.884] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.885] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.885] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.885] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.885] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.885] GetCurrentThreadId () returned 0xa94 [0071.885] SysStringLen (param_1="Name") returned 0x4 [0071.885] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bitkinex.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.885] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.885] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.885] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.891] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.920] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.920] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.920] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.920] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.920] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.920] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.920] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.920] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.920] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.920] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.920] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.920] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.920] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.920] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.920] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.920] GetCurrentThreadId () returned 0xa94 [0071.921] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.921] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.921] GetCurrentThreadId () returned 0xa94 [0071.921] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.921] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.921] GetCurrentThreadId () returned 0xa94 [0071.921] GetCurrentThreadId () returned 0xa94 [0071.921] GetCurrentThreadId () returned 0xa94 [0071.921] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.921] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.921] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.923] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.923] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.923] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0071.923] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0071.923] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0071.923] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.923] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.923] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.924] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.924] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.924] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.924] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.924] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.924] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.924] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.924] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.924] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.924] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.924] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.924] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.924] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.925] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.925] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.925] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.927] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.927] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.927] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.927] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.927] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.927] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.927] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.927] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.927] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.927] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.928] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.928] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.928] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.928] GetCurrentThreadId () returned 0xa94 [0071.928] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.928] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\coreftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.928] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.929] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.929] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.929] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.929] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.929] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.929] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.929] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.929] GetCurrentThreadId () returned 0xa94 [0071.929] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.929] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\coreftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.930] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.930] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.930] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.930] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd02c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.930] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.930] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.930] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.930] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.930] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.930] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.930] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.931] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.931] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.931] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.931] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.931] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.931] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.931] SysStringLen (param_1="Name") returned 0x4 [0071.931] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.931] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a0 [0071.931] SysStringLen (param_1="Name") returned 0x4 [0071.931] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.932] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.932] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.932] GetCurrentThreadId () returned 0xa94 [0071.932] SysStringLen (param_1="Name") returned 0x4 [0071.932] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="coreftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.932] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.932] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.932] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.932] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.933] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.933] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.933] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.933] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.933] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.933] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.933] GetCurrentThreadId () returned 0xa94 [0071.933] SysStringLen (param_1="Name") returned 0x4 [0071.933] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="coreftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.933] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.934] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.934] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.941] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.954] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.954] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.955] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.955] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.955] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.955] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.955] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.955] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.955] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.955] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.955] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.955] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.955] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.955] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.955] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.955] GetCurrentThreadId () returned 0xa94 [0071.956] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.956] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.956] GetCurrentThreadId () returned 0xa94 [0071.956] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.957] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.957] GetCurrentThreadId () returned 0xa94 [0071.957] GetCurrentThreadId () returned 0xa94 [0071.957] GetCurrentThreadId () returned 0xa94 [0071.957] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.958] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.958] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.963] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.963] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.963] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0071.963] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0071.963] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0071.963] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.964] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.964] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.964] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.964] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.964] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.964] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.964] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.964] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.964] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.964] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.964] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.965] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.965] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.965] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.965] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.965] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.965] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.965] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.966] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.966] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.966] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.966] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.966] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.966] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.967] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.967] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.967] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.967] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.967] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.967] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.967] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.967] GetCurrentThreadId () returned 0xa94 [0071.967] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.967] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Microsoft Sync Framework\\far.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.967] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.968] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.968] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.968] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.968] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0071.968] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.968] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.968] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.968] GetCurrentThreadId () returned 0xa94 [0071.968] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.968] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Microsoft Sync Framework\\far.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.969] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.969] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.969] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0071.969] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0071.969] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd02c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0071.969] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0071.969] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0071.969] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.969] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0071.969] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0071.969] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0071.969] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0071.969] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.969] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.969] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.969] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.969] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.969] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.970] SysStringLen (param_1="Name") returned 0x4 [0071.970] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0071.970] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a0 [0071.970] SysStringLen (param_1="Name") returned 0x4 [0071.970] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.970] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.970] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.970] GetCurrentThreadId () returned 0xa94 [0071.970] SysStringLen (param_1="Name") returned 0x4 [0071.970] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="far.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.970] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.970] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0071.971] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.971] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.971] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0071.971] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.971] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0071.971] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.971] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.971] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.971] GetCurrentThreadId () returned 0xa94 [0071.971] SysStringLen (param_1="Name") returned 0x4 [0071.971] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="far.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.971] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0071.972] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.972] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0071.978] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0071.986] IUnknown:Release (This=0x4af2010) returned 0x1 [0071.986] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.986] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.986] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.986] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.986] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.987] IUnknown:Release (This=0x4af2010) returned 0x0 [0071.987] IUnknown:Release (This=0x2fb99c) returned 0x0 [0071.987] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.987] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.987] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.987] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.987] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.987] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0071.987] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.987] GetCurrentThreadId () returned 0xa94 [0071.987] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0071.987] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.987] GetCurrentThreadId () returned 0xa94 [0071.987] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0071.987] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0071.987] GetCurrentThreadId () returned 0xa94 [0071.988] GetCurrentThreadId () returned 0xa94 [0071.988] GetCurrentThreadId () returned 0xa94 [0071.988] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.988] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.988] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0071.995] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0071.995] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0071.995] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2480 [0071.995] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24f0 [0071.995] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2550 [0071.995] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0071.995] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.995] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0071.995] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0071.995] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0071.995] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0071.995] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0071.995] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0071.995] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0071.996] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0071.996] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0071.996] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0071.996] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0071.996] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.996] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.996] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0071.996] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0071.996] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0071.996] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0071.997] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0071.997] IUnknown:Release (This=0x2f9d40) returned 0x3 [0071.998] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.998] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0071.998] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0071.998] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0071.998] IUnknown:Release (This=0x4af2010) returned 0x2 [0071.998] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.998] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0071.998] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.998] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.998] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.998] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0071.999] GetCurrentThreadId () returned 0xa94 [0071.999] SysStringLen (param_1="ExecutablePath") returned 0xe [0071.999] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Mozilla Firefox\\filezilla.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0071.999] IUnknown:Release (This=0x2fb99c) returned 0x1 [0071.999] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0071.999] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.000] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.000] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.000] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.000] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.000] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.000] GetCurrentThreadId () returned 0xa94 [0072.000] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.000] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Mozilla Firefox\\filezilla.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.000] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.001] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.001] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.001] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.001] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd11c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.001] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.001] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0072.001] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.001] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0072.001] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0072.002] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0072.002] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.002] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.002] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.002] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.002] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.002] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.002] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.002] SysStringLen (param_1="Name") returned 0x4 [0072.002] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.002] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25b0 [0072.002] SysStringLen (param_1="Name") returned 0x4 [0072.002] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.003] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.003] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.003] GetCurrentThreadId () returned 0xa94 [0072.003] SysStringLen (param_1="Name") returned 0x4 [0072.003] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="filezilla.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.003] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.003] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.003] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.004] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.004] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.004] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.004] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.004] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.004] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.004] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.004] GetCurrentThreadId () returned 0xa94 [0072.005] SysStringLen (param_1="Name") returned 0x4 [0072.005] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="filezilla.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.005] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0072.005] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.005] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0072.013] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0072.026] IUnknown:Release (This=0x4af2010) returned 0x1 [0072.026] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.026] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.026] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.026] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.026] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.026] IUnknown:Release (This=0x4af2010) returned 0x0 [0072.026] IUnknown:Release (This=0x2fb99c) returned 0x0 [0072.026] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.026] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.026] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.026] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.026] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.026] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.026] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.026] GetCurrentThreadId () returned 0xa94 [0072.027] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0072.027] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.027] GetCurrentThreadId () returned 0xa94 [0072.027] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0072.027] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0072.027] GetCurrentThreadId () returned 0xa94 [0072.027] GetCurrentThreadId () returned 0xa94 [0072.027] GetCurrentThreadId () returned 0xa94 [0072.028] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.028] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.028] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.042] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0072.042] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0072.042] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0072.042] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0072.042] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0072.042] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0072.042] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.042] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0072.042] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0072.043] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0072.043] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0072.043] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.043] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.043] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0072.043] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0072.043] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0072.043] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0072.043] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0072.043] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.043] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.043] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0072.044] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0072.044] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0072.044] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0072.045] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0072.046] IUnknown:Release (This=0x2f9d40) returned 0x3 [0072.046] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.046] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.046] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.046] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.046] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.046] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.046] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0072.046] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.046] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.047] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.047] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.047] GetCurrentThreadId () returned 0xa94 [0072.047] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.047] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Photo Viewer\\flashfxp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.047] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.048] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.048] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.048] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.048] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.048] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.048] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.048] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.048] GetCurrentThreadId () returned 0xa94 [0072.048] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.049] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Photo Viewer\\flashfxp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.049] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.049] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.049] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.049] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.049] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd02c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.049] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.049] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0072.050] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.050] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0072.050] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0072.050] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0072.050] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.050] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.050] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.050] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.050] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.050] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.050] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.051] SysStringLen (param_1="Name") returned 0x4 [0072.051] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.051] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0072.051] SysStringLen (param_1="Name") returned 0x4 [0072.051] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.051] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.051] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.051] GetCurrentThreadId () returned 0xa94 [0072.052] SysStringLen (param_1="Name") returned 0x4 [0072.052] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="flashfxp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.052] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.052] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.052] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.052] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.052] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.052] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.052] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.053] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.053] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.053] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.053] GetCurrentThreadId () returned 0xa94 [0072.053] SysStringLen (param_1="Name") returned 0x4 [0072.053] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="flashfxp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.053] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0072.054] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.054] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0072.060] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0072.075] IUnknown:Release (This=0x4af2010) returned 0x1 [0072.075] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.075] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.075] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.075] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.075] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.075] IUnknown:Release (This=0x4af2010) returned 0x0 [0072.075] IUnknown:Release (This=0x2fb99c) returned 0x0 [0072.075] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.075] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.075] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.075] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.076] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.076] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.076] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.076] GetCurrentThreadId () returned 0xa94 [0072.076] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0072.076] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.076] GetCurrentThreadId () returned 0xa94 [0072.076] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0072.076] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0072.076] GetCurrentThreadId () returned 0xa94 [0072.076] GetCurrentThreadId () returned 0xa94 [0072.076] GetCurrentThreadId () returned 0xa94 [0072.077] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.077] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.077] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.078] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0072.078] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0072.078] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2460 [0072.078] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24d0 [0072.078] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2530 [0072.078] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0072.079] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.079] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0072.079] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0072.079] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0072.079] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0072.079] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.079] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.079] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0072.079] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0072.079] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0072.079] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0072.079] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0072.079] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.079] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.080] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0072.080] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0072.080] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0072.080] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0072.081] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0072.082] IUnknown:Release (This=0x2f9d40) returned 0x3 [0072.082] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.082] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.082] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.082] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.082] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.082] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.083] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0072.083] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.083] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.083] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.083] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.083] GetCurrentThreadId () returned 0xa94 [0072.083] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.083] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Common Files\\fling.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.084] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.084] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.084] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.084] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.084] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.084] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.084] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.084] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.084] GetCurrentThreadId () returned 0xa94 [0072.084] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.085] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Common Files\\fling.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.085] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.085] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.085] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.085] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd02c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.085] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.085] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0072.085] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.085] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0072.085] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0072.085] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0072.086] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.086] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.086] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.086] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.086] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.086] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.086] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.086] SysStringLen (param_1="Name") returned 0x4 [0072.086] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.086] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2590 [0072.086] SysStringLen (param_1="Name") returned 0x4 [0072.086] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.086] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.086] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.087] GetCurrentThreadId () returned 0xa94 [0072.087] SysStringLen (param_1="Name") returned 0x4 [0072.087] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fling.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.087] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.087] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.087] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.087] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.087] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.087] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.087] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.087] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.088] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.088] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.088] GetCurrentThreadId () returned 0xa94 [0072.088] SysStringLen (param_1="Name") returned 0x4 [0072.088] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fling.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.088] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.088] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0072.088] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.088] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0072.096] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0072.107] IUnknown:Release (This=0x4af2010) returned 0x1 [0072.108] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.108] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.108] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.108] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.108] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.108] IUnknown:Release (This=0x4af2010) returned 0x0 [0072.108] IUnknown:Release (This=0x2fb99c) returned 0x0 [0072.108] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.108] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.108] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.108] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.108] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.108] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.108] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.108] GetCurrentThreadId () returned 0xa94 [0072.108] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0072.108] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.108] GetCurrentThreadId () returned 0xa94 [0072.108] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0072.109] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0072.109] GetCurrentThreadId () returned 0xa94 [0072.109] GetCurrentThreadId () returned 0xa94 [0072.109] GetCurrentThreadId () returned 0xa94 [0072.110] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.110] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.110] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.117] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0072.117] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0072.117] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2480 [0072.117] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24f0 [0072.117] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2550 [0072.117] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0072.117] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.117] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0072.117] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0072.118] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0072.118] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0072.118] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.118] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.118] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0072.118] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0072.118] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0072.118] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0072.118] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0072.118] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.118] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.118] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0072.119] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0072.119] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0072.119] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0072.120] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0072.120] IUnknown:Release (This=0x2f9d40) returned 0x3 [0072.120] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.121] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.121] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.121] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.121] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.121] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.121] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0072.121] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.121] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.121] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.121] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.122] GetCurrentThreadId () returned 0xa94 [0072.122] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.122] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Windows Sidebar\\foxmailincmail.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.122] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.122] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.122] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.122] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.122] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.122] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.123] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.123] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.123] GetCurrentThreadId () returned 0xa94 [0072.123] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.123] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Windows Sidebar\\foxmailincmail.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.123] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.123] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.123] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.124] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.124] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.124] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.124] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0072.124] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.124] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0072.124] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0072.124] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0072.124] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.124] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.125] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.125] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.125] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.125] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.125] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.125] SysStringLen (param_1="Name") returned 0x4 [0072.125] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.125] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25b0 [0072.125] SysStringLen (param_1="Name") returned 0x4 [0072.125] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.125] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.125] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.125] GetCurrentThreadId () returned 0xa94 [0072.126] SysStringLen (param_1="Name") returned 0x4 [0072.126] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="foxmailincmail.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.126] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.126] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.126] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.126] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.127] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.127] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.127] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.127] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.127] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.127] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.127] GetCurrentThreadId () returned 0xa94 [0072.127] SysStringLen (param_1="Name") returned 0x4 [0072.127] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="foxmailincmail.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.127] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0072.128] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.128] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0072.136] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0072.147] IUnknown:Release (This=0x4af2010) returned 0x1 [0072.147] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.147] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.147] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.147] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.147] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.147] IUnknown:Release (This=0x4af2010) returned 0x0 [0072.147] IUnknown:Release (This=0x2fb99c) returned 0x0 [0072.147] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.147] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.147] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.147] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.147] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.147] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.148] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.148] GetCurrentThreadId () returned 0xa94 [0072.148] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0072.148] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.148] GetCurrentThreadId () returned 0xa94 [0072.148] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0072.148] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0072.148] GetCurrentThreadId () returned 0xa94 [0072.148] GetCurrentThreadId () returned 0xa94 [0072.149] GetCurrentThreadId () returned 0xa94 [0072.149] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.149] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.149] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.158] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0072.158] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0072.158] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2490 [0072.158] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2500 [0072.158] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2560 [0072.158] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0072.158] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.158] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0072.158] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0072.159] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0072.159] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0072.159] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.159] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.159] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0072.159] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0072.159] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0072.159] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0072.159] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0072.159] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.159] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.159] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0072.160] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0072.160] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0072.161] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0072.162] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0072.162] IUnknown:Release (This=0x2f9d40) returned 0x3 [0072.162] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.162] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.163] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.163] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.163] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.163] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.163] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0072.163] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.163] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.163] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.163] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.164] GetCurrentThreadId () returned 0xa94 [0072.164] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.164] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Reference Assemblies\\gmailnotifierpro.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.164] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.165] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.165] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.165] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.165] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.165] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.166] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.166] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.166] GetCurrentThreadId () returned 0xa94 [0072.166] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.166] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Reference Assemblies\\gmailnotifierpro.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.167] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.167] CharLowerBuffW (in: lpsz="C:\\Program Files\\Reference Assemblies\\gmailnotifierpro.exe", cchLength=0x3b | out: lpsz="c:\\program files\\reference assemblies\\gmailnotifierpro.exe") returned 0x3b [0072.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0072.167] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.167] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.167] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd02c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.168] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.168] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0072.168] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0072.168] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18eb84, nSize=0x104 | out: lpFilename="C:\\ProgramData\\zhang.exe" (normalized: "c:\\programdata\\zhang.exe")) returned 0x18 [0072.169] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.169] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0072.169] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0072.169] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0072.169] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.169] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x6) returned 0x1677628 [0072.169] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167c638 | out: hHeap=0x1660000) returned 1 [0072.169] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167c610 | out: hHeap=0x1660000) returned 1 [0072.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0072.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x2fd07c, cchWideChar=6 | out: lpWideCharStr="zhang") returned 6 [0072.169] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1677628 | out: hHeap=0x1660000) returned 1 [0072.169] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.170] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.170] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.170] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.170] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.170] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.170] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.170] SysStringLen (param_1="Name") returned 0x4 [0072.170] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.170] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25c0 [0072.170] SysStringLen (param_1="Name") returned 0x4 [0072.170] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.171] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.171] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.171] GetCurrentThreadId () returned 0xa94 [0072.171] SysStringLen (param_1="Name") returned 0x4 [0072.171] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="gmailnotifierpro.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.171] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.171] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.172] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.172] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.173] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.173] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.173] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.173] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.173] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.173] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.173] GetCurrentThreadId () returned 0xa94 [0072.174] SysStringLen (param_1="Name") returned 0x4 [0072.174] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="gmailnotifierpro.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.174] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0072.175] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.175] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0072.178] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.179] CharLowerBuffW (in: lpsz="[System Process]", cchLength=0x11 | out: lpsz="[system process]") returned 0x11 [0072.184] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0072.186] GetLastError () returned 0x0 [0072.186] CloseHandle (hObject=0x1b8) returned 1 [0072.186] GetLastError () returned 0x0 [0072.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gmailnotifierpro.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gmailnotifierpro.exe", lpUsedDefaultChar=0x0) returned 260 [0072.186] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0072.187] GetLastError () returned 0x0 [0072.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="icq.exe") returned 260 [0072.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.187] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.188] VarBstrCmp (bstrLeft="icq.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.188] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0072.188] GetLastError () returned 0x0 [0072.188] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="leechftp.exe") returned 260 [0072.188] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.189] CharLowerBuffW (in: lpsz="leechftp.exe", cchLength=0xd | out: lpsz="leechftp.exe") returned 0xd [0072.189] VarBstrCmp (bstrLeft="leechftp.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.189] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0072.189] GetLastError () returned 0x0 [0072.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="ncftp.exe") returned 260 [0072.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.190] CharLowerBuffW (in: lpsz="ncftp.exe", cchLength=0xa | out: lpsz="ncftp.exe") returned 0xa [0072.190] VarBstrCmp (bstrLeft="ncftp.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.190] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0072.191] GetLastError () returned 0x0 [0072.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="notepad.exe") returned 260 [0072.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.192] CharLowerBuffW (in: lpsz="notepad.exe", cchLength=0xc | out: lpsz="notepad.exe") returned 0xc [0072.197] VarBstrCmp (bstrLeft="notepad.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.197] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0072.198] GetLastError () returned 0x0 [0072.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="operamail.exe") returned 260 [0072.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.199] CharLowerBuffW (in: lpsz="operamail.exe", cchLength=0xe | out: lpsz="operamail.exe") returned 0xe [0072.199] VarBstrCmp (bstrLeft="operamail.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.199] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0072.200] GetLastError () returned 0x0 [0072.200] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="outlook.exe") returned 260 [0072.200] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.201] CharLowerBuffW (in: lpsz="outlook.exe", cchLength=0xc | out: lpsz="outlook.exe") returned 0xc [0072.201] VarBstrCmp (bstrLeft="outlook.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.201] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0072.201] GetLastError () returned 0x0 [0072.201] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="pidgin.exe") returned 260 [0072.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.202] CharLowerBuffW (in: lpsz="pidgin.exe", cchLength=0xb | out: lpsz="pidgin.exe") returned 0xb [0072.202] VarBstrCmp (bstrLeft="pidgin.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.203] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0072.203] GetLastError () returned 0x0 [0072.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="scriptftp.exe") returned 260 [0072.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.204] CharLowerBuffW (in: lpsz="scriptftp.exe", cchLength=0xe | out: lpsz="scriptftp.exe") returned 0xe [0072.204] VarBstrCmp (bstrLeft="scriptftp.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.204] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0072.205] GetLastError () returned 0x0 [0072.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="skype.exe") returned 260 [0072.205] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.206] CharLowerBuffW (in: lpsz="skype.exe", cchLength=0xa | out: lpsz="skype.exe") returned 0xa [0072.206] VarBstrCmp (bstrLeft="skype.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.206] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0072.206] GetLastError () returned 0x0 [0072.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="smartftp.exe") returned 260 [0072.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.208] CharLowerBuffW (in: lpsz="smartftp.exe", cchLength=0xd | out: lpsz="smartftp.exe") returned 0xd [0072.208] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.208] VarBstrCmp (bstrLeft="smartftp.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smartftp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="smartftp.exe", lpUsedDefaultChar=0x0) returned 260 [0072.209] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0072.209] GetLastError () returned 0x0 [0072.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="thunderbird.exe") returned 260 [0072.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.210] CharLowerBuffW (in: lpsz="thunderbird.exe", cchLength=0x10 | out: lpsz="thunderbird.exe") returned 0x10 [0072.211] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.211] VarBstrCmp (bstrLeft="thunderbird.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="thunderbird.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="thunderbird.exe", lpUsedDefaultChar=0x0) returned 260 [0072.211] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0072.211] GetLastError () returned 0x0 [0072.211] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="totalcmd.exe") returned 260 [0072.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.212] CharLowerBuffW (in: lpsz="totalcmd.exe", cchLength=0xd | out: lpsz="totalcmd.exe") returned 0xd [0072.213] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.213] VarBstrCmp (bstrLeft="totalcmd.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="totalcmd.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="totalcmd.exe", lpUsedDefaultChar=0x0) returned 260 [0072.213] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0072.213] GetLastError () returned 0x0 [0072.213] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="trillian.exe") returned 260 [0072.214] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.214] CharLowerBuffW (in: lpsz="trillian.exe", cchLength=0xd | out: lpsz="trillian.exe") returned 0xd [0072.215] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.215] VarBstrCmp (bstrLeft="trillian.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="trillian.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trillian.exe", lpUsedDefaultChar=0x0) returned 260 [0072.215] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0072.216] GetLastError () returned 0x0 [0072.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="webdrive.exe") returned 260 [0072.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.217] CharLowerBuffW (in: lpsz="webdrive.exe", cchLength=0xd | out: lpsz="webdrive.exe") returned 0xd [0072.217] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.217] VarBstrCmp (bstrLeft="webdrive.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="webdrive.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="webdrive.exe", lpUsedDefaultChar=0x0) returned 260 [0072.217] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0072.218] GetLastError () returned 0x0 [0072.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="whatsapp.exe") returned 260 [0072.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.218] CharLowerBuffW (in: lpsz="whatsapp.exe", cchLength=0xd | out: lpsz="whatsapp.exe") returned 0xd [0072.219] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.219] VarBstrCmp (bstrLeft="whatsapp.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="whatsapp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="whatsapp.exe", lpUsedDefaultChar=0x0) returned 260 [0072.219] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0072.219] GetLastError () returned 0x0 [0072.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="winscp.exe") returned 260 [0072.220] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.220] CharLowerBuffW (in: lpsz="winscp.exe", cchLength=0xb | out: lpsz="winscp.exe") returned 0xb [0072.220] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.220] VarBstrCmp (bstrLeft="winscp.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winscp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="winscp.exe", lpUsedDefaultChar=0x0) returned 260 [0072.221] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0072.221] GetLastError () returned 0x0 [0072.221] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="yahoomessenger.exe") returned 260 [0072.221] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.222] CharLowerBuffW (in: lpsz="yahoomessenger.exe", cchLength=0x13 | out: lpsz="yahoomessenger.exe") returned 0x13 [0072.223] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.223] VarBstrCmp (bstrLeft="yahoomessenger.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="yahoomessenger.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yahoomessenger.exe", lpUsedDefaultChar=0x0) returned 260 [0072.224] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0072.224] GetLastError () returned 0x0 [0072.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="active-charge.exe") returned 260 [0072.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.225] CharLowerBuffW (in: lpsz="active-charge.exe", cchLength=0x12 | out: lpsz="active-charge.exe") returned 0x12 [0072.225] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.225] VarBstrCmp (bstrLeft="active-charge.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="active-charge.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active-charge.exe", lpUsedDefaultChar=0x0) returned 260 [0072.225] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0072.226] GetLastError () returned 0x0 [0072.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="accupos.exe") returned 260 [0072.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.226] CharLowerBuffW (in: lpsz="accupos.exe", cchLength=0xc | out: lpsz="accupos.exe") returned 0xc [0072.227] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.227] VarBstrCmp (bstrLeft="accupos.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="accupos.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accupos.exe", lpUsedDefaultChar=0x0) returned 260 [0072.227] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0072.227] GetLastError () returned 0x0 [0072.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="afr38.exe") returned 260 [0072.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.228] CharLowerBuffW (in: lpsz="afr38.exe", cchLength=0xa | out: lpsz="afr38.exe") returned 0xa [0072.228] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.229] VarBstrCmp (bstrLeft="afr38.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="afr38.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afr38.exe", lpUsedDefaultChar=0x0) returned 260 [0072.229] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0072.229] GetLastError () returned 0x0 [0072.229] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="aldelo.exe") returned 260 [0072.230] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.230] CharLowerBuffW (in: lpsz="aldelo.exe", cchLength=0xb | out: lpsz="aldelo.exe") returned 0xb [0072.231] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.231] VarBstrCmp (bstrLeft="aldelo.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aldelo.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aldelo.exe", lpUsedDefaultChar=0x0) returned 260 [0072.231] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0072.231] GetLastError () returned 0x0 [0072.231] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="ccv_server.exe") returned 260 [0072.232] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.232] CharLowerBuffW (in: lpsz="ccv_server.exe", cchLength=0xf | out: lpsz="ccv_server.exe") returned 0xf [0072.232] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.232] VarBstrCmp (bstrLeft="ccv_server.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ccv_server.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ccv_server.exe", lpUsedDefaultChar=0x0) returned 260 [0072.233] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0072.233] GetLastError () returned 0x0 [0072.233] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="centralcreditcard.exe") returned 260 [0072.233] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.234] CharLowerBuffW (in: lpsz="centralcreditcard.exe", cchLength=0x16 | out: lpsz="centralcreditcard.exe") returned 0x16 [0072.234] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.235] VarBstrCmp (bstrLeft="entralcreditcard.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="centralcreditcard.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="centralcreditcard.exe", lpUsedDefaultChar=0x0) returned 260 [0072.235] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0072.235] GetLastError () returned 0x0 [0072.235] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="creditservice.exe") returned 260 [0072.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.236] CharLowerBuffW (in: lpsz="creditservice.exe", cchLength=0x12 | out: lpsz="creditservice.exe") returned 0x12 [0072.236] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.236] VarBstrCmp (bstrLeft="creditservice.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="creditservice.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="creditservice.exe", lpUsedDefaultChar=0x0) returned 260 [0072.237] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0072.237] GetLastError () returned 0x0 [0072.237] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="edcsvr.exe") returned 260 [0072.237] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.239] CharLowerBuffW (in: lpsz="edcsvr.exe", cchLength=0xb | out: lpsz="edcsvr.exe") returned 0xb [0072.239] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.239] VarBstrCmp (bstrLeft="edcsvr.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="edcsvr.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="edcsvr.exe", lpUsedDefaultChar=0x0) returned 260 [0072.239] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0072.240] GetLastError () returned 0x0 [0072.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="fpos.exe") returned 260 [0072.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.240] CharLowerBuffW (in: lpsz="fpos.exe", cchLength=0x9 | out: lpsz="fpos.exe") returned 0x9 [0072.240] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.241] VarBstrCmp (bstrLeft="fpos.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fpos.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fpos.exe", lpUsedDefaultChar=0x0) returned 260 [0072.241] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0072.241] GetLastError () returned 0x0 [0072.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="isspos.exe") returned 260 [0072.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.242] CharLowerBuffW (in: lpsz="isspos.exe", cchLength=0xb | out: lpsz="isspos.exe") returned 0xb [0072.242] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.242] VarBstrCmp (bstrLeft="isspos.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="isspos.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isspos.exe", lpUsedDefaultChar=0x0) returned 260 [0072.242] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0072.242] GetLastError () returned 0x0 [0072.243] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="mxslipstream.exe") returned 260 [0072.243] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.243] CharLowerBuffW (in: lpsz="mxslipstream.exe", cchLength=0x11 | out: lpsz="mxslipstream.exe") returned 0x11 [0072.243] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.243] VarBstrCmp (bstrLeft="mxslipstream.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mxslipstream.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mxslipstream.exe", lpUsedDefaultChar=0x0) returned 260 [0072.243] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0072.244] GetLastError () returned 0x0 [0072.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="omnipos.exe") returned 260 [0072.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.244] CharLowerBuffW (in: lpsz="omnipos.exe", cchLength=0xc | out: lpsz="omnipos.exe") returned 0xc [0072.244] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.244] VarBstrCmp (bstrLeft="omnipos.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="omnipos.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="omnipos.exe", lpUsedDefaultChar=0x0) returned 260 [0072.245] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0072.245] GetLastError () returned 0x0 [0072.245] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="spcwin.exe") returned 260 [0072.245] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.245] CharLowerBuffW (in: lpsz="spcwin.exe", cchLength=0xb | out: lpsz="spcwin.exe") returned 0xb [0072.246] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.246] VarBstrCmp (bstrLeft="spcwin.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="spcwin.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spcwin.exe", lpUsedDefaultChar=0x0) returned 260 [0072.246] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0072.246] GetLastError () returned 0x0 [0072.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="spgagentservice.exe") returned 260 [0072.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.247] CharLowerBuffW (in: lpsz="spgagentservice.exe", cchLength=0x14 | out: lpsz="spgagentservice.exe") returned 0x14 [0072.247] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.247] VarBstrCmp (bstrLeft="spgagentservice.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="spgagentservice.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spgagentservice.exe", lpUsedDefaultChar=0x0) returned 260 [0072.247] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0072.247] GetLastError () returned 0x0 [0072.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="utg2.exe") returned 260 [0072.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.248] CharLowerBuffW (in: lpsz="utg2.exe", cchLength=0x9 | out: lpsz="utg2.exe") returned 0x9 [0072.248] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.248] VarBstrCmp (bstrLeft="utg2.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="utg2.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="utg2.exe", lpUsedDefaultChar=0x0) returned 260 [0072.249] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notify native.exe")) returned 1 [0072.249] GetLastError () returned 0x0 [0072.249] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="notify native.exe") returned 260 [0072.249] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.250] CharLowerBuffW (in: lpsz="notify native.exe", cchLength=0x12 | out: lpsz="notify native.exe") returned 0x12 [0072.250] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.250] VarBstrCmp (bstrLeft="notify native.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notify native.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notify native.exe", lpUsedDefaultChar=0x0) returned 260 [0072.250] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="holland_resulted_plot.exe")) returned 1 [0072.250] GetLastError () returned 0x0 [0072.250] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="holland_resulted_plot.exe") returned 260 [0072.251] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.251] CharLowerBuffW (in: lpsz="holland_resulted_plot.exe", cchLength=0x1a | out: lpsz="holland_resulted_plot.exe") returned 0x1a [0072.251] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.251] VarBstrCmp (bstrLeft="nd_resulted_plot.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="holland_resulted_plot.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="holland_resulted_plot.exe", lpUsedDefaultChar=0x0) returned 260 [0072.251] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.252] GetLastError () returned 0x0 [0072.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0072.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.252] CharLowerBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xd | out: lpsz="wmiprvse.exe") returned 0xd [0072.252] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.252] VarBstrCmp (bstrLeft="wmiprvse.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WmiPrvSE.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WmiPrvSE.exe", lpUsedDefaultChar=0x0) returned 260 [0072.252] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.253] GetLastError () returned 0x0 [0072.253] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0072.253] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.253] CharLowerBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xd | out: lpsz="wmiprvse.exe") returned 0xd [0072.253] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.253] VarBstrCmp (bstrLeft="wmiprvse.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WmiPrvSE.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WmiPrvSE.exe", lpUsedDefaultChar=0x0) returned 260 [0072.254] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.254] GetLastError () returned 0x0 [0072.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0072.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.255] CharLowerBuffW (in: lpsz="taskhost.exe", cchLength=0xd | out: lpsz="taskhost.exe") returned 0xd [0072.255] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.255] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskhost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskhost.exe", lpUsedDefaultChar=0x0) returned 260 [0072.255] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zhang.exe")) returned 1 [0072.255] GetLastError () returned 0x0 [0072.255] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="zhang.exe") returned 260 [0072.256] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.256] CharLowerBuffW (in: lpsz="zhang.exe", cchLength=0xa | out: lpsz="zhang.exe") returned 0xa [0072.256] CharLowerBuffW (in: lpsz="gmailnotifierpro.exe", cchLength=0x15 | out: lpsz="gmailnotifierpro.exe") returned 0x15 [0072.256] VarBstrCmp (bstrLeft="zhang.exe", bstrRight="gmailnotifierpro.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="zhang.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zhang.exe", lpUsedDefaultChar=0x0) returned 260 [0072.256] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zhang.exe")) returned 0 [0072.257] GetLastError () returned 0x12 [0072.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="zhang.exe") returned 260 [0072.257] CloseHandle (hObject=0x1b4) returned 1 [0072.257] GetLastError () returned 0x0 [0072.257] IUnknown:Release (This=0x4af2010) returned 0x1 [0072.257] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.257] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.257] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.257] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.257] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.257] IUnknown:Release (This=0x4af2010) returned 0x0 [0072.257] IUnknown:Release (This=0x2fb99c) returned 0x0 [0072.258] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.258] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.258] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.258] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.258] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.258] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.258] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.258] GetCurrentThreadId () returned 0xa94 [0072.258] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0072.258] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.258] GetCurrentThreadId () returned 0xa94 [0072.258] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0072.258] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0072.258] GetCurrentThreadId () returned 0xa94 [0072.259] GetCurrentThreadId () returned 0xa94 [0072.259] GetCurrentThreadId () returned 0xa94 [0072.259] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.259] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.259] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.260] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0072.260] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0072.260] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0072.260] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0072.260] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0072.260] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0072.261] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.261] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0072.261] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0072.261] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0072.261] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0072.261] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.261] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.261] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0072.261] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0072.261] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0072.261] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0072.261] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0072.261] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.261] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.262] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0072.262] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0072.262] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0072.262] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0072.263] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0072.263] IUnknown:Release (This=0x2f9d40) returned 0x3 [0072.263] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.263] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.263] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.263] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.263] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.263] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.264] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0072.264] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.264] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.264] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.264] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.264] GetCurrentThreadId () returned 0xa94 [0072.264] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.264] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Common Files\\icq.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.264] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.264] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.264] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.264] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.265] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.265] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.265] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.265] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.265] GetCurrentThreadId () returned 0xa94 [0072.265] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.265] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Common Files\\icq.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.265] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.265] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\icq.exe", cchLength=0x26 | out: lpsz="c:\\program files\\common files\\icq.exe") returned 0x26 [0072.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0072.265] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.265] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.265] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd07c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.266] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.266] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0072.266] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0072.266] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18eb84, nSize=0x104 | out: lpFilename="C:\\ProgramData\\zhang.exe" (normalized: "c:\\programdata\\zhang.exe")) returned 0x18 [0072.266] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.266] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0072.266] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0072.266] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0072.266] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.266] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x6) returned 0x1677628 [0072.266] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167c638 | out: hHeap=0x1660000) returned 1 [0072.266] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167c610 | out: hHeap=0x1660000) returned 1 [0072.267] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0072.267] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x2fd0a4, cchWideChar=6 | out: lpWideCharStr="zhang") returned 6 [0072.267] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1677628 | out: hHeap=0x1660000) returned 1 [0072.267] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.267] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.267] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.267] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.267] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.267] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.267] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.268] SysStringLen (param_1="Name") returned 0x4 [0072.268] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.268] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a0 [0072.268] SysStringLen (param_1="Name") returned 0x4 [0072.268] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.268] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.268] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.268] GetCurrentThreadId () returned 0xa94 [0072.268] SysStringLen (param_1="Name") returned 0x4 [0072.268] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="icq.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.269] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.269] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.269] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.270] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.270] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.270] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.270] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.270] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.270] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.270] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.270] GetCurrentThreadId () returned 0xa94 [0072.270] SysStringLen (param_1="Name") returned 0x4 [0072.270] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="icq.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.271] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0072.271] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.271] GetLastError () returned 0x0 [0072.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpWideCharStr=0x18eb7c, cchWideChar=128 | out: lpWideCharStr="Service Pack 1") returned 128 [0072.271] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0072.273] GetLastError () returned 0x0 [0072.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=260, lpMultiByteStr=0x18e8d8, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 260 [0072.274] Process32First (in: hSnapshot=0x1b4, lppe=0x18e8b4 | out: lppe=0x18e8b4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.274] GetLastError () returned 0x0 [0072.274] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e8d8, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="[System Process]") returned 260 [0072.274] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.275] CharLowerBuffW (in: lpsz="[System Process]", cchLength=0x11 | out: lpsz="[system process]") returned 0x11 [0072.275] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.275] VarBstrCmp (bstrLeft="rocess]", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="[System Process]", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[System Process]", lpUsedDefaultChar=0x0) returned 260 [0072.275] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0072.276] GetLastError () returned 0x0 [0072.276] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="System") returned 260 [0072.276] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.276] CharLowerBuffW (in: lpsz="System", cchLength=0x7 | out: lpsz="system") returned 0x7 [0072.276] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.276] VarBstrCmp (bstrLeft="system", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="System", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="System", lpUsedDefaultChar=0x0) returned 260 [0072.277] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0072.277] GetLastError () returned 0x0 [0072.277] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="smss.exe") returned 260 [0072.277] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.278] CharLowerBuffW (in: lpsz="smss.exe", cchLength=0x9 | out: lpsz="smss.exe") returned 0x9 [0072.278] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.278] VarBstrCmp (bstrLeft="mss.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smss.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="smss.exe", lpUsedDefaultChar=0x0) returned 260 [0072.278] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.279] GetLastError () returned 0x0 [0072.279] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0072.279] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.279] CharLowerBuffW (in: lpsz="csrss.exe", cchLength=0xa | out: lpsz="csrss.exe") returned 0xa [0072.279] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.279] VarBstrCmp (bstrLeft="rss.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csrss.exe", lpUsedDefaultChar=0x0) returned 260 [0072.280] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0072.280] GetLastError () returned 0x0 [0072.280] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="wininit.exe") returned 260 [0072.280] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.281] CharLowerBuffW (in: lpsz="wininit.exe", cchLength=0xc | out: lpsz="wininit.exe") returned 0xc [0072.281] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.281] VarBstrCmp (bstrLeft="nit.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wininit.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wininit.exe", lpUsedDefaultChar=0x0) returned 260 [0072.281] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.281] GetLastError () returned 0x0 [0072.282] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0072.282] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.282] CharLowerBuffW (in: lpsz="csrss.exe", cchLength=0xa | out: lpsz="csrss.exe") returned 0xa [0072.282] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.282] VarBstrCmp (bstrLeft="rss.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csrss.exe", lpUsedDefaultChar=0x0) returned 260 [0072.282] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0072.283] GetLastError () returned 0x0 [0072.283] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="winlogon.exe") returned 260 [0072.283] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.283] CharLowerBuffW (in: lpsz="winlogon.exe", cchLength=0xd | out: lpsz="winlogon.exe") returned 0xd [0072.283] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.283] VarBstrCmp (bstrLeft="gon.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winlogon.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="winlogon.exe", lpUsedDefaultChar=0x0) returned 260 [0072.284] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0072.284] GetLastError () returned 0x0 [0072.284] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="services.exe") returned 260 [0072.284] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.284] CharLowerBuffW (in: lpsz="services.exe", cchLength=0xd | out: lpsz="services.exe") returned 0xd [0072.284] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.285] VarBstrCmp (bstrLeft="ces.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services.exe", lpUsedDefaultChar=0x0) returned 260 [0072.285] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0072.285] GetLastError () returned 0x0 [0072.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="lsass.exe") returned 260 [0072.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.286] CharLowerBuffW (in: lpsz="lsass.exe", cchLength=0xa | out: lpsz="lsass.exe") returned 0xa [0072.286] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.286] VarBstrCmp (bstrLeft="ass.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsass.exe", lpUsedDefaultChar=0x0) returned 260 [0072.286] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0072.286] GetLastError () returned 0x0 [0072.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="lsm.exe") returned 260 [0072.287] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.287] CharLowerBuffW (in: lpsz="lsm.exe", cchLength=0x8 | out: lpsz="lsm.exe") returned 0x8 [0072.287] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.287] VarBstrCmp (bstrLeft="lsm.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsm.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsm.exe", lpUsedDefaultChar=0x0) returned 260 [0072.287] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.288] GetLastError () returned 0x0 [0072.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.288] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0072.288] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.288] VarBstrCmp (bstrLeft="ost.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0072.288] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.289] GetLastError () returned 0x0 [0072.289] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.289] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.289] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0072.289] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.289] VarBstrCmp (bstrLeft="ost.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0072.289] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.289] GetLastError () returned 0x0 [0072.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.290] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0072.290] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.290] VarBstrCmp (bstrLeft="ost.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0072.290] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.291] GetLastError () returned 0x0 [0072.291] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.291] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.291] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0072.291] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.291] VarBstrCmp (bstrLeft="ost.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0072.291] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.292] GetLastError () returned 0x0 [0072.292] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.292] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.292] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0072.292] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.292] VarBstrCmp (bstrLeft="ost.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0072.292] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0072.293] GetLastError () returned 0x0 [0072.293] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="audiodg.exe") returned 260 [0072.293] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.293] CharLowerBuffW (in: lpsz="audiodg.exe", cchLength=0xc | out: lpsz="audiodg.exe") returned 0xc [0072.293] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.293] VarBstrCmp (bstrLeft="odg.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiodg.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiodg.exe", lpUsedDefaultChar=0x0) returned 260 [0072.293] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.294] GetLastError () returned 0x0 [0072.294] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.294] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.295] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0072.295] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.295] VarBstrCmp (bstrLeft="ost.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0072.295] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.296] GetLastError () returned 0x0 [0072.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.296] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0072.296] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.296] VarBstrCmp (bstrLeft="ost.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0072.297] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0072.297] GetLastError () returned 0x0 [0072.297] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="dwm.exe") returned 260 [0072.297] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.297] CharLowerBuffW (in: lpsz="dwm.exe", cchLength=0x8 | out: lpsz="dwm.exe") returned 0x8 [0072.297] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.297] VarBstrCmp (bstrLeft="dwm.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dwm.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwm.exe", lpUsedDefaultChar=0x0) returned 260 [0072.298] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0072.298] GetLastError () returned 0x0 [0072.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="explorer.exe") returned 260 [0072.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.298] CharLowerBuffW (in: lpsz="explorer.exe", cchLength=0xd | out: lpsz="explorer.exe") returned 0xd [0072.299] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.299] VarBstrCmp (bstrLeft="rer.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer.exe", lpUsedDefaultChar=0x0) returned 260 [0072.299] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0072.299] GetLastError () returned 0x0 [0072.299] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="spoolsv.exe") returned 260 [0072.299] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.299] CharLowerBuffW (in: lpsz="spoolsv.exe", cchLength=0xc | out: lpsz="spoolsv.exe") returned 0xc [0072.300] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.300] VarBstrCmp (bstrLeft="lsv.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="spoolsv.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spoolsv.exe", lpUsedDefaultChar=0x0) returned 260 [0072.300] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.300] GetLastError () returned 0x0 [0072.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.301] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0072.301] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.301] VarBstrCmp (bstrLeft="ost.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0072.301] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.302] GetLastError () returned 0x0 [0072.302] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0072.302] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.302] CharLowerBuffW (in: lpsz="taskhost.exe", cchLength=0xd | out: lpsz="taskhost.exe") returned 0xd [0072.302] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.302] VarBstrCmp (bstrLeft="ost.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskhost.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskhost.exe", lpUsedDefaultChar=0x0) returned 260 [0072.302] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0072.303] GetLastError () returned 0x0 [0072.303] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="taskeng.exe") returned 260 [0072.303] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.303] CharLowerBuffW (in: lpsz="taskeng.exe", cchLength=0xc | out: lpsz="taskeng.exe") returned 0xc [0072.303] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.303] VarBstrCmp (bstrLeft="eng.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskeng.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskeng.exe", lpUsedDefaultChar=0x0) returned 260 [0072.303] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0072.304] GetLastError () returned 0x0 [0072.304] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="icq.exe") returned 260 [0072.304] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.304] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.304] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.304] VarBstrCmp (bstrLeft="icq.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x1 [0072.305] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=1, dwProcessId=0x124) returned 0x1b8 [0072.305] GetLastError () returned 0x0 [0072.305] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0072.307] GetLastError () returned 0x0 [0072.307] CloseHandle (hObject=0x1b8) returned 1 [0072.307] GetLastError () returned 0x0 [0072.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="icq.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icq.exe", lpUsedDefaultChar=0x0) returned 260 [0072.307] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0072.308] GetLastError () returned 0x0 [0072.308] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="leechftp.exe") returned 260 [0072.308] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.308] CharLowerBuffW (in: lpsz="leechftp.exe", cchLength=0xd | out: lpsz="leechftp.exe") returned 0xd [0072.308] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.308] VarBstrCmp (bstrLeft="ftp.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="leechftp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="leechftp.exe", lpUsedDefaultChar=0x0) returned 260 [0072.308] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0072.309] GetLastError () returned 0x0 [0072.309] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="ncftp.exe") returned 260 [0072.309] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.309] CharLowerBuffW (in: lpsz="ncftp.exe", cchLength=0xa | out: lpsz="ncftp.exe") returned 0xa [0072.309] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.309] VarBstrCmp (bstrLeft="ftp.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ncftp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ncftp.exe", lpUsedDefaultChar=0x0) returned 260 [0072.310] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0072.310] GetLastError () returned 0x0 [0072.310] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="notepad.exe") returned 260 [0072.310] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.311] CharLowerBuffW (in: lpsz="notepad.exe", cchLength=0xc | out: lpsz="notepad.exe") returned 0xc [0072.311] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.311] VarBstrCmp (bstrLeft="pad.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="notepad.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad.exe", lpUsedDefaultChar=0x0) returned 260 [0072.311] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0072.312] GetLastError () returned 0x0 [0072.312] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="operamail.exe") returned 260 [0072.312] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.312] CharLowerBuffW (in: lpsz="operamail.exe", cchLength=0xe | out: lpsz="operamail.exe") returned 0xe [0072.313] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.313] VarBstrCmp (bstrLeft="ail.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="operamail.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="operamail.exe", lpUsedDefaultChar=0x0) returned 260 [0072.313] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0072.313] GetLastError () returned 0x0 [0072.313] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="outlook.exe") returned 260 [0072.314] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.314] CharLowerBuffW (in: lpsz="outlook.exe", cchLength=0xc | out: lpsz="outlook.exe") returned 0xc [0072.314] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.314] VarBstrCmp (bstrLeft="ook.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="outlook.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="outlook.exe", lpUsedDefaultChar=0x0) returned 260 [0072.315] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0072.315] GetLastError () returned 0x0 [0072.315] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="pidgin.exe") returned 260 [0072.315] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.315] CharLowerBuffW (in: lpsz="pidgin.exe", cchLength=0xb | out: lpsz="pidgin.exe") returned 0xb [0072.316] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.316] VarBstrCmp (bstrLeft="gin.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pidgin.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pidgin.exe", lpUsedDefaultChar=0x0) returned 260 [0072.316] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0072.316] GetLastError () returned 0x0 [0072.316] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="scriptftp.exe") returned 260 [0072.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.317] CharLowerBuffW (in: lpsz="scriptftp.exe", cchLength=0xe | out: lpsz="scriptftp.exe") returned 0xe [0072.317] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.317] VarBstrCmp (bstrLeft="ftp.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="scriptftp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scriptftp.exe", lpUsedDefaultChar=0x0) returned 260 [0072.317] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0072.318] GetLastError () returned 0x0 [0072.318] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="skype.exe") returned 260 [0072.318] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.318] CharLowerBuffW (in: lpsz="skype.exe", cchLength=0xa | out: lpsz="skype.exe") returned 0xa [0072.318] CharLowerBuffW (in: lpsz="icq.exe", cchLength=0x8 | out: lpsz="icq.exe") returned 0x8 [0072.318] VarBstrCmp (bstrLeft="ype.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="skype.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="skype.exe", lpUsedDefaultChar=0x0) returned 260 [0072.319] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0072.319] GetLastError () returned 0x0 [0072.319] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="smartftp.exe") returned 260 [0072.319] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.320] CharLowerBuffW (in: lpsz="smartftp.exe", cchLength=0xd | out: lpsz="smartftp.exe") returned 0xd [0072.320] VarBstrCmp (bstrLeft="ftp.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.320] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0072.321] GetLastError () returned 0x0 [0072.321] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="thunderbird.exe") returned 260 [0072.321] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.321] CharLowerBuffW (in: lpsz="thunderbird.exe", cchLength=0x10 | out: lpsz="thunderbird.exe") returned 0x10 [0072.322] VarBstrCmp (bstrLeft="ird.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.322] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0072.322] GetLastError () returned 0x0 [0072.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="totalcmd.exe") returned 260 [0072.323] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.323] CharLowerBuffW (in: lpsz="totalcmd.exe", cchLength=0xd | out: lpsz="totalcmd.exe") returned 0xd [0072.323] VarBstrCmp (bstrLeft="cmd.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.323] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0072.324] GetLastError () returned 0x0 [0072.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="trillian.exe") returned 260 [0072.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.325] CharLowerBuffW (in: lpsz="trillian.exe", cchLength=0xd | out: lpsz="trillian.exe") returned 0xd [0072.325] VarBstrCmp (bstrLeft="ian.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.325] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0072.325] GetLastError () returned 0x0 [0072.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="webdrive.exe") returned 260 [0072.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.326] CharLowerBuffW (in: lpsz="webdrive.exe", cchLength=0xd | out: lpsz="webdrive.exe") returned 0xd [0072.327] VarBstrCmp (bstrLeft="ive.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.327] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0072.327] GetLastError () returned 0x0 [0072.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="whatsapp.exe") returned 260 [0072.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.328] CharLowerBuffW (in: lpsz="whatsapp.exe", cchLength=0xd | out: lpsz="whatsapp.exe") returned 0xd [0072.328] VarBstrCmp (bstrLeft="app.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.328] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0072.329] GetLastError () returned 0x0 [0072.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="winscp.exe") returned 260 [0072.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.330] CharLowerBuffW (in: lpsz="winscp.exe", cchLength=0xb | out: lpsz="winscp.exe") returned 0xb [0072.330] VarBstrCmp (bstrLeft="scp.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.330] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0072.330] GetLastError () returned 0x0 [0072.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="yahoomessenger.exe") returned 260 [0072.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.337] CharLowerBuffW (in: lpsz="yahoomessenger.exe", cchLength=0x13 | out: lpsz="yahoomessenger.exe") returned 0x13 [0072.337] VarBstrCmp (bstrLeft="ger.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.337] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0072.337] GetLastError () returned 0x0 [0072.338] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="active-charge.exe") returned 260 [0072.338] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.338] CharLowerBuffW (in: lpsz="active-charge.exe", cchLength=0x12 | out: lpsz="active-charge.exe") returned 0x12 [0072.338] VarBstrCmp (bstrLeft="rge.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.338] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0072.339] GetLastError () returned 0x0 [0072.339] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="accupos.exe") returned 260 [0072.339] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.340] CharLowerBuffW (in: lpsz="accupos.exe", cchLength=0xc | out: lpsz="accupos.exe") returned 0xc [0072.340] VarBstrCmp (bstrLeft="pos.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.340] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0072.340] GetLastError () returned 0x0 [0072.340] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="afr38.exe") returned 260 [0072.340] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.341] CharLowerBuffW (in: lpsz="afr38.exe", cchLength=0xa | out: lpsz="afr38.exe") returned 0xa [0072.341] VarBstrCmp (bstrLeft="r38.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.341] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0072.341] GetLastError () returned 0x0 [0072.341] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="aldelo.exe") returned 260 [0072.341] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.342] CharLowerBuffW (in: lpsz="aldelo.exe", cchLength=0xb | out: lpsz="aldelo.exe") returned 0xb [0072.342] VarBstrCmp (bstrLeft="elo.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.342] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0072.342] GetLastError () returned 0x0 [0072.343] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="ccv_server.exe") returned 260 [0072.343] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.343] CharLowerBuffW (in: lpsz="ccv_server.exe", cchLength=0xf | out: lpsz="ccv_server.exe") returned 0xf [0072.343] VarBstrCmp (bstrLeft="ver.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.344] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0072.344] GetLastError () returned 0x0 [0072.344] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="centralcreditcard.exe") returned 260 [0072.344] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.345] CharLowerBuffW (in: lpsz="centralcreditcard.exe", cchLength=0x16 | out: lpsz="centralcreditcard.exe") returned 0x16 [0072.345] VarBstrCmp (bstrLeft="ard.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.345] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0072.345] GetLastError () returned 0x0 [0072.346] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="creditservice.exe") returned 260 [0072.346] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.346] CharLowerBuffW (in: lpsz="creditservice.exe", cchLength=0x12 | out: lpsz="creditservice.exe") returned 0x12 [0072.347] VarBstrCmp (bstrLeft="ice.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.347] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0072.347] GetLastError () returned 0x0 [0072.348] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="edcsvr.exe") returned 260 [0072.348] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.349] CharLowerBuffW (in: lpsz="edcsvr.exe", cchLength=0xb | out: lpsz="edcsvr.exe") returned 0xb [0072.349] VarBstrCmp (bstrLeft="svr.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.349] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0072.349] GetLastError () returned 0x0 [0072.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="fpos.exe") returned 260 [0072.350] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.350] CharLowerBuffW (in: lpsz="fpos.exe", cchLength=0x9 | out: lpsz="fpos.exe") returned 0x9 [0072.350] VarBstrCmp (bstrLeft="pos.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.350] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0072.351] GetLastError () returned 0x0 [0072.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="isspos.exe") returned 260 [0072.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.351] CharLowerBuffW (in: lpsz="isspos.exe", cchLength=0xb | out: lpsz="isspos.exe") returned 0xb [0072.351] VarBstrCmp (bstrLeft="pos.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.352] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0072.352] GetLastError () returned 0x0 [0072.352] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="mxslipstream.exe") returned 260 [0072.352] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.353] CharLowerBuffW (in: lpsz="mxslipstream.exe", cchLength=0x11 | out: lpsz="mxslipstream.exe") returned 0x11 [0072.353] VarBstrCmp (bstrLeft="eam.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.353] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0072.353] GetLastError () returned 0x0 [0072.353] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="omnipos.exe") returned 260 [0072.354] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.354] CharLowerBuffW (in: lpsz="omnipos.exe", cchLength=0xc | out: lpsz="omnipos.exe") returned 0xc [0072.354] VarBstrCmp (bstrLeft="pos.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.355] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0072.355] GetLastError () returned 0x0 [0072.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="spcwin.exe") returned 260 [0072.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.356] CharLowerBuffW (in: lpsz="spcwin.exe", cchLength=0xb | out: lpsz="spcwin.exe") returned 0xb [0072.356] VarBstrCmp (bstrLeft="win.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.356] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0072.357] GetLastError () returned 0x0 [0072.357] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="spgagentservice.exe") returned 260 [0072.357] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.357] CharLowerBuffW (in: lpsz="spgagentservice.exe", cchLength=0x14 | out: lpsz="spgagentservice.exe") returned 0x14 [0072.358] VarBstrCmp (bstrLeft="ice.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.358] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0072.358] GetLastError () returned 0x0 [0072.358] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="utg2.exe") returned 260 [0072.359] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.359] CharLowerBuffW (in: lpsz="utg2.exe", cchLength=0x9 | out: lpsz="utg2.exe") returned 0x9 [0072.359] VarBstrCmp (bstrLeft="tg2.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.360] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notify native.exe")) returned 1 [0072.360] GetLastError () returned 0x0 [0072.360] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="notify native.exe") returned 260 [0072.360] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.361] CharLowerBuffW (in: lpsz="notify native.exe", cchLength=0x12 | out: lpsz="notify native.exe") returned 0x12 [0072.361] VarBstrCmp (bstrLeft="ive.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.361] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="holland_resulted_plot.exe")) returned 1 [0072.362] GetLastError () returned 0x0 [0072.362] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="holland_resulted_plot.exe") returned 260 [0072.362] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.363] CharLowerBuffW (in: lpsz="holland_resulted_plot.exe", cchLength=0x1a | out: lpsz="holland_resulted_plot.exe") returned 0x1a [0072.363] VarBstrCmp (bstrLeft="lot.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.364] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.364] GetLastError () returned 0x0 [0072.364] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0072.365] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.365] CharLowerBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xd | out: lpsz="wmiprvse.exe") returned 0xd [0072.365] VarBstrCmp (bstrLeft="vse.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.366] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.366] GetLastError () returned 0x0 [0072.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0072.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.367] CharLowerBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xd | out: lpsz="wmiprvse.exe") returned 0xd [0072.367] VarBstrCmp (bstrLeft="vse.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.367] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.368] GetLastError () returned 0x0 [0072.368] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0072.368] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.369] CharLowerBuffW (in: lpsz="taskhost.exe", cchLength=0xd | out: lpsz="taskhost.exe") returned 0xd [0072.369] VarBstrCmp (bstrLeft="ost.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.369] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zhang.exe")) returned 1 [0072.370] GetLastError () returned 0x0 [0072.370] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="zhang.exe") returned 260 [0072.370] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f86e4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.371] CharLowerBuffW (in: lpsz="zhang.exe", cchLength=0xa | out: lpsz="zhang.exe") returned 0xa [0072.371] VarBstrCmp (bstrLeft="ang.exe", bstrRight="icq.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.371] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zhang.exe")) returned 0 [0072.371] GetLastError () returned 0x12 [0072.372] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="zhang.exe") returned 260 [0072.372] CloseHandle (hObject=0x1b4) returned 1 [0072.372] GetLastError () returned 0x0 [0072.372] IUnknown:Release (This=0x4af2010) returned 0x1 [0072.372] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.372] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.373] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.373] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.373] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.373] IUnknown:Release (This=0x4af2010) returned 0x0 [0072.373] IUnknown:Release (This=0x2fb99c) returned 0x0 [0072.373] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.373] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.373] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.373] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.374] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.374] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.374] GetCurrentThreadId () returned 0xa94 [0072.374] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0072.374] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.374] GetCurrentThreadId () returned 0xa94 [0072.375] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0072.375] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0072.375] GetCurrentThreadId () returned 0xa94 [0072.375] GetCurrentThreadId () returned 0xa94 [0072.375] GetCurrentThreadId () returned 0xa94 [0072.376] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.376] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.376] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.378] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0072.378] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0072.378] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0072.379] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0072.379] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0072.379] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0072.379] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.379] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0072.379] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0072.379] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0072.380] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0072.380] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.380] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.380] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0072.380] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0072.381] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0072.381] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0072.381] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0072.381] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.381] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.381] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0072.382] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0072.382] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0072.382] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0072.384] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0072.384] IUnknown:Release (This=0x2f9d40) returned 0x3 [0072.384] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.384] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.384] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.384] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.384] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.384] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.384] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0072.385] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.385] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.385] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.385] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.385] GetCurrentThreadId () returned 0xa94 [0072.385] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.385] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\DVD Maker\\leechftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.386] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.386] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.386] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.386] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.386] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.386] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.387] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.387] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.387] GetCurrentThreadId () returned 0xa94 [0072.387] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.387] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\DVD Maker\\leechftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.387] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.388] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\leechftp.exe", cchLength=0x28 | out: lpsz="c:\\program files\\dvd maker\\leechftp.exe") returned 0x28 [0072.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0072.388] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.388] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.388] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.389] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd11c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.389] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.389] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0072.389] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0072.389] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18eb84, nSize=0x104 | out: lpFilename="C:\\ProgramData\\zhang.exe" (normalized: "c:\\programdata\\zhang.exe")) returned 0x18 [0072.390] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.390] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0072.390] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0072.390] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0072.390] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.390] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.391] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.391] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.391] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.391] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.391] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.391] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.391] SysStringLen (param_1="Name") returned 0x4 [0072.392] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.392] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0072.392] SysStringLen (param_1="Name") returned 0x4 [0072.392] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.392] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.393] GetCurrentThreadId () returned 0xa94 [0072.393] SysStringLen (param_1="Name") returned 0x4 [0072.393] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="leechftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.394] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.394] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.395] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.395] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.395] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.395] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.395] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.395] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.396] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.396] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.396] GetCurrentThreadId () returned 0xa94 [0072.396] SysStringLen (param_1="Name") returned 0x4 [0072.396] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="leechftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.397] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0072.397] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.397] GetLastError () returned 0x0 [0072.397] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpWideCharStr=0x18eb7c, cchWideChar=128 | out: lpWideCharStr="Service Pack 1") returned 128 [0072.398] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0072.400] GetLastError () returned 0x0 [0072.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=260, lpMultiByteStr=0x18e8d8, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 260 [0072.401] Process32First (in: hSnapshot=0x1b4, lppe=0x18e8b4 | out: lppe=0x18e8b4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.401] GetLastError () returned 0x0 [0072.401] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e8d8, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="[System Process]") returned 260 [0072.402] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.402] CharLowerBuffW (in: lpsz="[System Process]", cchLength=0x11 | out: lpsz="[system process]") returned 0x11 [0072.402] VarBstrCmp (bstrLeft="tem process]", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.402] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0072.403] GetLastError () returned 0x0 [0072.403] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="System") returned 260 [0072.403] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.404] CharLowerBuffW (in: lpsz="System", cchLength=0x7 | out: lpsz="system") returned 0x7 [0072.404] VarBstrCmp (bstrLeft="system", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.404] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0072.404] GetLastError () returned 0x0 [0072.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="smss.exe") returned 260 [0072.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.405] CharLowerBuffW (in: lpsz="smss.exe", cchLength=0x9 | out: lpsz="smss.exe") returned 0x9 [0072.405] VarBstrCmp (bstrLeft="smss.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.406] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.406] GetLastError () returned 0x0 [0072.406] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0072.406] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.406] CharLowerBuffW (in: lpsz="csrss.exe", cchLength=0xa | out: lpsz="csrss.exe") returned 0xa [0072.407] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.407] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0072.407] GetLastError () returned 0x0 [0072.407] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="wininit.exe") returned 260 [0072.407] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.408] CharLowerBuffW (in: lpsz="wininit.exe", cchLength=0xc | out: lpsz="wininit.exe") returned 0xc [0072.408] VarBstrCmp (bstrLeft="wininit.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.408] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.409] GetLastError () returned 0x0 [0072.409] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0072.410] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.410] CharLowerBuffW (in: lpsz="csrss.exe", cchLength=0xa | out: lpsz="csrss.exe") returned 0xa [0072.411] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.411] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0072.411] GetLastError () returned 0x0 [0072.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="winlogon.exe") returned 260 [0072.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.412] CharLowerBuffW (in: lpsz="winlogon.exe", cchLength=0xd | out: lpsz="winlogon.exe") returned 0xd [0072.412] VarBstrCmp (bstrLeft="winlogon.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.412] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0072.413] GetLastError () returned 0x0 [0072.413] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="services.exe") returned 260 [0072.413] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.413] CharLowerBuffW (in: lpsz="services.exe", cchLength=0xd | out: lpsz="services.exe") returned 0xd [0072.414] VarBstrCmp (bstrLeft="services.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.414] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0072.414] GetLastError () returned 0x0 [0072.414] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="lsass.exe") returned 260 [0072.414] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.415] CharLowerBuffW (in: lpsz="lsass.exe", cchLength=0xa | out: lpsz="lsass.exe") returned 0xa [0072.415] VarBstrCmp (bstrLeft="lsass.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.415] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0072.415] GetLastError () returned 0x0 [0072.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="lsm.exe") returned 260 [0072.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.416] CharLowerBuffW (in: lpsz="lsm.exe", cchLength=0x8 | out: lpsz="lsm.exe") returned 0x8 [0072.416] VarBstrCmp (bstrLeft="lsm.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.416] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.416] GetLastError () returned 0x0 [0072.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.417] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0072.417] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.417] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.418] GetLastError () returned 0x0 [0072.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.418] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0072.418] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.418] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.419] GetLastError () returned 0x0 [0072.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.420] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0072.420] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.420] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.421] GetLastError () returned 0x0 [0072.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.422] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0072.422] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.422] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.423] GetLastError () returned 0x0 [0072.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.424] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0072.424] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.424] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0072.424] GetLastError () returned 0x0 [0072.425] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="audiodg.exe") returned 260 [0072.425] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.426] VarBstrCmp (bstrLeft="audiodg.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.426] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.426] GetLastError () returned 0x0 [0072.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.427] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.427] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.428] GetLastError () returned 0x0 [0072.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.428] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.428] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0072.429] GetLastError () returned 0x0 [0072.429] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="dwm.exe") returned 260 [0072.429] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.430] VarBstrCmp (bstrLeft="dwm.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.430] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0072.430] GetLastError () returned 0x0 [0072.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="explorer.exe") returned 260 [0072.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.431] VarBstrCmp (bstrLeft="explorer.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.431] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0072.431] GetLastError () returned 0x0 [0072.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="spoolsv.exe") returned 260 [0072.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.432] VarBstrCmp (bstrLeft="spoolsv.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.432] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.432] GetLastError () returned 0x0 [0072.433] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.433] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.433] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.433] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.434] GetLastError () returned 0x0 [0072.434] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0072.434] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.434] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.434] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0072.435] GetLastError () returned 0x0 [0072.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="taskeng.exe") returned 260 [0072.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.435] VarBstrCmp (bstrLeft="taskeng.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.435] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0072.436] GetLastError () returned 0x0 [0072.436] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="leechftp.exe") returned 260 [0072.436] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.436] VarBstrCmp (bstrLeft="leechftp.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x1 [0072.437] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0072.440] GetLastError () returned 0x0 [0072.440] CloseHandle (hObject=0x1b8) returned 1 [0072.440] GetLastError () returned 0x0 [0072.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="leechftp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="leechftp.exe", lpUsedDefaultChar=0x0) returned 260 [0072.440] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0072.441] GetLastError () returned 0x0 [0072.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="ncftp.exe") returned 260 [0072.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.441] VarBstrCmp (bstrLeft="ncftp.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.442] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0072.442] GetLastError () returned 0x0 [0072.442] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="notepad.exe") returned 260 [0072.442] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.443] VarBstrCmp (bstrLeft="notepad.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.443] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0072.443] GetLastError () returned 0x0 [0072.443] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="operamail.exe") returned 260 [0072.443] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.444] VarBstrCmp (bstrLeft="peramail.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.444] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0072.444] GetLastError () returned 0x0 [0072.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="outlook.exe") returned 260 [0072.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.445] VarBstrCmp (bstrLeft="outlook.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.445] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0072.445] GetLastError () returned 0x0 [0072.445] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="pidgin.exe") returned 260 [0072.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.446] VarBstrCmp (bstrLeft="pidgin.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.446] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0072.446] GetLastError () returned 0x0 [0072.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="scriptftp.exe") returned 260 [0072.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.447] VarBstrCmp (bstrLeft="criptftp.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.447] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0072.448] GetLastError () returned 0x0 [0072.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="skype.exe") returned 260 [0072.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e740, cbMultiByte=1, lpWideCharStr=0x2f872c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0072.448] VarBstrCmp (bstrLeft="skype.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.448] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0072.449] GetLastError () returned 0x0 [0072.449] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="smartftp.exe") returned 260 [0072.449] VarBstrCmp (bstrLeft="smartftp.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.449] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0072.450] GetLastError () returned 0x0 [0072.450] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="thunderbird.exe") returned 260 [0072.450] VarBstrCmp (bstrLeft="nderbird.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.450] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0072.451] GetLastError () returned 0x0 [0072.451] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="totalcmd.exe") returned 260 [0072.451] VarBstrCmp (bstrLeft="totalcmd.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.451] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0072.451] GetLastError () returned 0x0 [0072.451] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="trillian.exe") returned 260 [0072.452] VarBstrCmp (bstrLeft="trillian.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.452] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0072.452] GetLastError () returned 0x0 [0072.452] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="webdrive.exe") returned 260 [0072.452] VarBstrCmp (bstrLeft="webdrive.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.453] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0072.453] GetLastError () returned 0x0 [0072.453] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="whatsapp.exe") returned 260 [0072.453] VarBstrCmp (bstrLeft="whatsapp.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.453] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0072.454] GetLastError () returned 0x0 [0072.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="winscp.exe") returned 260 [0072.454] VarBstrCmp (bstrLeft="winscp.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.454] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0072.455] GetLastError () returned 0x0 [0072.455] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="yahoomessenger.exe") returned 260 [0072.455] VarBstrCmp (bstrLeft="essenger.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.455] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0072.455] GetLastError () returned 0x0 [0072.456] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="active-charge.exe") returned 260 [0072.456] VarBstrCmp (bstrLeft="e-charge.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.456] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0072.464] GetLastError () returned 0x0 [0072.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="accupos.exe") returned 260 [0072.464] VarBstrCmp (bstrLeft="accupos.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.464] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0072.464] GetLastError () returned 0x0 [0072.465] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="afr38.exe") returned 260 [0072.465] VarBstrCmp (bstrLeft="afr38.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.465] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0072.465] GetLastError () returned 0x0 [0072.465] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="aldelo.exe") returned 260 [0072.466] VarBstrCmp (bstrLeft="aldelo.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.466] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0072.466] GetLastError () returned 0x0 [0072.466] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="ccv_server.exe") returned 260 [0072.466] VarBstrCmp (bstrLeft="v_server.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.466] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0072.467] GetLastError () returned 0x0 [0072.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="centralcreditcard.exe") returned 260 [0072.467] VarBstrCmp (bstrLeft="editcard.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.467] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0072.467] GetLastError () returned 0x0 [0072.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="creditservice.exe") returned 260 [0072.468] VarBstrCmp (bstrLeft="tservice.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.468] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0072.468] GetLastError () returned 0x0 [0072.468] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="edcsvr.exe") returned 260 [0072.468] VarBstrCmp (bstrLeft="edcsvr.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.469] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0072.469] GetLastError () returned 0x0 [0072.469] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="fpos.exe") returned 260 [0072.469] VarBstrCmp (bstrLeft="fpos.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.469] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0072.470] GetLastError () returned 0x0 [0072.470] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="isspos.exe") returned 260 [0072.470] VarBstrCmp (bstrLeft="isspos.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.470] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0072.470] GetLastError () returned 0x0 [0072.470] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="mxslipstream.exe") returned 260 [0072.470] VarBstrCmp (bstrLeft="ipstream.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.470] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0072.471] GetLastError () returned 0x0 [0072.471] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="omnipos.exe") returned 260 [0072.471] VarBstrCmp (bstrLeft="omnipos.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.471] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0072.471] GetLastError () returned 0x0 [0072.472] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="spcwin.exe") returned 260 [0072.472] VarBstrCmp (bstrLeft="spcwin.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.472] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0072.472] GetLastError () returned 0x0 [0072.472] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="spgagentservice.exe") returned 260 [0072.472] VarBstrCmp (bstrLeft="tservice.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.472] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0072.473] GetLastError () returned 0x0 [0072.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="utg2.exe") returned 260 [0072.473] VarBstrCmp (bstrLeft="utg2.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.473] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notify native.exe")) returned 1 [0072.473] GetLastError () returned 0x0 [0072.474] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="notify native.exe") returned 260 [0072.474] VarBstrCmp (bstrLeft="y native.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.474] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="holland_resulted_plot.exe")) returned 1 [0072.474] GetLastError () returned 0x0 [0072.474] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="holland_resulted_plot.exe") returned 260 [0072.474] VarBstrCmp (bstrLeft="ted_plot.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.474] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.475] GetLastError () returned 0x0 [0072.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0072.475] VarBstrCmp (bstrLeft="wmiprvse.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.475] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.475] GetLastError () returned 0x0 [0072.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0072.475] VarBstrCmp (bstrLeft="wmiprvse.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.475] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.476] GetLastError () returned 0x0 [0072.476] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0072.476] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.476] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zhang.exe")) returned 1 [0072.477] GetLastError () returned 0x0 [0072.477] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="zhang.exe") returned 260 [0072.477] VarBstrCmp (bstrLeft="zhang.exe", bstrRight="leechftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.477] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zhang.exe")) returned 0 [0072.477] GetLastError () returned 0x12 [0072.477] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="zhang.exe") returned 260 [0072.477] CloseHandle (hObject=0x1b4) returned 1 [0072.477] GetLastError () returned 0x0 [0072.478] IUnknown:Release (This=0x4af2010) returned 0x1 [0072.478] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.478] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.478] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.478] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.478] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.478] IUnknown:Release (This=0x4af2010) returned 0x0 [0072.478] IUnknown:Release (This=0x2fb99c) returned 0x0 [0072.478] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.478] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.478] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.478] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.478] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.478] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.479] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.479] GetCurrentThreadId () returned 0xa94 [0072.479] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0072.479] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.479] GetCurrentThreadId () returned 0xa94 [0072.479] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0072.479] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0072.479] GetCurrentThreadId () returned 0xa94 [0072.479] GetCurrentThreadId () returned 0xa94 [0072.479] GetCurrentThreadId () returned 0xa94 [0072.480] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.480] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.480] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.482] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0072.482] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0072.482] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2460 [0072.482] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24d0 [0072.482] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2530 [0072.482] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0072.482] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.482] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0072.482] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0072.482] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0072.483] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0072.483] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.483] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.483] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0072.483] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0072.483] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0072.483] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0072.483] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0072.483] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.483] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.484] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0072.484] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0072.484] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0072.484] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0072.486] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0072.486] IUnknown:Release (This=0x2f9d40) returned 0x3 [0072.486] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.486] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.487] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.487] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.487] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.487] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.487] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0072.487] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.487] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.487] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.488] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.488] GetCurrentThreadId () returned 0xa94 [0072.488] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.488] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Microsoft Office\\ncftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.488] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.488] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.489] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.489] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.489] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.489] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.489] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.489] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.489] GetCurrentThreadId () returned 0xa94 [0072.490] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.490] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Microsoft Office\\ncftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.490] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.490] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\ncftp.exe", cchLength=0x2c | out: lpsz="c:\\program files\\microsoft office\\ncftp.exe") returned 0x2c [0072.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0072.490] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.491] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.491] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.491] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd054, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.491] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.491] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0072.491] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0072.491] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.491] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0072.491] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0072.491] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0072.491] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.491] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.492] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.492] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.492] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.492] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.492] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.492] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.492] SysStringLen (param_1="Name") returned 0x4 [0072.492] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.492] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2590 [0072.492] SysStringLen (param_1="Name") returned 0x4 [0072.492] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.493] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.493] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.493] GetCurrentThreadId () returned 0xa94 [0072.493] SysStringLen (param_1="Name") returned 0x4 [0072.493] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ncftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.493] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.493] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.493] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.493] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.494] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.494] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.494] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.494] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.494] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.494] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.494] GetCurrentThreadId () returned 0xa94 [0072.494] SysStringLen (param_1="Name") returned 0x4 [0072.494] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ncftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.494] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0072.495] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.495] GetLastError () returned 0x0 [0072.495] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpWideCharStr=0x18eb7c, cchWideChar=128 | out: lpWideCharStr="Service Pack 1") returned 128 [0072.495] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0072.497] GetLastError () returned 0x0 [0072.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=260, lpMultiByteStr=0x18e8d8, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 260 [0072.497] Process32First (in: hSnapshot=0x1b4, lppe=0x18e8b4 | out: lppe=0x18e8b4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.498] GetLastError () returned 0x0 [0072.498] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e8d8, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="[System Process]") returned 260 [0072.498] VarBstrCmp (bstrLeft=" process]", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.498] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0072.498] GetLastError () returned 0x0 [0072.498] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="System") returned 260 [0072.498] VarBstrCmp (bstrLeft="system", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.498] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0072.499] GetLastError () returned 0x0 [0072.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="smss.exe") returned 260 [0072.499] VarBstrCmp (bstrLeft="smss.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.499] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.499] GetLastError () returned 0x0 [0072.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0072.499] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.499] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0072.500] GetLastError () returned 0x0 [0072.500] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="wininit.exe") returned 260 [0072.500] VarBstrCmp (bstrLeft="ninit.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.500] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.500] GetLastError () returned 0x0 [0072.500] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0072.500] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.500] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0072.501] GetLastError () returned 0x0 [0072.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="winlogon.exe") returned 260 [0072.501] VarBstrCmp (bstrLeft="logon.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.501] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0072.501] GetLastError () returned 0x0 [0072.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="services.exe") returned 260 [0072.501] VarBstrCmp (bstrLeft="vices.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.501] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0072.502] GetLastError () returned 0x0 [0072.502] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="lsass.exe") returned 260 [0072.502] VarBstrCmp (bstrLeft="lsass.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.502] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0072.502] GetLastError () returned 0x0 [0072.502] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="lsm.exe") returned 260 [0072.502] VarBstrCmp (bstrLeft="lsm.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.502] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.503] GetLastError () returned 0x0 [0072.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.503] VarBstrCmp (bstrLeft="chost.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.503] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.512] GetLastError () returned 0x0 [0072.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.512] VarBstrCmp (bstrLeft="chost.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.526] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.526] GetLastError () returned 0x0 [0072.526] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.526] VarBstrCmp (bstrLeft="chost.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.526] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.527] GetLastError () returned 0x0 [0072.527] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.527] VarBstrCmp (bstrLeft="chost.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.527] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.527] GetLastError () returned 0x0 [0072.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.528] VarBstrCmp (bstrLeft="chost.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.528] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0072.528] GetLastError () returned 0x0 [0072.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="audiodg.exe") returned 260 [0072.528] VarBstrCmp (bstrLeft="diodg.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.528] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.529] GetLastError () returned 0x0 [0072.529] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.529] VarBstrCmp (bstrLeft="chost.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.529] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.529] GetLastError () returned 0x0 [0072.529] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.529] VarBstrCmp (bstrLeft="chost.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.529] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0072.530] GetLastError () returned 0x0 [0072.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="dwm.exe") returned 260 [0072.530] VarBstrCmp (bstrLeft="dwm.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.530] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0072.530] GetLastError () returned 0x0 [0072.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="explorer.exe") returned 260 [0072.531] VarBstrCmp (bstrLeft="lorer.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.531] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0072.531] GetLastError () returned 0x0 [0072.531] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="spoolsv.exe") returned 260 [0072.531] VarBstrCmp (bstrLeft="oolsv.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.531] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.532] GetLastError () returned 0x0 [0072.532] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0072.532] VarBstrCmp (bstrLeft="chost.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.532] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.532] GetLastError () returned 0x0 [0072.532] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0072.532] VarBstrCmp (bstrLeft="khost.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.532] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0072.533] GetLastError () returned 0x0 [0072.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="taskeng.exe") returned 260 [0072.533] VarBstrCmp (bstrLeft="skeng.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.533] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0072.533] GetLastError () returned 0x0 [0072.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="ncftp.exe") returned 260 [0072.533] VarBstrCmp (bstrLeft="ncftp.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x1 [0072.533] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0072.536] GetLastError () returned 0x0 [0072.536] CloseHandle (hObject=0x1b8) returned 1 [0072.536] GetLastError () returned 0x0 [0072.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ncftp.exe", cchWideChar=260, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ncftp.exe", lpUsedDefaultChar=0x0) returned 260 [0072.536] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0072.537] GetLastError () returned 0x0 [0072.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="notepad.exe") returned 260 [0072.537] VarBstrCmp (bstrLeft="tepad.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.537] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0072.537] GetLastError () returned 0x0 [0072.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="operamail.exe") returned 260 [0072.537] VarBstrCmp (bstrLeft="amail.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.538] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0072.538] GetLastError () returned 0x0 [0072.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="outlook.exe") returned 260 [0072.538] VarBstrCmp (bstrLeft="tlook.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.538] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0072.538] GetLastError () returned 0x0 [0072.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="pidgin.exe") returned 260 [0072.538] VarBstrCmp (bstrLeft="idgin.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.539] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0072.539] GetLastError () returned 0x0 [0072.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="scriptftp.exe") returned 260 [0072.539] VarBstrCmp (bstrLeft="ptftp.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.539] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0072.539] GetLastError () returned 0x0 [0072.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="skype.exe") returned 260 [0072.539] VarBstrCmp (bstrLeft="skype.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.540] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0072.540] GetLastError () returned 0x0 [0072.540] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="smartftp.exe") returned 260 [0072.540] VarBstrCmp (bstrLeft="rtftp.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.540] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0072.540] GetLastError () returned 0x0 [0072.540] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="thunderbird.exe") returned 260 [0072.541] VarBstrCmp (bstrLeft="rbird.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.541] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0072.541] GetLastError () returned 0x0 [0072.541] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="totalcmd.exe") returned 260 [0072.541] VarBstrCmp (bstrLeft="alcmd.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.541] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0072.541] GetLastError () returned 0x0 [0072.541] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="trillian.exe") returned 260 [0072.542] VarBstrCmp (bstrLeft="llian.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.542] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0072.542] GetLastError () returned 0x0 [0072.542] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="webdrive.exe") returned 260 [0072.542] VarBstrCmp (bstrLeft="drive.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.542] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0072.542] GetLastError () returned 0x0 [0072.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="whatsapp.exe") returned 260 [0072.543] VarBstrCmp (bstrLeft="tsapp.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.543] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0072.543] GetLastError () returned 0x0 [0072.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="winscp.exe") returned 260 [0072.543] VarBstrCmp (bstrLeft="inscp.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.543] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0072.543] GetLastError () returned 0x0 [0072.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="yahoomessenger.exe") returned 260 [0072.544] VarBstrCmp (bstrLeft="enger.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.544] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0072.544] GetLastError () returned 0x0 [0072.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="active-charge.exe") returned 260 [0072.544] VarBstrCmp (bstrLeft="harge.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.544] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0072.545] GetLastError () returned 0x0 [0072.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="accupos.exe") returned 260 [0072.545] VarBstrCmp (bstrLeft="cupos.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.545] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0072.545] GetLastError () returned 0x0 [0072.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="afr38.exe") returned 260 [0072.545] VarBstrCmp (bstrLeft="afr38.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.545] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0072.545] GetLastError () returned 0x0 [0072.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="aldelo.exe") returned 260 [0072.546] VarBstrCmp (bstrLeft="ldelo.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.546] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0072.546] GetLastError () returned 0x0 [0072.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="ccv_server.exe") returned 260 [0072.546] VarBstrCmp (bstrLeft="erver.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.546] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0072.546] GetLastError () returned 0x0 [0072.547] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="centralcreditcard.exe") returned 260 [0072.547] VarBstrCmp (bstrLeft="tcard.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.547] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0072.547] GetLastError () returned 0x0 [0072.547] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="creditservice.exe") returned 260 [0072.547] VarBstrCmp (bstrLeft="rvice.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.547] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0072.548] GetLastError () returned 0x0 [0072.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="edcsvr.exe") returned 260 [0072.548] VarBstrCmp (bstrLeft="dcsvr.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.548] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0072.548] GetLastError () returned 0x0 [0072.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="fpos.exe") returned 260 [0072.548] VarBstrCmp (bstrLeft="fpos.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.548] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0072.549] GetLastError () returned 0x0 [0072.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="isspos.exe") returned 260 [0072.549] VarBstrCmp (bstrLeft="sspos.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.549] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0072.549] GetLastError () returned 0x0 [0072.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="mxslipstream.exe") returned 260 [0072.549] VarBstrCmp (bstrLeft="tream.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.549] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0072.550] GetLastError () returned 0x0 [0072.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="omnipos.exe") returned 260 [0072.551] VarBstrCmp (bstrLeft="nipos.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.551] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0072.551] GetLastError () returned 0x0 [0072.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="spcwin.exe") returned 260 [0072.551] VarBstrCmp (bstrLeft="pcwin.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.551] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0072.552] GetLastError () returned 0x0 [0072.552] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="spgagentservice.exe") returned 260 [0072.552] VarBstrCmp (bstrLeft="rvice.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.552] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0072.552] GetLastError () returned 0x0 [0072.552] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="utg2.exe") returned 260 [0072.552] VarBstrCmp (bstrLeft="utg2.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.552] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notify native.exe")) returned 1 [0072.553] GetLastError () returned 0x0 [0072.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="notify native.exe") returned 260 [0072.553] VarBstrCmp (bstrLeft="ative.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.553] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="holland_resulted_plot.exe")) returned 1 [0072.553] GetLastError () returned 0x0 [0072.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="holland_resulted_plot.exe") returned 260 [0072.553] VarBstrCmp (bstrLeft="_plot.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.553] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.554] GetLastError () returned 0x0 [0072.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0072.554] VarBstrCmp (bstrLeft="prvse.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.554] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.554] GetLastError () returned 0x0 [0072.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0072.555] VarBstrCmp (bstrLeft="prvse.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.555] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.555] GetLastError () returned 0x0 [0072.555] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0072.555] VarBstrCmp (bstrLeft="khost.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.555] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zhang.exe")) returned 1 [0072.556] GetLastError () returned 0x0 [0072.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="zhang.exe") returned 260 [0072.556] VarBstrCmp (bstrLeft="zhang.exe", bstrRight="ncftp.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.556] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zhang.exe")) returned 0 [0072.556] GetLastError () returned 0x12 [0072.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="zhang.exe") returned 260 [0072.556] CloseHandle (hObject=0x1b4) returned 1 [0072.556] GetLastError () returned 0x0 [0072.557] IUnknown:Release (This=0x4af2010) returned 0x1 [0072.557] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.557] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.557] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.557] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.557] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.557] IUnknown:Release (This=0x4af2010) returned 0x0 [0072.557] IUnknown:Release (This=0x2fb99c) returned 0x0 [0072.557] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.557] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.557] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.557] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.558] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.558] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.558] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.558] GetCurrentThreadId () returned 0xa94 [0072.558] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0072.558] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.558] GetCurrentThreadId () returned 0xa94 [0072.558] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0072.559] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0072.559] GetCurrentThreadId () returned 0xa94 [0072.559] GetCurrentThreadId () returned 0xa94 [0072.559] GetCurrentThreadId () returned 0xa94 [0072.559] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.560] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.560] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.567] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0072.567] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0072.567] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0072.567] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0072.567] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0072.567] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0072.567] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.567] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0072.567] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0072.568] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0072.568] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0072.568] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.568] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.568] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0072.568] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0072.568] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0072.568] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0072.568] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0072.568] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.568] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.568] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0072.569] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0072.569] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0072.569] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0072.570] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0072.571] IUnknown:Release (This=0x2f9d40) returned 0x3 [0072.571] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.571] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.571] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.571] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.571] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.571] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.572] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0072.572] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.572] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.572] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.572] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.572] GetCurrentThreadId () returned 0xa94 [0072.573] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.573] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Google\\notepad.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.573] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.573] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.574] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.574] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.574] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.574] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.574] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.575] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.575] GetCurrentThreadId () returned 0xa94 [0072.575] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.575] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Google\\notepad.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.575] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.576] CharLowerBuffW (in: lpsz="C:\\Program Files (x86)\\Google\\notepad.exe", cchLength=0x2a | out: lpsz="c:\\program files (x86)\\google\\notepad.exe") returned 0x2a [0072.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0072.576] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.576] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.576] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.576] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd02c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.576] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.576] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0072.577] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0072.577] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.577] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0072.577] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0072.577] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0072.577] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.577] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.578] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.578] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.578] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.578] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.578] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.578] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.578] SysStringLen (param_1="Name") returned 0x4 [0072.578] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.578] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a0 [0072.578] SysStringLen (param_1="Name") returned 0x4 [0072.579] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.579] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.579] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.579] GetCurrentThreadId () returned 0xa94 [0072.579] SysStringLen (param_1="Name") returned 0x4 [0072.579] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="notepad.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.579] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.579] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.580] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.580] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.580] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.580] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.580] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.580] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.580] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.580] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.580] GetCurrentThreadId () returned 0xa94 [0072.581] SysStringLen (param_1="Name") returned 0x4 [0072.581] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="notepad.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.581] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0072.581] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.581] GetLastError () returned 0x0 [0072.581] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpWideCharStr=0x18eb7c, cchWideChar=128 | out: lpWideCharStr="Service Pack 1") returned 128 [0072.581] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0072.584] GetLastError () returned 0x0 [0072.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=260, lpMultiByteStr=0x18e8d8, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 260 [0072.584] Process32First (in: hSnapshot=0x1b4, lppe=0x18e8b4 | out: lppe=0x18e8b4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.584] GetLastError () returned 0x0 [0072.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e8d8, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="[System Process]") returned 260 [0072.584] VarBstrCmp (bstrLeft="em process]", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.584] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0072.585] GetLastError () returned 0x0 [0072.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="System") returned 260 [0072.585] VarBstrCmp (bstrLeft="system", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.585] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0072.585] GetLastError () returned 0x0 [0072.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7b0, cbMultiByte=260, lpWideCharStr=0x18ea58, cchWideChar=260 | out: lpWideCharStr="smss.exe") returned 260 [0072.586] VarBstrCmp (bstrLeft="smss.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.586] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.586] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.586] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0072.586] VarBstrCmp (bstrLeft="wininit.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.587] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.587] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.587] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0072.587] VarBstrCmp (bstrLeft="inlogon.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.587] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0072.588] VarBstrCmp (bstrLeft="ervices.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.588] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0072.588] VarBstrCmp (bstrLeft="lsass.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.588] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0072.589] VarBstrCmp (bstrLeft="lsm.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.589] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.589] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.589] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.590] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.590] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.590] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.590] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.590] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.591] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.591] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.591] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0072.591] VarBstrCmp (bstrLeft="audiodg.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.591] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.592] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.592] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.592] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.592] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0072.593] VarBstrCmp (bstrLeft="dwm.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.593] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0072.593] VarBstrCmp (bstrLeft="xplorer.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.593] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0072.593] VarBstrCmp (bstrLeft="spoolsv.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.594] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.594] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.594] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.594] VarBstrCmp (bstrLeft="askhost.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.594] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0072.595] VarBstrCmp (bstrLeft="taskeng.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.595] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0072.595] VarBstrCmp (bstrLeft="notepad.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x1 [0072.596] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0072.596] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0072.597] VarBstrCmp (bstrLeft="eramail.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.597] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0072.598] VarBstrCmp (bstrLeft="outlook.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.598] Process32Next (in: hSnapshot=0x1b4, lppe=0x18e78c | out: lppe=0x18e78c*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0072.598] VarBstrCmp (bstrLeft="pidgin.exe", bstrRight="notepad.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0072.606] IUnknown:Release (This=0x4af2010) returned 0x1 [0072.606] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.606] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.606] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.606] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.606] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.607] IUnknown:Release (This=0x4af2010) returned 0x0 [0072.607] IUnknown:Release (This=0x2fb99c) returned 0x0 [0072.607] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.607] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.607] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.607] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.607] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.607] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.607] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.607] GetCurrentThreadId () returned 0xa94 [0072.607] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0072.608] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.608] GetCurrentThreadId () returned 0xa94 [0072.608] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0072.608] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0072.608] GetCurrentThreadId () returned 0xa94 [0072.608] GetCurrentThreadId () returned 0xa94 [0072.608] GetCurrentThreadId () returned 0xa94 [0072.608] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.608] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.608] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.636] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0072.636] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0072.636] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2480 [0072.636] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24f0 [0072.636] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2550 [0072.636] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0072.636] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.636] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0072.636] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0072.637] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0072.637] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0072.637] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.637] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.637] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0072.637] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0072.637] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0072.637] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0072.637] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0072.637] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.637] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.637] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0072.638] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0072.638] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0072.638] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0072.640] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0072.640] IUnknown:Release (This=0x2f9d40) returned 0x3 [0072.640] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.640] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.640] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.640] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.640] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.641] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.641] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0072.641] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.641] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.641] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.641] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.642] GetCurrentThreadId () returned 0xa94 [0072.642] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.642] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Windows Portable Devices\\operamail.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.642] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.642] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.643] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.643] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.643] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.643] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.643] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.643] GetCurrentThreadId () returned 0xa94 [0072.643] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.643] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Windows Portable Devices\\operamail.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.644] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.644] CharLowerBuffW (in: lpsz="C:\\Program Files\\Windows Portable Devices\\operamail.exe", cchLength=0x38 | out: lpsz="c:\\program files\\windows portable devices\\operamail.exe") returned 0x38 [0072.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0072.644] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.644] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.644] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd02c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.645] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.645] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0072.645] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0072.645] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.645] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0072.645] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0072.646] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0072.646] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.646] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.646] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.646] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.646] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.646] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.646] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.647] SysStringLen (param_1="Name") returned 0x4 [0072.647] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.647] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25b0 [0072.647] SysStringLen (param_1="Name") returned 0x4 [0072.647] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.647] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.647] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.648] GetCurrentThreadId () returned 0xa94 [0072.648] SysStringLen (param_1="Name") returned 0x4 [0072.648] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="operamail.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.648] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.648] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.649] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.649] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.649] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.649] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.649] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.649] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.649] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.649] GetCurrentThreadId () returned 0xa94 [0072.650] SysStringLen (param_1="Name") returned 0x4 [0072.650] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="operamail.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.650] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0072.651] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.651] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0072.659] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0072.670] IUnknown:Release (This=0x4af2010) returned 0x1 [0072.670] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.670] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.670] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.670] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.670] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.670] IUnknown:Release (This=0x4af2010) returned 0x0 [0072.670] IUnknown:Release (This=0x2fb99c) returned 0x0 [0072.670] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.671] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.671] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.671] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.671] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.671] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.671] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.671] GetCurrentThreadId () returned 0xa94 [0072.671] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0072.671] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.671] GetCurrentThreadId () returned 0xa94 [0072.671] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0072.672] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0072.672] GetCurrentThreadId () returned 0xa94 [0072.672] GetCurrentThreadId () returned 0xa94 [0072.672] GetCurrentThreadId () returned 0xa94 [0072.672] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.673] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.673] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.683] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0072.683] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0072.683] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0072.683] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0072.683] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0072.683] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0072.684] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.684] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0072.684] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0072.684] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0072.684] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0072.684] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.684] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.684] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0072.684] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0072.684] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0072.684] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0072.684] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0072.685] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.685] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.685] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0072.685] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0072.685] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0072.685] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0072.687] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0072.687] IUnknown:Release (This=0x2f9d40) returned 0x3 [0072.687] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.687] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.687] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.687] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.687] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.687] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.688] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0072.688] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.688] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.688] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.688] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.688] GetCurrentThreadId () returned 0xa94 [0072.688] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.688] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Windows Journal\\outlook.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.689] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.689] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.689] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.689] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.689] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.689] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.689] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.689] GetCurrentThreadId () returned 0xa94 [0072.690] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.690] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Windows Journal\\outlook.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.690] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\Windows Journal\\outlook.exe", cchLength=0x2d | out: lpsz="c:\\program files\\windows journal\\outlook.exe") returned 0x2d [0072.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0072.690] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.690] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.691] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0f4, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.691] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.691] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0072.691] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0072.691] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.691] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0072.691] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0072.691] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0072.691] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.691] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.691] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.692] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.692] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.692] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.692] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.692] SysStringLen (param_1="Name") returned 0x4 [0072.692] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.692] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a0 [0072.692] SysStringLen (param_1="Name") returned 0x4 [0072.692] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.693] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.693] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.693] GetCurrentThreadId () returned 0xa94 [0072.693] SysStringLen (param_1="Name") returned 0x4 [0072.693] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="outlook.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.693] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.693] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.693] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.694] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.694] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.694] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.694] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.694] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.694] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.694] GetCurrentThreadId () returned 0xa94 [0072.694] SysStringLen (param_1="Name") returned 0x4 [0072.694] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="outlook.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.694] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0072.695] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.695] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0072.702] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0072.711] IUnknown:Release (This=0x4af2010) returned 0x1 [0072.711] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.711] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.711] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.711] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.713] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.713] IUnknown:Release (This=0x4af2010) returned 0x0 [0072.713] IUnknown:Release (This=0x2fb99c) returned 0x0 [0072.713] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.713] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.713] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.713] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.713] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.713] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.713] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.713] GetCurrentThreadId () returned 0xa94 [0072.714] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0072.714] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.714] GetCurrentThreadId () returned 0xa94 [0072.714] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0072.714] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0072.714] GetCurrentThreadId () returned 0xa94 [0072.714] GetCurrentThreadId () returned 0xa94 [0072.715] GetCurrentThreadId () returned 0xa94 [0072.715] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.715] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.715] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.724] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0072.724] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0072.724] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2468 [0072.724] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24d8 [0072.724] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2538 [0072.724] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0072.724] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.724] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0072.724] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0072.725] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0072.725] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0072.725] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.725] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.725] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0072.725] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0072.725] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0072.725] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0072.725] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0072.725] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.725] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.725] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0072.726] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0072.726] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0072.726] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0072.727] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0072.727] IUnknown:Release (This=0x2f9d40) returned 0x3 [0072.727] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.728] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.728] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.728] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.728] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.728] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.728] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0072.728] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.728] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.728] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.728] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.728] GetCurrentThreadId () returned 0xa94 [0072.728] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.728] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Mail\\pidgin.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.729] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.729] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.729] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.729] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.729] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.729] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.729] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.729] GetCurrentThreadId () returned 0xa94 [0072.729] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.729] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Mail\\pidgin.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.730] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.730] CharLowerBuffW (in: lpsz="C:\\Program Files (x86)\\Windows Mail\\pidgin.exe", cchLength=0x2f | out: lpsz="c:\\program files (x86)\\windows mail\\pidgin.exe") returned 0x2f [0072.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0072.730] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.730] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.730] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.730] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.730] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.730] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0072.730] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0072.731] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.731] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0072.731] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0072.731] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0072.731] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.731] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.731] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.731] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.731] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.731] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.731] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.731] SysStringLen (param_1="Name") returned 0x4 [0072.731] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.731] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2598 [0072.731] SysStringLen (param_1="Name") returned 0x4 [0072.731] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.732] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.732] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.732] GetCurrentThreadId () returned 0xa94 [0072.732] SysStringLen (param_1="Name") returned 0x4 [0072.732] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="pidgin.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.732] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.732] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.732] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.732] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.732] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.733] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.734] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.734] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.734] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.734] GetCurrentThreadId () returned 0xa94 [0072.734] SysStringLen (param_1="Name") returned 0x4 [0072.734] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="pidgin.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.734] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0072.734] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.734] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0072.742] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0072.750] IUnknown:Release (This=0x4af2010) returned 0x1 [0072.750] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.750] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.751] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.751] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.751] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.751] IUnknown:Release (This=0x4af2010) returned 0x0 [0072.751] IUnknown:Release (This=0x2fb99c) returned 0x0 [0072.751] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.751] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.751] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.751] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.751] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.751] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.751] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.751] GetCurrentThreadId () returned 0xa94 [0072.751] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0072.751] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.751] GetCurrentThreadId () returned 0xa94 [0072.751] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0072.752] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0072.752] GetCurrentThreadId () returned 0xa94 [0072.752] GetCurrentThreadId () returned 0xa94 [0072.752] GetCurrentThreadId () returned 0xa94 [0072.752] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.752] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.752] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.759] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0072.759] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0072.759] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2480 [0072.759] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24f0 [0072.759] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2550 [0072.759] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0072.759] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.759] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0072.759] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0072.760] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0072.760] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0072.760] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.760] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.760] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0072.760] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0072.760] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0072.760] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0072.760] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0072.760] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.760] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.760] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0072.760] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0072.760] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0072.761] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0072.762] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0072.762] IUnknown:Release (This=0x2f9d40) returned 0x3 [0072.762] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.762] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.762] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.762] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.762] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.762] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.763] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0072.763] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.763] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.763] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.763] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.763] GetCurrentThreadId () returned 0xa94 [0072.763] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.763] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Java\\scriptftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.763] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.764] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.764] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.764] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.764] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.764] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.764] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.764] GetCurrentThreadId () returned 0xa94 [0072.764] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.764] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Java\\scriptftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.765] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.765] CharLowerBuffW (in: lpsz="C:\\Program Files (x86)\\Java\\scriptftp.exe", cchLength=0x2a | out: lpsz="c:\\program files (x86)\\java\\scriptftp.exe") returned 0x2a [0072.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0072.765] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.765] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.765] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.765] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.765] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0072.765] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0072.765] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.766] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0072.766] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0072.766] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0072.766] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.766] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.766] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.766] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.766] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.766] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.766] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.766] SysStringLen (param_1="Name") returned 0x4 [0072.766] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.766] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25b0 [0072.766] SysStringLen (param_1="Name") returned 0x4 [0072.766] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.766] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.767] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.767] GetCurrentThreadId () returned 0xa94 [0072.767] SysStringLen (param_1="Name") returned 0x4 [0072.767] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="scriptftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.767] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.767] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.767] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.767] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.767] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.767] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.767] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.767] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.767] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.768] GetCurrentThreadId () returned 0xa94 [0072.768] SysStringLen (param_1="Name") returned 0x4 [0072.768] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="scriptftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.768] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0072.768] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.768] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0072.775] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0072.781] IUnknown:Release (This=0x4af2010) returned 0x1 [0072.781] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.781] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.781] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.781] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.781] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.781] IUnknown:Release (This=0x4af2010) returned 0x0 [0072.781] IUnknown:Release (This=0x2fb99c) returned 0x0 [0072.781] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.781] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.782] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.782] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.782] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.782] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.782] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.782] GetCurrentThreadId () returned 0xa94 [0072.782] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0072.782] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.782] GetCurrentThreadId () returned 0xa94 [0072.782] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0072.782] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0072.782] GetCurrentThreadId () returned 0xa94 [0072.782] GetCurrentThreadId () returned 0xa94 [0072.782] GetCurrentThreadId () returned 0xa94 [0072.783] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.783] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.783] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.791] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0072.791] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0072.791] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2460 [0072.791] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24d0 [0072.791] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2530 [0072.791] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0072.791] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.791] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0072.791] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0072.791] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0072.791] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0072.792] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.792] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.792] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0072.792] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0072.792] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0072.792] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0072.792] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0072.792] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.792] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.792] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0072.792] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0072.792] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0072.793] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0072.794] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0072.794] IUnknown:Release (This=0x2f9d40) returned 0x3 [0072.794] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.794] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.794] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.794] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.794] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.794] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.795] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0072.795] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.795] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.795] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.795] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.795] GetCurrentThreadId () returned 0xa94 [0072.795] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.795] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Mozilla Maintenance Service\\skype.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.795] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.796] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.796] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.796] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.796] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.796] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.796] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.796] GetCurrentThreadId () returned 0xa94 [0072.796] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.796] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Mozilla Maintenance Service\\skype.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.796] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.797] CharLowerBuffW (in: lpsz="C:\\Program Files (x86)\\Mozilla Maintenance Service\\skype.exe", cchLength=0x3d | out: lpsz="c:\\program files (x86)\\mozilla maintenance service\\skype.exe") returned 0x3d [0072.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0072.797] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.797] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.797] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd054, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.797] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.797] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0072.797] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0072.797] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.797] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0072.797] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0072.797] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0072.798] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.798] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.798] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.798] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.798] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.798] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.798] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.798] SysStringLen (param_1="Name") returned 0x4 [0072.798] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.798] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2590 [0072.798] SysStringLen (param_1="Name") returned 0x4 [0072.798] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.799] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.799] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.799] GetCurrentThreadId () returned 0xa94 [0072.799] SysStringLen (param_1="Name") returned 0x4 [0072.799] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="skype.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.799] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.799] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.799] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.800] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.800] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.800] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.800] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.800] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.800] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.800] GetCurrentThreadId () returned 0xa94 [0072.800] SysStringLen (param_1="Name") returned 0x4 [0072.800] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="skype.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.800] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0072.801] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.801] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0072.807] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0072.815] IUnknown:Release (This=0x4af2010) returned 0x1 [0072.815] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.815] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.815] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.815] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.815] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.815] IUnknown:Release (This=0x4af2010) returned 0x0 [0072.815] IUnknown:Release (This=0x2fb99c) returned 0x0 [0072.815] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.815] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.815] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.815] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.815] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.816] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.816] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.816] GetCurrentThreadId () returned 0xa94 [0072.816] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0072.816] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.816] GetCurrentThreadId () returned 0xa94 [0072.816] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0072.817] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0072.817] GetCurrentThreadId () returned 0xa94 [0072.817] GetCurrentThreadId () returned 0xa94 [0072.817] GetCurrentThreadId () returned 0xa94 [0072.817] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.817] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.817] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.823] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0072.823] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0072.823] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0072.823] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0072.823] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0072.823] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0072.823] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.823] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0072.823] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0072.823] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0072.823] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0072.823] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.823] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.823] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0072.824] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0072.824] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0072.824] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0072.824] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0072.824] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.824] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.824] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0072.824] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0072.824] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0072.824] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0072.826] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0072.826] IUnknown:Release (This=0x2f9d40) returned 0x3 [0072.826] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.826] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.826] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.826] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.826] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.826] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.826] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0072.826] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.826] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.826] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.826] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.827] GetCurrentThreadId () returned 0xa94 [0072.827] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.827] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\MSBuild\\smartftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.827] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.827] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.827] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.827] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.827] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.828] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.828] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.828] GetCurrentThreadId () returned 0xa94 [0072.828] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.828] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\MSBuild\\smartftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.828] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.828] CharLowerBuffW (in: lpsz="C:\\Program Files\\MSBuild\\smartftp.exe", cchLength=0x26 | out: lpsz="c:\\program files\\msbuild\\smartftp.exe") returned 0x26 [0072.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0072.828] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.829] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.829] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd07c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.829] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.829] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0072.829] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0072.829] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.829] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0072.829] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0072.829] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0072.829] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.830] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.830] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.830] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.830] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.830] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.830] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.830] SysStringLen (param_1="Name") returned 0x4 [0072.830] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.830] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0072.830] SysStringLen (param_1="Name") returned 0x4 [0072.831] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.831] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.831] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.831] GetCurrentThreadId () returned 0xa94 [0072.831] SysStringLen (param_1="Name") returned 0x4 [0072.831] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="smartftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.832] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.832] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.832] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.832] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.832] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.832] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.832] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.832] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.833] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.833] GetCurrentThreadId () returned 0xa94 [0072.833] SysStringLen (param_1="Name") returned 0x4 [0072.833] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="smartftp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.833] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0072.833] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.833] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0072.840] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0072.847] IUnknown:Release (This=0x4af2010) returned 0x1 [0072.854] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.854] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.854] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.854] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.854] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.854] IUnknown:Release (This=0x4af2010) returned 0x0 [0072.854] IUnknown:Release (This=0x2fb99c) returned 0x0 [0072.854] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.854] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.854] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.854] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.854] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.854] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.854] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.854] GetCurrentThreadId () returned 0xa94 [0072.854] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0072.854] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.854] GetCurrentThreadId () returned 0xa94 [0072.854] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0072.854] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0072.855] GetCurrentThreadId () returned 0xa94 [0072.855] GetCurrentThreadId () returned 0xa94 [0072.855] GetCurrentThreadId () returned 0xa94 [0072.855] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.855] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.855] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.856] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0072.856] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0072.856] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0072.856] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0072.856] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0072.856] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0072.856] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.856] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0072.856] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0072.857] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0072.857] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0072.857] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.857] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.857] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0072.857] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0072.857] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0072.857] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0072.857] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0072.857] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.857] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.857] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0072.857] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0072.857] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0072.858] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0072.859] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0072.859] IUnknown:Release (This=0x2f9d40) returned 0x3 [0072.859] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.859] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.859] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.859] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.859] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.859] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.859] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0072.859] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.860] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.860] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.860] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.860] GetCurrentThreadId () returned 0xa94 [0072.860] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.860] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\thunderbird.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.860] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.860] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.860] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.860] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.861] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.861] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.861] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.861] GetCurrentThreadId () returned 0xa94 [0072.861] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.861] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\thunderbird.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.861] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.861] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft SQL Server Compact Edition\\thunderbird.exe", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft sql server compact edition\\thunderbird.exe") returned 0x46 [0072.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0072.862] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.862] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.862] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd07c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.862] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.862] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0072.862] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0072.862] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.863] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0072.863] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0072.863] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0072.863] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.863] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.863] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.863] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.863] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.863] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.863] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.863] SysStringLen (param_1="Name") returned 0x4 [0072.863] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.863] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a0 [0072.863] SysStringLen (param_1="Name") returned 0x4 [0072.864] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.864] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.864] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.864] GetCurrentThreadId () returned 0xa94 [0072.864] SysStringLen (param_1="Name") returned 0x4 [0072.864] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="thunderbird.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.864] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.864] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.864] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.864] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.865] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.865] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.865] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.865] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.865] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.865] GetCurrentThreadId () returned 0xa94 [0072.865] SysStringLen (param_1="Name") returned 0x4 [0072.865] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="thunderbird.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.865] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0072.866] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.866] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0072.872] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0072.878] IUnknown:Release (This=0x4af2010) returned 0x1 [0072.878] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.878] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.878] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.878] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.878] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.878] IUnknown:Release (This=0x4af2010) returned 0x0 [0072.878] IUnknown:Release (This=0x2fb99c) returned 0x0 [0072.878] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.879] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.879] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.879] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.879] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.879] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.879] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.879] GetCurrentThreadId () returned 0xa94 [0072.879] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0072.879] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.879] GetCurrentThreadId () returned 0xa94 [0072.879] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0072.880] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0072.880] GetCurrentThreadId () returned 0xa94 [0072.880] GetCurrentThreadId () returned 0xa94 [0072.880] GetCurrentThreadId () returned 0xa94 [0072.880] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.880] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.880] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.886] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0072.886] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0072.886] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0072.886] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0072.886] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0072.887] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0072.887] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.887] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0072.887] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0072.887] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0072.887] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0072.887] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.887] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.887] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0072.887] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0072.887] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0072.887] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0072.887] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0072.887] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.887] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.888] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0072.888] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0072.888] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0072.888] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0072.889] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0072.889] IUnknown:Release (This=0x2f9d40) returned 0x3 [0072.889] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.889] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.890] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.890] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.890] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.890] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.890] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0072.890] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.890] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.890] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.890] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.890] GetCurrentThreadId () returned 0xa94 [0072.890] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.890] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Uninstall Information\\totalcmd.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.890] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.891] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.891] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.891] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.891] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.891] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.891] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.891] GetCurrentThreadId () returned 0xa94 [0072.891] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.891] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Uninstall Information\\totalcmd.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.891] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.892] CharLowerBuffW (in: lpsz="C:\\Program Files\\Uninstall Information\\totalcmd.exe", cchLength=0x34 | out: lpsz="c:\\program files\\uninstall information\\totalcmd.exe") returned 0x34 [0072.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0072.892] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.892] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.892] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd02c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.892] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.892] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0072.892] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0072.892] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.892] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0072.892] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0072.892] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0072.892] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.892] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.893] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.893] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.893] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.893] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.893] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.893] SysStringLen (param_1="Name") returned 0x4 [0072.893] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.893] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0072.893] SysStringLen (param_1="Name") returned 0x4 [0072.893] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.893] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.893] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.893] GetCurrentThreadId () returned 0xa94 [0072.893] SysStringLen (param_1="Name") returned 0x4 [0072.893] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="totalcmd.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.894] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.894] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.894] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.894] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.894] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.894] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.894] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.894] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.894] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.894] GetCurrentThreadId () returned 0xa94 [0072.894] SysStringLen (param_1="Name") returned 0x4 [0072.894] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="totalcmd.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.894] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0072.895] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.895] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0072.900] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0072.905] IUnknown:Release (This=0x4af2010) returned 0x1 [0072.905] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.905] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.905] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.905] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.905] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.905] IUnknown:Release (This=0x4af2010) returned 0x0 [0072.905] IUnknown:Release (This=0x2fb99c) returned 0x0 [0072.905] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.905] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.905] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.905] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.906] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.906] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.906] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.906] GetCurrentThreadId () returned 0xa94 [0072.906] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0072.906] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.906] GetCurrentThreadId () returned 0xa94 [0072.906] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0072.906] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0072.906] GetCurrentThreadId () returned 0xa94 [0072.906] GetCurrentThreadId () returned 0xa94 [0072.906] GetCurrentThreadId () returned 0xa94 [0072.907] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.907] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.907] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.923] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0072.923] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0072.923] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0072.923] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0072.923] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0072.923] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0072.923] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.923] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0072.923] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0072.924] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0072.924] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0072.924] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.924] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.924] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0072.924] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0072.924] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0072.924] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0072.924] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0072.924] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.925] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.925] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0072.925] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0072.925] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0072.925] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0072.927] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0072.927] IUnknown:Release (This=0x2f9d40) returned 0x3 [0072.927] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.927] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.927] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.927] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.927] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.927] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.927] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0072.927] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.928] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.928] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.928] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.928] GetCurrentThreadId () returned 0xa94 [0072.928] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.928] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Sidebar\\trillian.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.928] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.928] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.929] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.929] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.929] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.929] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.929] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.929] GetCurrentThreadId () returned 0xa94 [0072.929] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.929] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Sidebar\\trillian.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.929] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.929] CharLowerBuffW (in: lpsz="C:\\Program Files (x86)\\Windows Sidebar\\trillian.exe", cchLength=0x34 | out: lpsz="c:\\program files (x86)\\windows sidebar\\trillian.exe") returned 0x34 [0072.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0072.930] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.930] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.930] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd054, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.930] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.930] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0072.930] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0072.930] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.930] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0072.931] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0072.931] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0072.931] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.931] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.931] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.931] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.931] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.931] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.931] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.931] SysStringLen (param_1="Name") returned 0x4 [0072.931] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.931] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0072.931] SysStringLen (param_1="Name") returned 0x4 [0072.932] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.932] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.932] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.932] GetCurrentThreadId () returned 0xa94 [0072.932] SysStringLen (param_1="Name") returned 0x4 [0072.932] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="trillian.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.932] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.933] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.933] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.933] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.933] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.933] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.933] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.933] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.933] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.933] GetCurrentThreadId () returned 0xa94 [0072.933] SysStringLen (param_1="Name") returned 0x4 [0072.934] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="trillian.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.934] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0072.934] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.934] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0072.941] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0072.949] IUnknown:Release (This=0x4af2010) returned 0x1 [0072.949] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.949] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.949] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.949] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.949] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.949] IUnknown:Release (This=0x4af2010) returned 0x0 [0072.949] IUnknown:Release (This=0x2fb99c) returned 0x0 [0072.949] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.949] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.950] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.950] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.950] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.950] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.950] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.950] GetCurrentThreadId () returned 0xa94 [0072.950] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0072.950] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.950] GetCurrentThreadId () returned 0xa94 [0072.950] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0072.951] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0072.951] GetCurrentThreadId () returned 0xa94 [0072.951] GetCurrentThreadId () returned 0xa94 [0072.951] GetCurrentThreadId () returned 0xa94 [0072.951] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.951] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.951] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.958] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0072.958] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0072.958] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0072.958] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0072.958] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0072.958] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0072.958] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.958] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0072.958] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0072.959] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0072.959] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0072.959] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.959] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.959] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0072.959] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0072.959] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0072.959] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0072.959] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0072.959] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.959] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.959] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0072.959] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0072.959] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0072.960] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0072.961] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0072.961] IUnknown:Release (This=0x2f9d40) returned 0x3 [0072.961] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.961] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.962] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.962] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.962] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.962] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.962] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0072.962] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.962] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.962] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.962] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.962] GetCurrentThreadId () returned 0xa94 [0072.962] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.963] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Mail\\webdrive.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.963] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.963] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.963] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.963] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.963] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.963] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.963] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.963] GetCurrentThreadId () returned 0xa94 [0072.964] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.964] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Mail\\webdrive.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.964] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.964] CharLowerBuffW (in: lpsz="C:\\Program Files (x86)\\Windows Mail\\webdrive.exe", cchLength=0x31 | out: lpsz="c:\\program files (x86)\\windows mail\\webdrive.exe") returned 0x31 [0072.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0072.964] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.964] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.964] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.964] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd07c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.965] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.965] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0072.965] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0072.965] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.965] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0072.965] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0072.965] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0072.965] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0072.965] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.965] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.965] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.965] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.965] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.965] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.965] SysStringLen (param_1="Name") returned 0x4 [0072.966] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0072.966] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0072.966] SysStringLen (param_1="Name") returned 0x4 [0072.966] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.966] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.966] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.966] GetCurrentThreadId () returned 0xa94 [0072.966] SysStringLen (param_1="Name") returned 0x4 [0072.966] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="webdrive.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.967] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.967] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0072.967] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.967] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0072.967] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.967] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0072.967] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.967] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.967] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.968] GetCurrentThreadId () returned 0xa94 [0072.968] SysStringLen (param_1="Name") returned 0x4 [0072.968] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="webdrive.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.968] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0072.969] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.969] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0072.976] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0072.981] IUnknown:Release (This=0x4af2010) returned 0x1 [0072.981] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.982] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.982] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.982] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.982] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.982] IUnknown:Release (This=0x4af2010) returned 0x0 [0072.982] IUnknown:Release (This=0x2fb99c) returned 0x0 [0072.982] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.982] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.982] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.982] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.982] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.982] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0072.982] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.982] GetCurrentThreadId () returned 0xa94 [0072.982] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0072.982] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.983] GetCurrentThreadId () returned 0xa94 [0072.983] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0072.983] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0072.983] GetCurrentThreadId () returned 0xa94 [0072.983] GetCurrentThreadId () returned 0xa94 [0072.983] GetCurrentThreadId () returned 0xa94 [0072.983] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.983] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.983] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0072.993] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0072.993] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0072.993] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0072.993] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0072.993] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0072.993] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0072.993] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.993] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0072.993] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0072.993] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0072.993] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0072.993] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0072.994] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0072.994] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0072.994] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0072.994] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0072.994] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0072.994] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0072.994] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.994] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.994] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0072.994] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0072.994] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0072.995] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0072.996] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0072.996] IUnknown:Release (This=0x2f9d40) returned 0x3 [0072.996] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.996] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.996] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0072.997] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0072.997] IUnknown:Release (This=0x4af2010) returned 0x2 [0072.997] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.997] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0072.997] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.997] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.997] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.997] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.997] GetCurrentThreadId () returned 0xa94 [0072.997] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.998] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\MSBuild\\whatsapp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.998] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.998] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0072.998] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.998] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0072.998] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.998] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0072.998] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0072.998] GetCurrentThreadId () returned 0xa94 [0072.999] SysStringLen (param_1="ExecutablePath") returned 0xe [0072.999] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\MSBuild\\whatsapp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0072.999] IUnknown:Release (This=0x2fb99c) returned 0x1 [0072.999] CharLowerBuffW (in: lpsz="C:\\Program Files\\MSBuild\\whatsapp.exe", cchLength=0x26 | out: lpsz="c:\\program files\\msbuild\\whatsapp.exe") returned 0x26 [0072.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0072.999] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.999] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0072.999] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0072.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd07c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0072.999] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0072.999] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.000] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.000] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.000] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.000] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.000] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.000] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.000] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.000] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.000] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.000] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.000] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.000] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.000] SysStringLen (param_1="Name") returned 0x4 [0073.000] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.000] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0073.000] SysStringLen (param_1="Name") returned 0x4 [0073.001] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.001] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.001] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.001] GetCurrentThreadId () returned 0xa94 [0073.001] SysStringLen (param_1="Name") returned 0x4 [0073.001] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="whatsapp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.001] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.001] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.001] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.002] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.002] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.002] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.002] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.002] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.002] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.002] GetCurrentThreadId () returned 0xa94 [0073.002] SysStringLen (param_1="Name") returned 0x4 [0073.002] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="whatsapp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.002] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0073.003] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.003] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.008] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.014] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.014] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.015] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.015] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.015] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.015] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.015] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.015] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.015] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.015] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.015] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.015] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.015] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.015] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.015] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.015] GetCurrentThreadId () returned 0xa94 [0073.015] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.015] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.015] GetCurrentThreadId () returned 0xa94 [0073.015] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.016] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.016] GetCurrentThreadId () returned 0xa94 [0073.016] GetCurrentThreadId () returned 0xa94 [0073.016] GetCurrentThreadId () returned 0xa94 [0073.016] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.016] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.016] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.022] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.022] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.022] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2468 [0073.022] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24d8 [0073.022] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2538 [0073.022] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0073.022] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.022] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.022] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.023] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.023] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.023] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.023] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.023] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.023] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.023] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0073.023] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0073.023] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0073.023] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.023] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.023] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.023] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.023] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.024] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.025] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.025] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.025] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.025] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.025] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.025] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.025] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.025] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.025] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.025] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.025] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.025] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.026] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.026] GetCurrentThreadId () returned 0xa94 [0073.026] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.026] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Uninstall Information\\winscp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.026] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.026] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.026] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.026] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.026] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.027] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.027] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.027] GetCurrentThreadId () returned 0xa94 [0073.027] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.027] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Uninstall Information\\winscp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.027] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.027] CharLowerBuffW (in: lpsz="C:\\Program Files (x86)\\Uninstall Information\\winscp.exe", cchLength=0x38 | out: lpsz="c:\\program files (x86)\\uninstall information\\winscp.exe") returned 0x38 [0073.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0073.027] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.027] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.028] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.028] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0a4, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.028] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.028] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.028] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.028] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.028] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.028] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.028] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.028] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.028] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.028] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.028] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.028] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.028] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.029] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.029] SysStringLen (param_1="Name") returned 0x4 [0073.029] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.029] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2598 [0073.029] SysStringLen (param_1="Name") returned 0x4 [0073.029] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.029] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.029] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.029] GetCurrentThreadId () returned 0xa94 [0073.030] SysStringLen (param_1="Name") returned 0x4 [0073.030] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winscp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.030] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.030] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.030] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.030] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.030] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.030] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.031] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.031] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.031] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.031] GetCurrentThreadId () returned 0xa94 [0073.031] SysStringLen (param_1="Name") returned 0x4 [0073.031] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winscp.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.031] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0073.031] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.031] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.037] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.041] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.041] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.041] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.041] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.041] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.041] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.041] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.041] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.041] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.041] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.041] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.041] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.041] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.041] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.041] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.041] GetCurrentThreadId () returned 0xa94 [0073.041] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.041] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.041] GetCurrentThreadId () returned 0xa94 [0073.041] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.042] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.042] GetCurrentThreadId () returned 0xa94 [0073.042] GetCurrentThreadId () returned 0xa94 [0073.042] GetCurrentThreadId () returned 0xa94 [0073.042] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.042] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.042] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.048] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.049] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.049] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2480 [0073.049] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24f0 [0073.049] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2550 [0073.049] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0073.049] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.049] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.049] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.049] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.049] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.049] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.049] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.049] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.049] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.050] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0073.050] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0073.050] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0073.050] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.050] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.050] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.050] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.050] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.050] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.051] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.051] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.051] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.051] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.051] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.051] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.052] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.052] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.052] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.052] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.052] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.052] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.052] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.052] GetCurrentThreadId () returned 0xa94 [0073.052] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.052] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Reference Assemblies\\yahoomessenger.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.052] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.052] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.052] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.053] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.053] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.053] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.053] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.053] GetCurrentThreadId () returned 0xa94 [0073.053] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.053] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Reference Assemblies\\yahoomessenger.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.053] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.053] CharLowerBuffW (in: lpsz="C:\\Program Files (x86)\\Reference Assemblies\\yahoomessenger.exe", cchLength=0x3f | out: lpsz="c:\\program files (x86)\\reference assemblies\\yahoomessenger.exe") returned 0x3f [0073.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0073.053] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.053] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.053] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.054] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd07c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.054] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.054] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.054] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.054] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.054] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.054] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.054] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.054] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.054] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.054] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.054] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.054] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.054] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.054] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.054] SysStringLen (param_1="Name") returned 0x4 [0073.054] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.054] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25b0 [0073.054] SysStringLen (param_1="Name") returned 0x4 [0073.055] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.055] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.055] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.055] GetCurrentThreadId () returned 0xa94 [0073.055] SysStringLen (param_1="Name") returned 0x4 [0073.055] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="yahoomessenger.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.055] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.055] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.055] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.055] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.055] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.055] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.055] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.055] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.055] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.055] GetCurrentThreadId () returned 0xa94 [0073.056] SysStringLen (param_1="Name") returned 0x4 [0073.056] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="yahoomessenger.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.056] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0073.056] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.056] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.061] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.067] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.067] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.067] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.067] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.067] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.067] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.067] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.067] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.068] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.068] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.068] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.068] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.068] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.068] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.068] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.068] GetCurrentThreadId () returned 0xa94 [0073.068] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.068] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.068] GetCurrentThreadId () returned 0xa94 [0073.068] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.069] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.069] GetCurrentThreadId () returned 0xa94 [0073.069] GetCurrentThreadId () returned 0xa94 [0073.069] GetCurrentThreadId () returned 0xa94 [0073.069] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.069] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.069] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.075] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.075] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.076] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0073.076] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0073.076] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0073.076] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0073.076] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.076] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.076] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.076] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.076] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.076] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.076] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.076] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.076] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.076] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0073.076] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0073.077] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0073.077] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.077] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.077] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.077] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.077] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.077] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.078] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.078] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.078] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.079] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.079] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.079] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.079] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.079] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.079] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.079] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.079] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.079] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.079] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.079] GetCurrentThreadId () returned 0xa94 [0073.079] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.080] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Defender\\active-charge.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.080] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.080] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.080] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.080] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.080] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.080] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.080] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.080] GetCurrentThreadId () returned 0xa94 [0073.080] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.081] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Defender\\active-charge.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.081] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.081] CharLowerBuffW (in: lpsz="C:\\Program Files (x86)\\Windows Defender\\active-charge.exe", cchLength=0x3a | out: lpsz="c:\\program files (x86)\\windows defender\\active-charge.exe") returned 0x3a [0073.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0073.081] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.081] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.081] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0a4, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.081] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.081] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.081] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.081] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.082] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.082] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.082] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.082] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.082] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.082] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.082] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.082] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.082] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.082] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.082] SysStringLen (param_1="Name") returned 0x4 [0073.082] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.082] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0073.082] SysStringLen (param_1="Name") returned 0x4 [0073.082] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.082] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.082] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.082] GetCurrentThreadId () returned 0xa94 [0073.083] SysStringLen (param_1="Name") returned 0x4 [0073.083] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="active-charge.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.083] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.083] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.083] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.083] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.083] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.083] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.083] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.083] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.083] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.083] GetCurrentThreadId () returned 0xa94 [0073.083] SysStringLen (param_1="Name") returned 0x4 [0073.083] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="active-charge.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.084] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0073.084] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.084] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.089] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.093] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.093] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.093] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.093] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.093] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.093] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.093] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.093] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.093] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.093] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.093] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.093] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.093] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.093] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.094] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.094] GetCurrentThreadId () returned 0xa94 [0073.094] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.094] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.094] GetCurrentThreadId () returned 0xa94 [0073.094] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.094] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.094] GetCurrentThreadId () returned 0xa94 [0073.094] GetCurrentThreadId () returned 0xa94 [0073.094] GetCurrentThreadId () returned 0xa94 [0073.094] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.094] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.094] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.101] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.101] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.101] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0073.101] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0073.102] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0073.102] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0073.102] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.102] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.102] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.102] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.102] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.102] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.102] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.102] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.102] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.103] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0073.103] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0073.103] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0073.103] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.103] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.103] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.103] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.103] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.103] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.105] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.105] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.105] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.105] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.105] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.105] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.105] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.105] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.106] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.106] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.106] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.106] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.106] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.106] GetCurrentThreadId () returned 0xa94 [0073.106] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.106] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft.NET\\accupos.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.107] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.107] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.107] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.107] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.107] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.107] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.107] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.107] GetCurrentThreadId () returned 0xa94 [0073.107] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.108] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft.NET\\accupos.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.108] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.108] CharLowerBuffW (in: lpsz="C:\\Program Files (x86)\\Microsoft.NET\\accupos.exe", cchLength=0x31 | out: lpsz="c:\\program files (x86)\\microsoft.net\\accupos.exe") returned 0x31 [0073.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0073.108] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.108] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.108] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0a4, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.108] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.108] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.108] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.109] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.109] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.109] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.109] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.109] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.109] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.109] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.109] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.109] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.109] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.109] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.109] SysStringLen (param_1="Name") returned 0x4 [0073.109] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.109] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a0 [0073.109] SysStringLen (param_1="Name") returned 0x4 [0073.109] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.110] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.110] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.110] GetCurrentThreadId () returned 0xa94 [0073.110] SysStringLen (param_1="Name") returned 0x4 [0073.110] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="accupos.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.110] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.110] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.110] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.110] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.110] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.110] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.111] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.111] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.111] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.111] GetCurrentThreadId () returned 0xa94 [0073.111] SysStringLen (param_1="Name") returned 0x4 [0073.111] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="accupos.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.111] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0073.112] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.112] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.117] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.121] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.122] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.122] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.122] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.122] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.122] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.122] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.122] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.122] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.122] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.122] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.122] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.122] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.122] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.122] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.123] GetCurrentThreadId () returned 0xa94 [0073.123] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.123] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.123] GetCurrentThreadId () returned 0xa94 [0073.123] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.123] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.123] GetCurrentThreadId () returned 0xa94 [0073.123] GetCurrentThreadId () returned 0xa94 [0073.124] GetCurrentThreadId () returned 0xa94 [0073.124] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.124] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.124] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.129] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.129] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.129] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2460 [0073.130] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24d0 [0073.130] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2530 [0073.130] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0073.130] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.130] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.130] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.130] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.130] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.131] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.131] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.131] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.131] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.131] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0073.131] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0073.131] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0073.131] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.131] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.131] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.131] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.131] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.132] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.133] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.133] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.133] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.134] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.134] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.134] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.134] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.134] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.134] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.134] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.134] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.135] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.135] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.135] GetCurrentThreadId () returned 0xa94 [0073.135] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.135] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Mail\\afr38.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.135] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.136] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.136] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.136] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.136] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.136] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.136] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.136] GetCurrentThreadId () returned 0xa94 [0073.136] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.137] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Mail\\afr38.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.137] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.137] CharLowerBuffW (in: lpsz="C:\\Program Files (x86)\\Windows Mail\\afr38.exe", cchLength=0x2e | out: lpsz="c:\\program files (x86)\\windows mail\\afr38.exe") returned 0x2e [0073.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0073.137] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.138] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.138] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd02c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.138] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.138] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.138] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.139] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.139] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.139] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.139] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.139] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.139] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.140] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.140] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.140] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.140] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.140] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.140] SysStringLen (param_1="Name") returned 0x4 [0073.140] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.140] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2590 [0073.141] SysStringLen (param_1="Name") returned 0x4 [0073.141] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.141] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.141] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.141] GetCurrentThreadId () returned 0xa94 [0073.141] SysStringLen (param_1="Name") returned 0x4 [0073.142] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="afr38.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.142] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.142] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.142] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.143] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.143] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.143] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.143] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.143] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.143] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.143] GetCurrentThreadId () returned 0xa94 [0073.143] SysStringLen (param_1="Name") returned 0x4 [0073.143] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="afr38.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.144] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0073.144] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.144] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.149] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.153] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.153] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.153] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.153] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.153] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.154] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.154] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.154] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.154] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.154] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.154] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.154] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.154] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.154] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.155] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.155] GetCurrentThreadId () returned 0xa94 [0073.155] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.155] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.155] GetCurrentThreadId () returned 0xa94 [0073.155] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.156] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.156] GetCurrentThreadId () returned 0xa94 [0073.156] GetCurrentThreadId () returned 0xa94 [0073.156] GetCurrentThreadId () returned 0xa94 [0073.157] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.157] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.157] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.166] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.166] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.166] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2468 [0073.166] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24d8 [0073.166] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2538 [0073.166] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0073.167] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.167] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.167] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.167] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.167] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.167] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.167] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.167] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.168] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.168] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0073.168] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0073.168] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0073.168] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.168] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.168] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.169] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.169] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.169] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.171] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.171] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.171] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.171] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.171] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.171] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.171] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.172] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.172] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.172] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.172] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.172] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.173] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.173] GetCurrentThreadId () returned 0xa94 [0073.173] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.173] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft Office\\aldelo.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.173] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.174] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.174] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.174] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.174] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.175] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.175] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.175] GetCurrentThreadId () returned 0xa94 [0073.175] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.175] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft Office\\aldelo.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.176] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.176] CharLowerBuffW (in: lpsz="C:\\Program Files (x86)\\Microsoft Office\\aldelo.exe", cchLength=0x33 | out: lpsz="c:\\program files (x86)\\microsoft office\\aldelo.exe") returned 0x33 [0073.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0073.177] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.177] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.177] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.177] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd02c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.177] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.177] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.177] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.178] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.178] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.178] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.178] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.178] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.178] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.178] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.178] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.179] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.179] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.179] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.179] SysStringLen (param_1="Name") returned 0x4 [0073.179] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.179] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2598 [0073.179] SysStringLen (param_1="Name") returned 0x4 [0073.179] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.180] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.180] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.180] GetCurrentThreadId () returned 0xa94 [0073.180] SysStringLen (param_1="Name") returned 0x4 [0073.180] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="aldelo.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.180] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.181] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.181] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.181] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.181] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.181] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.181] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.182] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.182] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.182] GetCurrentThreadId () returned 0xa94 [0073.182] SysStringLen (param_1="Name") returned 0x4 [0073.182] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="aldelo.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.183] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eadc, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0073.183] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.183] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.188] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.193] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.193] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.193] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.193] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.193] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.193] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.193] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.193] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.194] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.194] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.194] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.194] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.194] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.194] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.194] GetCurrentThreadId () returned 0xa94 [0073.194] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.194] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.194] GetCurrentThreadId () returned 0xa94 [0073.195] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.195] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.196] GetCurrentThreadId () returned 0xa94 [0073.196] GetCurrentThreadId () returned 0xa94 [0073.196] GetCurrentThreadId () returned 0xa94 [0073.196] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.196] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.196] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.202] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.202] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.202] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2488 [0073.202] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24f8 [0073.202] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2558 [0073.202] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0073.203] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.203] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.203] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.203] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.203] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.203] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.203] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.203] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.203] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.203] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0073.203] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0073.204] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0073.204] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.204] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.204] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.204] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.204] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.204] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.206] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.206] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.206] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.206] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.207] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.207] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.207] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.207] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.207] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.207] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.208] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.208] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.208] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.208] GetCurrentThreadId () returned 0xa94 [0073.209] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.209] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Windows Sidebar\\ccv_server.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.209] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.210] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.210] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.210] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.210] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.210] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.210] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.211] GetCurrentThreadId () returned 0xa94 [0073.211] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.211] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Windows Sidebar\\ccv_server.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.211] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.212] CharLowerBuffW (in: lpsz="C:\\Program Files\\Windows Sidebar\\ccv_server.exe", cchLength=0x30 | out: lpsz="c:\\program files\\windows sidebar\\ccv_server.exe") returned 0x30 [0073.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0073.213] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.213] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.213] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.213] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0a4, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.213] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.213] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.213] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.214] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.214] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.214] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.214] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.214] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.214] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.215] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.215] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.215] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.215] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.215] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.215] SysStringLen (param_1="Name") returned 0x4 [0073.215] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.215] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25b8 [0073.215] SysStringLen (param_1="Name") returned 0x4 [0073.216] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.216] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.216] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.216] GetCurrentThreadId () returned 0xa94 [0073.216] SysStringLen (param_1="Name") returned 0x4 [0073.216] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ccv_server.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.217] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.217] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.217] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.217] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.217] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.217] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.218] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.218] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.218] GetCurrentThreadId () returned 0xa94 [0073.218] SysStringLen (param_1="Name") returned 0x4 [0073.218] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ccv_server.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.219] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.219] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.224] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.228] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.228] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.228] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.229] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.229] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.229] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.229] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.229] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.229] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.229] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.229] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.229] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.229] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.229] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.229] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.229] GetCurrentThreadId () returned 0xa94 [0073.229] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.229] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.229] GetCurrentThreadId () returned 0xa94 [0073.229] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.230] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.230] GetCurrentThreadId () returned 0xa94 [0073.230] GetCurrentThreadId () returned 0xa94 [0073.230] GetCurrentThreadId () returned 0xa94 [0073.230] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.230] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.230] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.237] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.237] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.237] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2490 [0073.237] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2500 [0073.237] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2560 [0073.237] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0073.237] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.237] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.237] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.237] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.237] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.238] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.238] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.238] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.238] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.238] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0073.238] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0073.238] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0073.238] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.238] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.238] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.239] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.239] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.239] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.241] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.241] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.241] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.241] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.241] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.241] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.241] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.241] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.241] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.242] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.242] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.242] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.242] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.242] GetCurrentThreadId () returned 0xa94 [0073.242] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.242] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Adobe\\centralcreditcard.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.243] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.243] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.243] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.243] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.243] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.243] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.243] GetCurrentThreadId () returned 0xa94 [0073.243] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.244] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Adobe\\centralcreditcard.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.244] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.244] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.244] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.244] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.244] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.244] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.245] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.245] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.245] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.245] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.245] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.245] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.245] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.245] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.245] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.246] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.246] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.246] SysStringLen (param_1="Name") returned 0x4 [0073.246] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.246] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25c0 [0073.246] SysStringLen (param_1="Name") returned 0x4 [0073.246] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.246] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.246] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.246] GetCurrentThreadId () returned 0xa94 [0073.247] SysStringLen (param_1="Name") returned 0x4 [0073.247] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="centralcreditcard.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.247] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.247] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.247] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.247] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.247] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.247] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.248] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.248] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.248] GetCurrentThreadId () returned 0xa94 [0073.248] SysStringLen (param_1="Name") returned 0x4 [0073.248] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="centralcreditcard.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.248] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.248] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.253] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.256] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.256] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.256] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.256] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.256] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.256] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.256] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.256] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.256] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.256] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.256] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.256] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.256] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.256] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.257] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.257] GetCurrentThreadId () returned 0xa94 [0073.257] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.257] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.257] GetCurrentThreadId () returned 0xa94 [0073.257] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.257] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.257] GetCurrentThreadId () returned 0xa94 [0073.257] GetCurrentThreadId () returned 0xa94 [0073.257] GetCurrentThreadId () returned 0xa94 [0073.258] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.258] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.258] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.265] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.265] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.265] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0073.265] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0073.265] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0073.265] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0073.265] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.266] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.266] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.266] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.266] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.266] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.266] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.266] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.266] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.266] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0073.266] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0073.266] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0073.267] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.267] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.267] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.267] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.267] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.267] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.269] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.269] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.269] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.269] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.269] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.269] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.269] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.270] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.270] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.270] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.270] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.270] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.270] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.270] GetCurrentThreadId () returned 0xa94 [0073.271] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.271] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows NT\\creditservice.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.271] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.271] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.271] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.271] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.272] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.272] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.272] GetCurrentThreadId () returned 0xa94 [0073.272] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.272] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows NT\\creditservice.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.272] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.272] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.272] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0f4, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.272] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.272] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.273] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.273] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.273] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.273] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.273] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.273] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.273] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.273] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.273] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.273] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.273] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.273] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.274] SysStringLen (param_1="Name") returned 0x4 [0073.274] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.274] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0073.274] SysStringLen (param_1="Name") returned 0x4 [0073.274] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.274] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.274] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.274] GetCurrentThreadId () returned 0xa94 [0073.274] SysStringLen (param_1="Name") returned 0x4 [0073.275] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="creditservice.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.275] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.275] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.275] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.275] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.275] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.275] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.275] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.275] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.275] GetCurrentThreadId () returned 0xa94 [0073.275] SysStringLen (param_1="Name") returned 0x4 [0073.276] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="creditservice.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.276] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.276] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.282] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.286] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.286] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.286] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.286] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.286] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.286] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.286] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.286] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.286] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.287] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.287] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.287] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.287] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.287] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.287] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.287] GetCurrentThreadId () returned 0xa94 [0073.287] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.287] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.287] GetCurrentThreadId () returned 0xa94 [0073.287] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.288] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.288] GetCurrentThreadId () returned 0xa94 [0073.288] GetCurrentThreadId () returned 0xa94 [0073.288] GetCurrentThreadId () returned 0xa94 [0073.288] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.288] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.288] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.294] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.294] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.294] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2468 [0073.294] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24d8 [0073.294] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2538 [0073.294] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0073.295] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.295] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.295] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.295] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.295] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.295] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.295] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.295] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.296] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.296] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0073.296] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0073.296] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0073.296] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.296] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.296] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.296] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.297] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.297] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.298] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.299] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.299] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.299] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.299] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.299] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.299] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.300] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.300] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.300] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.300] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.300] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.300] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.300] GetCurrentThreadId () returned 0xa94 [0073.300] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.300] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Sidebar\\edcsvr.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.301] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.301] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.301] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.301] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.301] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.301] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.301] GetCurrentThreadId () returned 0xa94 [0073.301] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.301] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Sidebar\\edcsvr.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.302] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.302] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.302] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.302] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.302] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.302] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.302] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.302] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.303] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.303] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.303] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.303] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.303] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.303] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.303] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.303] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.303] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.303] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.303] SysStringLen (param_1="Name") returned 0x4 [0073.304] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.304] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2598 [0073.304] SysStringLen (param_1="Name") returned 0x4 [0073.304] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.304] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.304] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.304] GetCurrentThreadId () returned 0xa94 [0073.305] SysStringLen (param_1="Name") returned 0x4 [0073.305] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="edcsvr.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.305] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.305] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.305] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.305] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.305] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.306] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.306] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.306] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.306] GetCurrentThreadId () returned 0xa94 [0073.306] SysStringLen (param_1="Name") returned 0x4 [0073.306] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="edcsvr.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.306] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.307] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.313] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.321] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.321] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.321] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.322] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.322] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.322] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.322] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.322] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.322] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.322] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.322] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.322] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.322] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.322] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.322] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.322] GetCurrentThreadId () returned 0xa94 [0073.323] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.323] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.323] GetCurrentThreadId () returned 0xa94 [0073.323] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.323] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.323] GetCurrentThreadId () returned 0xa94 [0073.323] GetCurrentThreadId () returned 0xa94 [0073.323] GetCurrentThreadId () returned 0xa94 [0073.323] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.323] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.323] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.325] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.325] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.325] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0073.325] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0073.325] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0073.325] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0073.325] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.325] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.325] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.325] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.325] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.325] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.326] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.326] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.326] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.326] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0073.326] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0073.326] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0073.326] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.326] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.326] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.326] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.326] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.326] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.327] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.328] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.328] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.328] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.328] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.328] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.328] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.328] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.328] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.328] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.328] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.328] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.328] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.329] GetCurrentThreadId () returned 0xa94 [0073.329] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.329] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Uninstall Information\\fpos.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.329] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.329] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.329] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.329] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.329] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.329] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.330] GetCurrentThreadId () returned 0xa94 [0073.330] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.330] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Uninstall Information\\fpos.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.330] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.330] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.330] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd054, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.330] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.330] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.331] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.331] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.331] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.331] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.331] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.331] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.331] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.331] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.331] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.331] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.331] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.331] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.331] SysStringLen (param_1="Name") returned 0x4 [0073.332] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.332] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0073.332] SysStringLen (param_1="Name") returned 0x4 [0073.332] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.332] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.332] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.332] GetCurrentThreadId () returned 0xa94 [0073.332] SysStringLen (param_1="Name") returned 0x4 [0073.333] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fpos.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.333] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.333] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.333] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.333] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.333] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.333] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.333] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.333] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.333] GetCurrentThreadId () returned 0xa94 [0073.334] SysStringLen (param_1="Name") returned 0x4 [0073.334] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fpos.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.334] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.334] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.338] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.342] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.342] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.342] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.342] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.342] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.342] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.342] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.342] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.342] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.343] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.343] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.343] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.343] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.343] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.343] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.343] GetCurrentThreadId () returned 0xa94 [0073.343] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.343] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.343] GetCurrentThreadId () returned 0xa94 [0073.343] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.344] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.344] GetCurrentThreadId () returned 0xa94 [0073.344] GetCurrentThreadId () returned 0xa94 [0073.344] GetCurrentThreadId () returned 0xa94 [0073.344] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.344] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.344] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.350] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.350] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.350] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2468 [0073.350] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24d8 [0073.351] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2538 [0073.351] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0073.351] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.351] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.351] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.351] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.351] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.351] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.351] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.351] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.352] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.352] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0073.352] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0073.352] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0073.352] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.352] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.352] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.352] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.352] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.353] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.354] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.354] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.354] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.354] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.355] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.355] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.355] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.355] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.355] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.355] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.355] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.356] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.356] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.356] GetCurrentThreadId () returned 0xa94 [0073.356] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.356] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Defender\\isspos.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.357] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.357] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.357] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.357] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.357] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.357] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.357] GetCurrentThreadId () returned 0xa94 [0073.357] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.358] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Defender\\isspos.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.358] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.358] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.358] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.358] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd07c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.358] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.358] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.358] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.359] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.359] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.359] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.359] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.359] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.359] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.359] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.359] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.359] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.359] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.359] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.360] SysStringLen (param_1="Name") returned 0x4 [0073.360] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.360] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2598 [0073.360] SysStringLen (param_1="Name") returned 0x4 [0073.360] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.361] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.361] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.361] GetCurrentThreadId () returned 0xa94 [0073.361] SysStringLen (param_1="Name") returned 0x4 [0073.361] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="isspos.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.361] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.362] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.362] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.362] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.362] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.362] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.362] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.362] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.363] GetCurrentThreadId () returned 0xa94 [0073.363] SysStringLen (param_1="Name") returned 0x4 [0073.363] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="isspos.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.363] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.363] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.369] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.372] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.372] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.372] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.372] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.372] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.372] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.372] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.372] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.372] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.373] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.373] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.373] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.373] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.373] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.373] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.373] GetCurrentThreadId () returned 0xa94 [0073.373] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.373] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.373] GetCurrentThreadId () returned 0xa94 [0073.374] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.374] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.374] GetCurrentThreadId () returned 0xa94 [0073.374] GetCurrentThreadId () returned 0xa94 [0073.374] GetCurrentThreadId () returned 0xa94 [0073.375] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.375] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.375] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.383] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.383] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.383] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0073.384] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e8 [0073.384] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2548 [0073.384] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0073.384] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.384] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.384] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.385] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.385] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.385] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.385] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.385] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.385] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.386] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0073.386] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0073.386] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0073.386] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.386] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.386] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.386] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.387] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.387] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.389] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.389] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.389] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.389] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.389] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.389] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.390] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.390] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.390] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.390] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.390] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.390] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.391] GetCurrentThreadId () returned 0xa94 [0073.391] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.391] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Windows Media Player\\mxslipstream.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.392] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.392] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.392] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.392] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.392] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.393] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.393] GetCurrentThreadId () returned 0xa94 [0073.393] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.393] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Windows Media Player\\mxslipstream.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.394] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.394] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.394] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.394] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd054, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.394] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.394] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.395] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.395] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.395] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.395] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.395] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.395] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.395] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.396] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.396] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.396] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.396] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.396] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.396] SysStringLen (param_1="Name") returned 0x4 [0073.397] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.397] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0073.397] SysStringLen (param_1="Name") returned 0x4 [0073.397] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.397] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.398] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.398] GetCurrentThreadId () returned 0xa94 [0073.398] SysStringLen (param_1="Name") returned 0x4 [0073.398] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="mxslipstream.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.399] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.399] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.399] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.399] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.399] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.400] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.400] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.400] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.400] GetCurrentThreadId () returned 0xa94 [0073.400] SysStringLen (param_1="Name") returned 0x4 [0073.401] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="mxslipstream.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.401] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.401] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.407] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.412] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.412] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.412] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.412] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.412] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.412] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.412] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.413] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.413] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.413] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.413] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.413] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.413] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.413] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.413] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.413] GetCurrentThreadId () returned 0xa94 [0073.414] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.414] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.414] GetCurrentThreadId () returned 0xa94 [0073.414] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.415] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.415] GetCurrentThreadId () returned 0xa94 [0073.415] GetCurrentThreadId () returned 0xa94 [0073.415] GetCurrentThreadId () returned 0xa94 [0073.415] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.416] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.416] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.424] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.424] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.424] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2470 [0073.424] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24e0 [0073.425] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2540 [0073.425] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0073.425] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.425] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.425] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.426] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.426] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.426] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.426] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.426] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.426] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.427] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0073.427] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0073.427] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0073.427] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.427] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.427] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.428] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.428] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.428] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.430] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.431] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.431] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.431] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.431] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.431] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.431] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.432] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.432] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.432] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.432] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.433] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.433] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.433] GetCurrentThreadId () returned 0xa94 [0073.433] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.433] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Mozilla Maintenance Service\\omnipos.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.434] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.434] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.434] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.434] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.435] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.435] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.435] GetCurrentThreadId () returned 0xa94 [0073.435] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.436] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Mozilla Maintenance Service\\omnipos.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.436] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.436] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.436] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.436] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd07c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.436] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.436] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.437] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.437] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.437] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.437] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.437] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.437] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.437] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.438] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.438] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.438] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.438] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.438] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.438] SysStringLen (param_1="Name") returned 0x4 [0073.438] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.438] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a0 [0073.438] SysStringLen (param_1="Name") returned 0x4 [0073.439] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.440] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.440] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.440] GetCurrentThreadId () returned 0xa94 [0073.440] SysStringLen (param_1="Name") returned 0x4 [0073.441] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="omnipos.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.441] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.441] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.442] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.442] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.442] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.442] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.442] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.442] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.443] GetCurrentThreadId () returned 0xa94 [0073.443] SysStringLen (param_1="Name") returned 0x4 [0073.443] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="omnipos.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.443] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.443] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.450] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.454] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.454] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.454] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.454] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.454] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.454] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.454] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.454] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.454] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.455] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.455] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.455] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.455] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.455] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.455] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.455] GetCurrentThreadId () returned 0xa94 [0073.455] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.455] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.456] GetCurrentThreadId () returned 0xa94 [0073.456] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.457] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.457] GetCurrentThreadId () returned 0xa94 [0073.457] GetCurrentThreadId () returned 0xa94 [0073.457] GetCurrentThreadId () returned 0xa94 [0073.457] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.457] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.457] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.464] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.464] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.464] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2468 [0073.464] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24d8 [0073.464] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2538 [0073.464] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0073.464] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.464] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.464] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.465] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.465] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.465] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.465] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.465] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.465] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.465] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aec610 [0073.465] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0073.465] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b98 [0073.466] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.466] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.466] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.466] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.466] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.466] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.468] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.468] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.468] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.468] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.468] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.468] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.468] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.468] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.468] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.469] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.469] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.469] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.469] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.469] GetCurrentThreadId () returned 0xa94 [0073.469] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.469] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Windows Photo Viewer\\spcwin.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.470] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.470] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.470] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.470] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.470] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.470] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.470] GetCurrentThreadId () returned 0xa94 [0073.470] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.470] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Windows Photo Viewer\\spcwin.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.471] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.471] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.471] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.471] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0f4, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.471] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.471] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.471] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.471] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.471] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.471] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.471] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.471] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.472] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.472] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.472] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.472] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.472] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.472] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.472] SysStringLen (param_1="Name") returned 0x4 [0073.472] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.472] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2598 [0073.472] SysStringLen (param_1="Name") returned 0x4 [0073.472] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.472] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.473] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.473] GetCurrentThreadId () returned 0xa94 [0073.473] SysStringLen (param_1="Name") returned 0x4 [0073.473] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spcwin.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.473] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.473] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.473] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.473] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.473] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.474] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.474] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.474] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.474] GetCurrentThreadId () returned 0xa94 [0073.474] SysStringLen (param_1="Name") returned 0x4 [0073.474] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spcwin.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.474] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.474] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.480] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.482] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.482] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.482] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.482] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.482] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.482] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.482] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.482] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.482] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.482] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.482] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.482] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.482] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0073.482] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.482] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.483] GetCurrentThreadId () returned 0xa94 [0073.483] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.483] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.483] GetCurrentThreadId () returned 0xa94 [0073.483] GetCurrentThreadId () returned 0xa94 [0073.483] GetCurrentThreadId () returned 0xa94 [0073.483] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.483] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.483] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.493] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.493] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.493] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2488 [0073.493] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.493] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.493] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.494] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.494] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.494] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.494] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.494] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.494] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.494] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.494] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.494] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.494] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.494] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.495] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.496] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.496] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.496] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.497] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.497] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.497] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.497] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.497] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.497] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.497] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.497] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.497] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.497] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.497] GetCurrentThreadId () returned 0xa94 [0073.498] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.498] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Adobe\\spgagentservice.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.498] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.498] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.498] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.498] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.498] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.498] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.498] GetCurrentThreadId () returned 0xa94 [0073.499] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.499] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Adobe\\spgagentservice.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.499] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.499] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.499] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0f4, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.499] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.499] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.500] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.500] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.500] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.500] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.500] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.500] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.500] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.500] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.500] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.501] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.501] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.501] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.501] SysStringLen (param_1="Name") returned 0x4 [0073.501] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.501] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25b8 [0073.501] SysStringLen (param_1="Name") returned 0x4 [0073.501] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.502] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.502] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.502] GetCurrentThreadId () returned 0xa94 [0073.502] SysStringLen (param_1="Name") returned 0x4 [0073.502] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spgagentservice.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.502] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.503] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.503] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.503] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.503] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.503] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.503] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.503] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.503] GetCurrentThreadId () returned 0xa94 [0073.504] SysStringLen (param_1="Name") returned 0x4 [0073.504] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spgagentservice.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.504] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.504] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.510] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.514] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.514] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.514] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.514] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.514] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.514] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.514] GetCurrentThreadId () returned 0xa94 [0073.514] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.515] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.515] GetCurrentThreadId () returned 0xa94 [0073.515] GetCurrentThreadId () returned 0xa94 [0073.515] GetCurrentThreadId () returned 0xa94 [0073.515] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.516] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.516] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.523] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.523] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.523] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0073.524] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.524] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.524] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.524] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.524] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.524] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.524] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.524] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.524] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.524] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.525] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.525] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.525] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.525] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.525] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.527] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.527] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.527] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.527] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.527] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.527] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.527] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.527] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.527] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.527] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.528] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.528] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.528] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.528] GetCurrentThreadId () returned 0xa94 [0073.528] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.528] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Windows Media Player\\utg2.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.529] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.529] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.529] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.529] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.529] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.529] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.529] GetCurrentThreadId () returned 0xa94 [0073.529] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.529] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Windows Media Player\\utg2.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.529] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.529] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.529] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd054, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.530] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.530] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.530] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.530] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.530] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.530] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.530] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.530] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.530] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.530] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.531] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.531] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.531] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.531] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.531] SysStringLen (param_1="Name") returned 0x4 [0073.531] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.531] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0073.531] SysStringLen (param_1="Name") returned 0x4 [0073.531] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.531] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.531] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.531] GetCurrentThreadId () returned 0xa94 [0073.531] SysStringLen (param_1="Name") returned 0x4 [0073.531] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="utg2.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.531] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.532] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.532] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.532] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.532] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.532] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.532] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.532] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.532] GetCurrentThreadId () returned 0xa94 [0073.532] SysStringLen (param_1="Name") returned 0x4 [0073.532] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="utg2.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.532] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.532] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.537] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.539] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.539] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.539] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.539] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.539] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.539] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.539] GetCurrentThreadId () returned 0xa94 [0073.539] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.539] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.539] GetCurrentThreadId () returned 0xa94 [0073.539] GetCurrentThreadId () returned 0xa94 [0073.540] GetCurrentThreadId () returned 0xa94 [0073.540] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.540] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.540] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.548] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.548] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.548] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0073.548] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.549] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.549] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.549] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.549] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.549] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.549] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.549] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.549] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.549] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.549] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.549] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.550] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.550] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.550] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.551] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.552] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.552] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.552] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.552] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.552] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.552] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.552] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.552] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.552] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.552] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.552] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.553] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.553] GetCurrentThreadId () returned 0xa94 [0073.553] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.553] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Common Files\\notify native.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.553] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.553] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.553] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.553] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.554] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.554] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.554] GetCurrentThreadId () returned 0xa94 [0073.554] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.554] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Common Files\\notify native.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.554] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.554] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.554] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd11c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.555] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.555] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.555] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.555] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.555] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.555] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.555] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.555] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.555] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.555] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.555] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.555] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.556] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.556] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.556] SysStringLen (param_1="Name") returned 0x4 [0073.556] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.556] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25a8 [0073.556] SysStringLen (param_1="Name") returned 0x4 [0073.556] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.556] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.556] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.556] GetCurrentThreadId () returned 0xa94 [0073.556] SysStringLen (param_1="Name") returned 0x4 [0073.557] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="notify native.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.557] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.557] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.557] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.557] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.557] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.558] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.558] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.558] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.558] GetCurrentThreadId () returned 0xa94 [0073.558] SysStringLen (param_1="Name") returned 0x4 [0073.558] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="notify native.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.559] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.559] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.564] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.570] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.570] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.570] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.570] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.571] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.571] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.571] GetCurrentThreadId () returned 0xa94 [0073.571] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.572] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.572] GetCurrentThreadId () returned 0xa94 [0073.572] GetCurrentThreadId () returned 0xa94 [0073.572] GetCurrentThreadId () returned 0xa94 [0073.573] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.573] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.573] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.579] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.579] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.579] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af24a8 [0073.579] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.580] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.580] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.580] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.580] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.580] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.580] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.580] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.580] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.581] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.581] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.581] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.581] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.581] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.581] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.583] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.583] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.583] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.583] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.583] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.583] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.583] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.583] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.583] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.583] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.583] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.584] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.584] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.584] GetCurrentThreadId () returned 0xa94 [0073.584] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.584] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft Analysis Services\\holland_resulted_plot.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.584] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.584] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.584] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.584] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.584] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.584] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.584] GetCurrentThreadId () returned 0xa94 [0073.584] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.585] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft Analysis Services\\holland_resulted_plot.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.585] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.585] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.585] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.585] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.585] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.585] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.585] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.585] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.585] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.585] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.585] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.585] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.585] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.586] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.586] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.586] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.586] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.586] SysStringLen (param_1="Name") returned 0x4 [0073.586] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.586] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af25d8 [0073.586] SysStringLen (param_1="Name") returned 0x4 [0073.586] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.586] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.586] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.586] GetCurrentThreadId () returned 0xa94 [0073.586] SysStringLen (param_1="Name") returned 0x4 [0073.586] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="holland_resulted_plot.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.586] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0073.587] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.587] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.587] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.587] _wcsicmp (_String1="Name", _String2="Name") returned 0 [0073.587] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.587] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.587] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.587] GetCurrentThreadId () returned 0xa94 [0073.587] SysStringLen (param_1="Name") returned 0x4 [0073.587] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="holland_resulted_plot.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.587] GetVersionExA (in: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18eac8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.587] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9e4) returned 0x1b4 [0073.591] TerminateProcess (hProcess=0x1b8, uExitCode=0x0) returned 1 [0073.594] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.594] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.594] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.594] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.594] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.594] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.594] GetCurrentThreadId () returned 0xa94 [0073.594] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.604] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x46, wParam=0x0, lParam=0x18e428) returned 0x0 [0073.605] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x46, wParam=0x0, lParam=0x18e428) returned 0x0 [0073.606] GetParent (hWnd=0x5026a) returned 0x0 [0073.606] GetWindowRect (in: hWnd=0x5026a, lpRect=0x18e050 | out: lpRect=0x18e050) returned 1 [0073.606] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x47, wParam=0x0, lParam=0x18e428) returned 0x0 [0073.606] GetWindowLongA (hWnd=0x5026a, nIndex=-16) returned 114229248 [0073.606] GetClientRect (in: hWnd=0x5026a, lpRect=0x18e0c0 | out: lpRect=0x18e0c0) returned 1 [0073.606] MapWindowPoints (in: hWndFrom=0x5026a, hWndTo=0x0, lpPoints=0x18e0c0, cPoints=0x2 | out: lpPoints=0x18e0c0) returned 11796638 [0073.608] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x8016b [0073.609] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x83, wParam=0x1, lParam=0x18e00c) returned 0x0 [0073.610] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x47, wParam=0x0, lParam=0x18e428) returned 0x0 [0073.610] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0073.610] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0073.610] GetWindowLongA (hWnd=0x30160, nIndex=0) returned 23470236 [0073.628] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0073.628] GetDesktopWindow () returned 0x10010 [0073.629] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x3013e [0073.629] GetWindow (hWnd=0x3013e, uCmd=0x4) returned 0x3013c [0073.629] GetWindow (hWnd=0x3013e, uCmd=0x2) returned 0x3013c [0073.629] GetWindow (hWnd=0x3013c, uCmd=0x4) returned 0x3013a [0073.629] GetWindow (hWnd=0x3013c, uCmd=0x2) returned 0x300b2 [0073.629] GetWindow (hWnd=0x300b2, uCmd=0x4) returned 0x0 [0073.629] GetWindow (hWnd=0x300b2, uCmd=0x2) returned 0x300ee [0073.629] GetWindow (hWnd=0x300ee, uCmd=0x4) returned 0x0 [0073.629] GetWindow (hWnd=0x300ee, uCmd=0x2) returned 0x400c0 [0073.630] GetWindow (hWnd=0x400c0, uCmd=0x4) returned 0x0 [0073.630] GetWindow (hWnd=0x400c0, uCmd=0x2) returned 0x10144 [0073.630] GetWindow (hWnd=0x10144, uCmd=0x4) returned 0x20142 [0073.630] GetWindow (hWnd=0x10144, uCmd=0x2) returned 0x10122 [0073.630] GetWindow (hWnd=0x10122, uCmd=0x4) returned 0x10056 [0073.630] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x2001e [0073.630] GetWindow (hWnd=0x2001e, uCmd=0x4) returned 0x20028 [0073.630] GetWindow (hWnd=0x2001e, uCmd=0x2) returned 0x20028 [0073.630] GetWindow (hWnd=0x20028, uCmd=0x4) returned 0x20018 [0073.631] GetWindow (hWnd=0x20028, uCmd=0x2) returned 0x10078 [0073.631] GetWindow (hWnd=0x10078, uCmd=0x4) returned 0x10056 [0073.631] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10076 [0073.631] GetWindow (hWnd=0x10076, uCmd=0x4) returned 0x10056 [0073.631] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10062 [0073.631] GetWindow (hWnd=0x10062, uCmd=0x4) returned 0x10056 [0073.631] GetWindow (hWnd=0x10062, uCmd=0x2) returned 0x10090 [0073.631] GetWindow (hWnd=0x10090, uCmd=0x4) returned 0x10056 [0073.631] GetWindow (hWnd=0x10090, uCmd=0x2) returned 0x10080 [0073.631] GetWindow (hWnd=0x10080, uCmd=0x4) returned 0x10056 [0073.631] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x1007e [0073.631] GetWindow (hWnd=0x1007e, uCmd=0x4) returned 0x10056 [0073.631] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x1007a [0073.631] GetWindow (hWnd=0x1007a, uCmd=0x4) returned 0x10056 [0073.631] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10058 [0073.631] GetWindow (hWnd=0x10058, uCmd=0x4) returned 0x10054 [0073.631] GetWindow (hWnd=0x10058, uCmd=0x2) returned 0x10054 [0073.632] GetWindow (hWnd=0x10054, uCmd=0x4) returned 0x1005a [0073.632] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x1005a [0073.632] GetWindow (hWnd=0x1005a, uCmd=0x4) returned 0x10056 [0073.632] GetWindow (hWnd=0x1005a, uCmd=0x2) returned 0x10056 [0073.632] GetWindow (hWnd=0x10056, uCmd=0x4) returned 0x0 [0073.632] GetWindow (hWnd=0x10056, uCmd=0x2) returned 0x100fa [0073.632] GetWindow (hWnd=0x100fa, uCmd=0x4) returned 0x0 [0073.632] GetWindow (hWnd=0x100fa, uCmd=0x2) returned 0x500a0 [0073.632] GetWindow (hWnd=0x500a0, uCmd=0x4) returned 0x0 [0073.632] GetWindow (hWnd=0x500a0, uCmd=0x2) returned 0x10092 [0073.632] GetWindow (hWnd=0x10092, uCmd=0x4) returned 0x0 [0073.632] GetWindow (hWnd=0x10092, uCmd=0x2) returned 0x5026a [0073.632] GetWindow (hWnd=0x5026a, uCmd=0x4) returned 0x4015c [0073.632] IsWindowVisible (hWnd=0x5026a) returned 0 [0073.633] GetWindow (hWnd=0x5026a, uCmd=0x2) returned 0x6015a [0073.633] GetWindow (hWnd=0x6015a, uCmd=0x4) returned 0x4015c [0073.633] IsWindowVisible (hWnd=0x6015a) returned 0 [0073.633] GetWindow (hWnd=0x6015a, uCmd=0x2) returned 0x4015c [0073.633] GetWindow (hWnd=0x4015c, uCmd=0x4) returned 0x0 [0073.633] GetWindow (hWnd=0x4015c, uCmd=0x2) returned 0x30160 [0073.633] GetWindow (hWnd=0x30160, uCmd=0x4) returned 0x0 [0073.633] GetWindow (hWnd=0x30160, uCmd=0x2) returned 0x900a6 [0073.633] GetWindow (hWnd=0x900a6, uCmd=0x4) returned 0x0 [0073.633] GetWindow (hWnd=0x900a6, uCmd=0x2) returned 0x300c6 [0073.633] GetWindow (hWnd=0x300c6, uCmd=0x4) returned 0x900a6 [0073.633] GetWindow (hWnd=0x300c6, uCmd=0x2) returned 0x400d0 [0073.633] GetWindow (hWnd=0x400d0, uCmd=0x4) returned 0x0 [0073.633] GetWindow (hWnd=0x400d0, uCmd=0x2) returned 0x400f0 [0073.634] GetWindow (hWnd=0x400f0, uCmd=0x4) returned 0x900a6 [0073.634] GetWindow (hWnd=0x400f0, uCmd=0x2) returned 0x300de [0073.634] GetWindow (hWnd=0x300de, uCmd=0x4) returned 0x0 [0073.634] GetWindow (hWnd=0x300de, uCmd=0x2) returned 0x300ca [0073.634] GetWindow (hWnd=0x300ca, uCmd=0x4) returned 0x900a6 [0073.634] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x400c4 [0073.634] GetWindow (hWnd=0x400c4, uCmd=0x4) returned 0x900a6 [0073.634] GetWindow (hWnd=0x400c4, uCmd=0x2) returned 0x300ac [0073.634] GetWindow (hWnd=0x300ac, uCmd=0x4) returned 0x900a6 [0073.635] GetWindow (hWnd=0x300ac, uCmd=0x2) returned 0x30158 [0073.635] GetWindow (hWnd=0x30158, uCmd=0x4) returned 0x0 [0073.635] GetWindow (hWnd=0x30158, uCmd=0x2) returned 0x1014e [0073.635] GetWindow (hWnd=0x1014e, uCmd=0x4) returned 0x0 [0073.635] GetWindow (hWnd=0x1014e, uCmd=0x2) returned 0x1014c [0073.635] GetWindow (hWnd=0x1014c, uCmd=0x4) returned 0x0 [0073.635] GetWindow (hWnd=0x1014c, uCmd=0x2) returned 0x20142 [0073.636] GetWindow (hWnd=0x20142, uCmd=0x4) returned 0x0 [0073.636] GetWindow (hWnd=0x20142, uCmd=0x2) returned 0x10136 [0073.636] GetWindow (hWnd=0x10136, uCmd=0x4) returned 0x0 [0073.636] GetWindow (hWnd=0x10136, uCmd=0x2) returned 0x10138 [0073.636] GetWindow (hWnd=0x10138, uCmd=0x4) returned 0x10136 [0073.636] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x1012e [0073.636] GetWindow (hWnd=0x1012e, uCmd=0x4) returned 0x0 [0073.636] GetWindow (hWnd=0x1012e, uCmd=0x2) returned 0x10130 [0073.636] GetWindow (hWnd=0x10130, uCmd=0x4) returned 0x1012e [0073.636] GetWindow (hWnd=0x10130, uCmd=0x2) returned 0x10124 [0073.636] GetWindow (hWnd=0x10124, uCmd=0x4) returned 0x0 [0073.637] GetWindow (hWnd=0x10124, uCmd=0x2) returned 0x10126 [0073.637] GetWindow (hWnd=0x10126, uCmd=0x4) returned 0x10124 [0073.637] GetWindow (hWnd=0x10126, uCmd=0x2) returned 0x200d6 [0073.637] GetWindow (hWnd=0x200d6, uCmd=0x4) returned 0x0 [0073.637] GetWindow (hWnd=0x200d6, uCmd=0x2) returned 0x200a8 [0073.637] GetWindow (hWnd=0x200a8, uCmd=0x4) returned 0x0 [0073.637] GetWindow (hWnd=0x200a8, uCmd=0x2) returned 0x10110 [0073.637] GetWindow (hWnd=0x10110, uCmd=0x4) returned 0x200a8 [0073.638] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x1010c [0073.638] GetWindow (hWnd=0x1010c, uCmd=0x4) returned 0x0 [0073.638] GetWindow (hWnd=0x1010c, uCmd=0x2) returned 0x1010a [0073.638] GetWindow (hWnd=0x1010a, uCmd=0x4) returned 0x10048 [0073.638] GetWindow (hWnd=0x1010a, uCmd=0x2) returned 0x10108 [0073.638] GetWindow (hWnd=0x10108, uCmd=0x4) returned 0x0 [0073.638] GetWindow (hWnd=0x10108, uCmd=0x2) returned 0x10102 [0073.638] GetWindow (hWnd=0x10102, uCmd=0x4) returned 0x0 [0073.638] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x50094 [0073.639] GetWindow (hWnd=0x50094, uCmd=0x4) returned 0x0 [0073.639] GetWindow (hWnd=0x50094, uCmd=0x2) returned 0x1008a [0073.639] GetWindow (hWnd=0x1008a, uCmd=0x4) returned 0x0 [0073.639] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x10088 [0073.639] GetWindow (hWnd=0x10088, uCmd=0x4) returned 0x0 [0073.639] GetWindow (hWnd=0x10088, uCmd=0x2) returned 0x10084 [0073.639] GetWindow (hWnd=0x10084, uCmd=0x4) returned 0x0 [0073.640] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10086 [0073.640] GetWindow (hWnd=0x10086, uCmd=0x4) returned 0x10084 [0073.640] GetWindow (hWnd=0x10086, uCmd=0x2) returned 0x1007c [0073.640] GetWindow (hWnd=0x1007c, uCmd=0x4) returned 0x10066 [0073.640] GetWindow (hWnd=0x1007c, uCmd=0x2) returned 0x1006a [0073.640] GetWindow (hWnd=0x1006a, uCmd=0x4) returned 0x10066 [0073.640] GetWindow (hWnd=0x1006a, uCmd=0x2) returned 0x20020 [0073.640] GetWindow (hWnd=0x20020, uCmd=0x4) returned 0x0 [0073.640] GetWindow (hWnd=0x20020, uCmd=0x2) returned 0x2002a [0073.640] GetWindow (hWnd=0x2002a, uCmd=0x4) returned 0x20020 [0073.641] GetWindow (hWnd=0x2002a, uCmd=0x2) returned 0x10066 [0073.641] GetWindow (hWnd=0x10066, uCmd=0x4) returned 0x0 [0073.641] GetWindow (hWnd=0x10066, uCmd=0x2) returned 0x10052 [0073.641] GetWindow (hWnd=0x10052, uCmd=0x4) returned 0x0 [0073.641] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004a [0073.641] GetWindow (hWnd=0x1004a, uCmd=0x4) returned 0x0 [0073.641] GetWindow (hWnd=0x1004a, uCmd=0x2) returned 0x20046 [0073.641] GetWindow (hWnd=0x20046, uCmd=0x4) returned 0x0 [0073.641] GetWindow (hWnd=0x20046, uCmd=0x2) returned 0x10048 [0073.641] GetWindow (hWnd=0x10048, uCmd=0x4) returned 0x100f2 [0073.642] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x30044 [0073.642] GetWindow (hWnd=0x30044, uCmd=0x4) returned 0x0 [0073.643] GetWindow (hWnd=0x30044, uCmd=0x2) returned 0x2001a [0073.643] GetWindow (hWnd=0x2001a, uCmd=0x4) returned 0x20018 [0073.643] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x20018 [0073.643] GetWindow (hWnd=0x20018, uCmd=0x4) returned 0x0 [0073.643] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x100f2 [0073.644] GetWindow (hWnd=0x100f2, uCmd=0x4) returned 0x0 [0073.644] GetWindow (hWnd=0x100f2, uCmd=0x2) returned 0x0 [0073.644] GetDesktopWindow () returned 0x10010 [0073.644] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x3013e [0073.644] GetWindow (hWnd=0x3013e, uCmd=0x4) returned 0x3013c [0073.644] GetWindow (hWnd=0x3013e, uCmd=0x2) returned 0x3013c [0073.644] GetWindow (hWnd=0x3013c, uCmd=0x4) returned 0x3013a [0073.644] GetWindow (hWnd=0x3013c, uCmd=0x2) returned 0x300b2 [0073.644] GetWindow (hWnd=0x300b2, uCmd=0x4) returned 0x0 [0073.644] IsWindowVisible (hWnd=0x300b2) returned 0 [0073.644] GetWindow (hWnd=0x300b2, uCmd=0x2) returned 0x300ee [0073.645] GetWindow (hWnd=0x300ee, uCmd=0x4) returned 0x0 [0073.645] IsWindowVisible (hWnd=0x300ee) returned 0 [0073.645] GetWindow (hWnd=0x300ee, uCmd=0x2) returned 0x400c0 [0073.645] GetWindow (hWnd=0x400c0, uCmd=0x4) returned 0x0 [0073.645] IsWindowVisible (hWnd=0x400c0) returned 0 [0073.645] GetWindow (hWnd=0x400c0, uCmd=0x2) returned 0x10144 [0073.645] GetWindow (hWnd=0x10144, uCmd=0x4) returned 0x20142 [0073.645] GetWindow (hWnd=0x10144, uCmd=0x2) returned 0x10122 [0073.645] GetWindow (hWnd=0x10122, uCmd=0x4) returned 0x10056 [0073.645] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x2001e [0073.646] GetWindow (hWnd=0x2001e, uCmd=0x4) returned 0x20028 [0073.646] GetWindow (hWnd=0x2001e, uCmd=0x2) returned 0x20028 [0073.646] GetWindow (hWnd=0x20028, uCmd=0x4) returned 0x20018 [0073.646] GetWindow (hWnd=0x20028, uCmd=0x2) returned 0x10078 [0073.646] GetWindow (hWnd=0x10078, uCmd=0x4) returned 0x10056 [0073.646] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10076 [0073.646] GetWindow (hWnd=0x10076, uCmd=0x4) returned 0x10056 [0073.646] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10062 [0073.646] GetWindow (hWnd=0x10062, uCmd=0x4) returned 0x10056 [0073.646] GetWindow (hWnd=0x10062, uCmd=0x2) returned 0x10090 [0073.647] GetWindow (hWnd=0x10090, uCmd=0x4) returned 0x10056 [0073.647] GetWindow (hWnd=0x10090, uCmd=0x2) returned 0x10080 [0073.647] GetWindow (hWnd=0x10080, uCmd=0x4) returned 0x10056 [0073.647] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x1007e [0073.647] GetWindow (hWnd=0x1007e, uCmd=0x4) returned 0x10056 [0073.647] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x1007a [0073.647] GetWindow (hWnd=0x1007a, uCmd=0x4) returned 0x10056 [0073.647] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10058 [0073.647] GetWindow (hWnd=0x10058, uCmd=0x4) returned 0x10054 [0073.647] GetWindow (hWnd=0x10058, uCmd=0x2) returned 0x10054 [0073.648] GetWindow (hWnd=0x10054, uCmd=0x4) returned 0x1005a [0073.648] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x1005a [0073.648] GetWindow (hWnd=0x1005a, uCmd=0x4) returned 0x10056 [0073.648] GetWindow (hWnd=0x1005a, uCmd=0x2) returned 0x10056 [0073.648] GetWindow (hWnd=0x10056, uCmd=0x4) returned 0x0 [0073.648] IsWindowVisible (hWnd=0x10056) returned 1 [0073.648] IsWindowEnabled (hWnd=0x10056) returned 1 [0073.648] GetClassNameA (in: hWnd=0x10056, lpClassName=0x18e270, nMaxCount=20 | out: lpClassName="Shell_TrayWnd") returned 13 [0073.648] lstrcmpiA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0073.648] GetLastActivePopup (hWnd=0x10056) returned 0x1005a [0073.648] SetActiveWindow (hWnd=0x1005a) returned 0x0 [0073.672] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0073.675] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0073.676] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0073.676] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x5d, dwPendingType=0x1) returned 0x2 [0073.677] GetCurrentThreadId () returned 0xa94 [0073.677] GetCurrentThreadId () returned 0xa94 [0073.677] GetCurrentThreadId () returned 0xa94 [0073.677] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.677] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.677] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.678] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.678] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.678] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0073.678] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.678] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.678] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.678] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.678] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.679] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.679] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.679] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.679] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.679] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.679] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.679] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.679] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.679] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.680] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.681] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.681] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.681] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.681] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.681] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.681] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.681] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.681] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.681] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.682] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.682] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.682] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.682] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.682] GetCurrentThreadId () returned 0xa94 [0073.682] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.682] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\wmiprvse.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.682] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.682] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.683] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.683] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.683] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.683] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.683] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.683] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.683] GetCurrentThreadId () returned 0xa94 [0073.683] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.683] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\wmiprvse.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.683] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.683] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\wbem\\wmiprvse.exe", cchLength=0x26 | out: lpsz="c:\\windows\\system32\\wbem\\wmiprvse.exe") returned 0x26 [0073.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0073.684] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.684] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.684] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.684] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.684] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.684] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.684] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.685] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.685] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.685] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.685] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.685] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.685] GetCurrentThreadId () returned 0xa94 [0073.685] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.685] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.685] GetCurrentThreadId () returned 0xa94 [0073.685] GetCurrentThreadId () returned 0xa94 [0073.685] GetCurrentThreadId () returned 0xa94 [0073.686] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.686] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.686] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.692] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.692] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.692] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0073.692] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.692] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.692] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.693] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.693] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.693] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.693] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.693] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.693] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.693] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.693] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.693] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.693] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.693] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.694] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.695] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.695] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.695] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.695] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.696] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.696] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.696] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.696] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.696] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.696] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.696] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.697] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.697] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.697] GetCurrentThreadId () returned 0xa94 [0073.697] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.697] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\wmiprvse.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.697] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.697] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.698] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.698] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.698] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.698] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.698] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.698] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.698] GetCurrentThreadId () returned 0xa94 [0073.699] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.699] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\wmiprvse.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.699] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.699] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\wbem\\wmiprvse.exe", cchLength=0x26 | out: lpsz="c:\\windows\\system32\\wbem\\wmiprvse.exe") returned 0x26 [0073.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0073.700] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.700] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.700] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.700] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd07c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.700] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.700] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.700] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.701] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.701] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.701] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.701] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.701] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.701] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.701] GetCurrentThreadId () returned 0xa94 [0073.702] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.702] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.702] GetCurrentThreadId () returned 0xa94 [0073.702] GetCurrentThreadId () returned 0xa94 [0073.703] GetCurrentThreadId () returned 0xa94 [0073.703] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.703] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.703] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.705] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.705] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.706] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2478 [0073.706] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.706] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.706] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.706] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.706] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.706] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.706] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.706] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.707] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.707] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.707] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.707] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.707] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.707] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.708] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.709] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.709] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.709] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.709] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.710] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.710] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.710] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.710] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.710] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.710] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.710] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.711] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.711] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.711] GetCurrentThreadId () returned 0xa94 [0073.711] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.711] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\taskhost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.711] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.712] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.712] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.712] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.712] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.712] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.713] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.713] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.713] GetCurrentThreadId () returned 0xa94 [0073.713] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.713] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\taskhost.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.713] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.714] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\taskhost.exe", cchLength=0x21 | out: lpsz="c:\\windows\\system32\\taskhost.exe") returned 0x21 [0073.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0073.714] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.714] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.714] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.715] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd054, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.715] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.715] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.715] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.715] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.715] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.715] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.716] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.716] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.716] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.716] GetCurrentThreadId () returned 0xa94 [0073.716] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x4af2010, puReturned=0x18ec78*=0x1) returned 0x0 [0073.716] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.716] GetCurrentThreadId () returned 0xa94 [0073.717] GetCurrentThreadId () returned 0xa94 [0073.717] GetCurrentThreadId () returned 0xa94 [0073.717] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.717] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.717] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.718] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0af0 [0073.718] IUnknown:AddRef (This=0x4af2010) returned 0x2 [0073.719] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2460 [0073.719] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.719] IUnknown:AddRef (This=0x4aed8f4) returned 0x4 [0073.719] IUnknown:QueryInterface (in: This=0x4aed8f4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x4aed8f8) returned 0x0 [0073.719] IClientSecurity:QueryBlanket (in: This=0x4aed8f8, pProxy=0x4aed8f4, pAuthnSvc=0x18ebd0, pAuthzSvc=0x18ebd4, pServerPrincName=0x0, pAuthnLevel=0x18ebf0, pImpLevel=0x18ebfc, pAuthInfo=0x0, pCapabilites=0x18ebe8 | out: pAuthnSvc=0x18ebd0*=0xa, pAuthzSvc=0x18ebd4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ebf0*=0x6, pImpLevel=0x18ebfc*=0x3, pAuthInfo=0x0, pCapabilites=0x18ebe8*=0x20) returned 0x0 [0073.719] IUnknown:Release (This=0x4aed8f8) returned 0x4 [0073.719] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.719] WbemLocator:IUnknown:AddRef (This=0x4aed7f4) returned 0x3 [0073.719] IUnknown:Release (This=0x4aed8f4) returned 0x3 [0073.720] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0073.721] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.721] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.721] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.721] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.721] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.722] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18ec54*=0x0 | out: pptlib=0x18ec54*=0x2f9d40) returned 0x0 [0073.723] ITypeLib:GetTypeInfoOfGuid (in: This=0x2f9d40, GUID=0x753e55e4*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x4aec628 | out: ppTInfo=0x4aec628*=0x2fb99c) returned 0x0 [0073.724] IUnknown:Release (This=0x2f9d40) returned 0x3 [0073.724] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.724] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.724] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.724] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.725] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.725] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.725] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0073.725] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.725] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.725] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.725] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.725] GetCurrentThreadId () returned 0xa94 [0073.725] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.726] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\ProgramData\\zhang.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.726] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.726] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.726] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="ExecutablePath", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.726] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.726] _wcsicmp (_String1="ExecutablePath", _String2="ExecutablePath") returned 0 [0073.726] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.726] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.726] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.726] GetCurrentThreadId () returned 0xa94 [0073.727] SysStringLen (param_1="ExecutablePath") returned 0xe [0073.727] IWbemClassObject:Get (in: This=0x4af2010, wszName="ExecutablePath", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\ProgramData\\zhang.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.727] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.727] CharLowerBuffW (in: lpsz="C:\\ProgramData\\zhang.exe", cchLength=0x19 | out: lpsz="c:\\programdata\\zhang.exe") returned 0x19 [0073.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0073.727] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.727] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0073.728] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0073.728] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd07c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0073.728] SysReAllocStringLen (in: pbstr=0x18ecf0*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecf0*="C:") returned 1 [0073.728] VarCat (in: pvarLeft=0x18edcc, pvarRight=0x18ed7c, pvarResult=0x18edbc | out: pvarResult=0x18edbc) returned 0x0 [0073.728] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xc | out: lpsz="c:\\windows\\") returned 0xc [0073.728] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18eb84, nSize=0x104 | out: lpFilename="C:\\ProgramData\\zhang.exe" (normalized: "c:\\programdata\\zhang.exe")) returned 0x18 [0073.728] lstrcpynA (in: lpString1=0x18ea70, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.728] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0073.728] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0073.728] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0073.728] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0073.729] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.729] DispGetIDsOfNames (in: ptinfo=0x2fb99c, rgszNames=0x18eccc*="Name", cNames=0x1, rgdispid=0x18ecd0 | out: rgdispid=0x18ecd0*=-1) returned 0x80020006 [0073.729] _wcsicmp (_String1="ExecutablePath", _String2="Name") returned -9 [0073.729] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.729] IUnknown:AddRef (This=0x4af2010) returned 0x3 [0073.729] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x18ebdc*=0) returned 0x0 [0073.729] IUnknown:Release (This=0x4af2010) returned 0x2 [0073.729] SysStringLen (param_1="Name") returned 0x4 [0073.729] _wcsicmp (_String1="Name", _String2="ExecutablePath") returned 9 [0073.729] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4af2590 [0073.729] SysStringLen (param_1="Name") returned 0x4 [0073.729] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.730] IUnknown:AddRef (This=0x2fb99c) returned 0x2 [0073.730] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.730] GetCurrentThreadId () returned 0xa94 [0073.730] SysStringLen (param_1="Name") returned 0x4 [0073.730] IWbemClassObject:Get (in: This=0x4af2010, wszName="Name", lFlags=0, pVal=0x18eb70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18eba8, varVal2=0x753e2d81), pType=0x18eb80*=1967009158, plFlavor=0x0 | out: pVal=0x18eb70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="zhang.exe", varVal2=0x753e2d81), pType=0x18eb80*=8, plFlavor=0x0) returned 0x0 [0073.730] IUnknown:Release (This=0x2fb99c) returned 0x1 [0073.730] VarCmp (pvarLeft=0x18edec, pvarRight=0x18edfc, lcid=0x0, dwFlags=0x30001) returned 0x1 [0073.730] IUnknown:Release (This=0x4af2010) returned 0x1 [0073.730] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x2 [0073.730] IUnknown:Release (This=0x4af2010) returned 0x0 [0073.730] IUnknown:Release (This=0x2fb99c) returned 0x0 [0073.730] IUnknown:AddRef (This=0x4aed8f4) returned 0x3 [0073.730] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0073.730] GetCurrentThreadId () returned 0xa94 [0073.730] IEnumWbemClassObject:Next (in: This=0x4aed8f4, lTimeout=-1, uCount=0x1, apObjects=0x18ec80, puReturned=0x18ec78 | out: apObjects=0x18ec80*=0x0, puReturned=0x18ec78*=0x0) returned 0x1 [0073.731] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0073.731] GetCurrentThreadId () returned 0xa94 [0073.731] GetCurrentThreadId () returned 0xa94 [0073.731] GetCurrentThreadId () returned 0xa94 [0073.731] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.731] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.731] PeekMessageA (in: lpMsg=0x18e470, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e470) returned 0 [0073.732] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec34 | out: pperrinfo=0x18ec34*=0x0) returned 0x1 [0073.732] IUnknown:Release (This=0x4aed8f4) returned 0x2 [0073.732] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18ec78 | out: pperrinfo=0x18ec78*=0x0) returned 0x1 [0073.734] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x1 [0073.734] WbemLocator:IUnknown:Release (This=0x4aed7f4) returned 0x0 [0073.735] IUnknown:Release (This=0x2fb894) returned 0x0 [0073.735] IUnknown:Release (This=0x4aed8f4) returned 0x1 [0073.735] IUnknown:Release (This=0x4aed8f4) returned 0x0 [0073.738] IUnknown:Release (This=0x2fb944) returned 0x0 [0073.739] LoadLibraryA (lpLibFileName="SrClient") returned 0x75260000 [0075.888] SetErrorMode (uMode=0x8001) returned 0x8001 [0075.889] GetProcAddress (hModule=0x75260000, lpProcName="SRRemoveRestorePoint") returned 0x75263117 [0075.889] SRRemoveRestorePoint (dwRPNum=0x0) returned 0x2 [0075.891] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0075.891] GetCurrentThreadId () returned 0xa94 [0075.891] GetCurrentThreadId () returned 0xa94 [0075.892] GetCurrentThreadId () returned 0xa94 [0075.892] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0075.892] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0075.892] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0075.892] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0075.966] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x4e, dwPendingType=0x1) returned 0x2 [0075.967] GetCurrentThreadId () returned 0xa94 [0075.967] GetCurrentThreadId () returned 0xa94 [0075.967] GetCurrentThreadId () returned 0xa94 [0075.967] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0075.967] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0075.967] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0075.967] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0075.983] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x5e, dwPendingType=0x1) returned 0x2 [0075.983] GetCurrentThreadId () returned 0xa94 [0075.983] GetCurrentThreadId () returned 0xa94 [0075.984] GetCurrentThreadId () returned 0xa94 [0075.984] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0075.984] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0075.984] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0075.984] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0076.179] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0076.179] GetCurrentThreadId () returned 0xa94 [0076.180] GetCurrentThreadId () returned 0xa94 [0076.180] GetCurrentThreadId () returned 0xa94 [0076.180] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0076.180] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0076.181] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0076.220] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0076.220] GetCurrentThreadId () returned 0xa94 [0076.220] GetCurrentThreadId () returned 0xa94 [0076.220] GetCurrentThreadId () returned 0xa94 [0076.221] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0076.221] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0076.221] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0076.221] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0076.356] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x7d, dwPendingType=0x1) returned 0x2 [0076.356] GetCurrentThreadId () returned 0xa94 [0076.357] GetCurrentThreadId () returned 0xa94 [0076.357] GetCurrentThreadId () returned 0xa94 [0076.357] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0076.357] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0076.357] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0076.357] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0076.442] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xcb, dwPendingType=0x1) returned 0x2 [0076.442] GetCurrentThreadId () returned 0xa94 [0076.442] GetCurrentThreadId () returned 0xa94 [0076.442] GetCurrentThreadId () returned 0xa94 [0076.442] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0076.442] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0076.442] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0076.442] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0076.465] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xea, dwPendingType=0x1) returned 0x2 [0076.466] GetCurrentThreadId () returned 0xa94 [0076.466] GetCurrentThreadId () returned 0xa94 [0076.466] GetCurrentThreadId () returned 0xa94 [0076.466] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0076.466] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0076.466] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0076.466] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0076.934] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x158, dwPendingType=0x1) returned 0x2 [0076.934] GetCurrentThreadId () returned 0xa94 [0076.934] GetCurrentThreadId () returned 0xa94 [0076.934] GetCurrentThreadId () returned 0xa94 [0076.934] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0076.934] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0076.934] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0076.934] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.142] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1c5, dwPendingType=0x1) returned 0x2 [0077.142] GetCurrentThreadId () returned 0xa94 [0077.142] GetCurrentThreadId () returned 0xa94 [0077.142] GetCurrentThreadId () returned 0xa94 [0077.142] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.142] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.142] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0077.142] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.199] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x203, dwPendingType=0x1) returned 0x2 [0077.199] GetCurrentThreadId () returned 0xa94 [0077.199] GetCurrentThreadId () returned 0xa94 [0077.199] GetCurrentThreadId () returned 0xa94 [0077.199] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.199] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.199] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0077.199] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.246] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x232, dwPendingType=0x1) returned 0x2 [0077.246] GetCurrentThreadId () returned 0xa94 [0077.246] GetCurrentThreadId () returned 0xa94 [0077.246] GetCurrentThreadId () returned 0xa94 [0077.246] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.246] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.246] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0077.247] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.477] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2af, dwPendingType=0x1) returned 0x2 [0077.477] GetCurrentThreadId () returned 0xa94 [0077.477] GetCurrentThreadId () returned 0xa94 [0077.477] GetCurrentThreadId () returned 0xa94 [0077.477] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.477] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.477] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0077.477] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.576] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x31c, dwPendingType=0x1) returned 0x2 [0077.576] GetCurrentThreadId () returned 0xa94 [0077.576] GetCurrentThreadId () returned 0xa94 [0077.576] GetCurrentThreadId () returned 0xa94 [0077.576] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.576] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.576] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0077.576] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.615] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x33b, dwPendingType=0x1) returned 0x2 [0077.615] GetCurrentThreadId () returned 0xa94 [0077.615] GetCurrentThreadId () returned 0xa94 [0077.615] GetCurrentThreadId () returned 0xa94 [0077.615] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.615] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.615] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0077.615] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.688] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x389, dwPendingType=0x1) returned 0x2 [0077.689] GetCurrentThreadId () returned 0xa94 [0077.689] GetCurrentThreadId () returned 0xa94 [0077.689] GetCurrentThreadId () returned 0xa94 [0077.689] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.689] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.689] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0077.690] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.822] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x406, dwPendingType=0x1) returned 0x2 [0077.823] GetCurrentThreadId () returned 0xa94 [0077.823] GetCurrentThreadId () returned 0xa94 [0077.823] GetCurrentThreadId () returned 0xa94 [0077.823] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.823] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.823] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0077.823] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.917] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x473, dwPendingType=0x1) returned 0x2 [0077.917] GetCurrentThreadId () returned 0xa94 [0077.917] GetCurrentThreadId () returned 0xa94 [0077.917] GetCurrentThreadId () returned 0xa94 [0077.917] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.917] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0077.917] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0077.917] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0077.917] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.026] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x4e0, dwPendingType=0x1) returned 0x2 [0078.026] GetCurrentThreadId () returned 0xa94 [0078.026] GetCurrentThreadId () returned 0xa94 [0078.026] GetCurrentThreadId () returned 0xa94 [0078.026] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.026] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.026] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0078.026] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.135] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x54e, dwPendingType=0x1) returned 0x2 [0078.135] GetCurrentThreadId () returned 0xa94 [0078.135] GetCurrentThreadId () returned 0xa94 [0078.135] GetCurrentThreadId () returned 0xa94 [0078.135] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.135] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.135] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0078.135] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.230] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x5ab, dwPendingType=0x1) returned 0x2 [0078.230] GetCurrentThreadId () returned 0xa94 [0078.230] GetCurrentThreadId () returned 0xa94 [0078.230] GetCurrentThreadId () returned 0xa94 [0078.230] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.230] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.230] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0078.230] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.244] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x5bb, dwPendingType=0x1) returned 0x2 [0078.244] GetCurrentThreadId () returned 0xa94 [0078.244] GetCurrentThreadId () returned 0xa94 [0078.244] GetCurrentThreadId () returned 0xa94 [0078.244] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.244] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.244] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0078.244] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.353] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x628, dwPendingType=0x1) returned 0x2 [0078.353] GetCurrentThreadId () returned 0xa94 [0078.354] GetCurrentThreadId () returned 0xa94 [0078.354] GetCurrentThreadId () returned 0xa94 [0078.354] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.354] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.354] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0078.354] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.462] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x695, dwPendingType=0x1) returned 0x2 [0078.462] GetCurrentThreadId () returned 0xa94 [0078.463] GetCurrentThreadId () returned 0xa94 [0078.463] GetCurrentThreadId () returned 0xa94 [0078.463] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.463] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.463] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0078.463] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.564] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x6e3, dwPendingType=0x1) returned 0x2 [0078.564] GetCurrentThreadId () returned 0xa94 [0078.564] GetCurrentThreadId () returned 0xa94 [0078.565] GetCurrentThreadId () returned 0xa94 [0078.565] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.565] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.565] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0078.565] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.587] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x702, dwPendingType=0x1) returned 0x2 [0078.587] GetCurrentThreadId () returned 0xa94 [0078.587] GetCurrentThreadId () returned 0xa94 [0078.587] GetCurrentThreadId () returned 0xa94 [0078.587] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.587] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.587] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0078.588] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.697] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x770, dwPendingType=0x1) returned 0x2 [0078.697] GetCurrentThreadId () returned 0xa94 [0078.697] GetCurrentThreadId () returned 0xa94 [0078.697] GetCurrentThreadId () returned 0xa94 [0078.697] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.697] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.697] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0078.697] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.846] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x7fc, dwPendingType=0x1) returned 0x2 [0078.869] GetCurrentThreadId () returned 0xa94 [0078.869] GetCurrentThreadId () returned 0xa94 [0078.869] GetCurrentThreadId () returned 0xa94 [0078.869] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.869] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.869] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0078.870] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0078.870] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0078.933] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x85a, dwPendingType=0x1) returned 0x2 [0078.961] GetCurrentThreadId () returned 0xa94 [0079.027] GetCurrentThreadId () returned 0xa94 [0079.072] GetCurrentThreadId () returned 0xa94 [0079.072] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.072] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.072] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0079.072] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0079.072] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.136] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x924, dwPendingType=0x1) returned 0x2 [0079.136] GetCurrentThreadId () returned 0xa94 [0079.136] GetCurrentThreadId () returned 0xa94 [0079.136] GetCurrentThreadId () returned 0xa94 [0079.136] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.136] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.136] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0079.136] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.196] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x953, dwPendingType=0x1) returned 0x2 [0079.196] GetCurrentThreadId () returned 0xa94 [0079.196] GetCurrentThreadId () returned 0xa94 [0079.196] GetCurrentThreadId () returned 0xa94 [0079.196] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.196] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.196] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0079.196] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.258] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x992, dwPendingType=0x1) returned 0x2 [0079.258] GetCurrentThreadId () returned 0xa94 [0079.258] GetCurrentThreadId () returned 0xa94 [0079.258] GetCurrentThreadId () returned 0xa94 [0079.258] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.258] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.259] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0079.259] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.306] GetLastError () returned 0x2 [0079.306] SRRemoveRestorePoint (dwRPNum=0x1) returned 0x2 [0079.309] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0079.309] GetCurrentThreadId () returned 0xa94 [0079.309] GetCurrentThreadId () returned 0xa94 [0079.310] GetCurrentThreadId () returned 0xa94 [0079.310] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0079.310] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0079.310] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0079.325] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0079.325] GetCurrentThreadId () returned 0xa94 [0079.325] GetCurrentThreadId () returned 0xa94 [0079.325] GetCurrentThreadId () returned 0xa94 [0079.325] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.325] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.326] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.367] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2f, dwPendingType=0x1) returned 0x2 [0079.367] GetCurrentThreadId () returned 0xa94 [0079.367] GetCurrentThreadId () returned 0xa94 [0079.368] GetCurrentThreadId () returned 0xa94 [0079.368] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.368] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.368] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0079.368] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.405] GetLastError () returned 0x2 [0079.406] SRRemoveRestorePoint (dwRPNum=0x2) returned 0x2 [0079.407] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0079.407] GetCurrentThreadId () returned 0xa94 [0079.407] GetCurrentThreadId () returned 0xa94 [0079.407] GetCurrentThreadId () returned 0xa94 [0079.407] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0079.407] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0079.407] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0079.411] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0079.411] GetCurrentThreadId () returned 0xa94 [0079.411] GetCurrentThreadId () returned 0xa94 [0079.411] GetCurrentThreadId () returned 0xa94 [0079.411] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.411] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.411] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.476] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x4e, dwPendingType=0x1) returned 0x2 [0079.477] GetCurrentThreadId () returned 0xa94 [0079.477] GetCurrentThreadId () returned 0xa94 [0079.477] GetCurrentThreadId () returned 0xa94 [0079.477] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.477] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.477] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0079.477] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.484] GetLastError () returned 0x2 [0079.485] SRRemoveRestorePoint (dwRPNum=0x3) returned 0x0 [0079.486] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0079.486] GetCurrentThreadId () returned 0xa94 [0079.486] GetCurrentThreadId () returned 0xa94 [0079.486] GetCurrentThreadId () returned 0xa94 [0079.486] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0079.487] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0079.487] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0079.490] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0079.490] GetCurrentThreadId () returned 0xa94 [0079.490] GetCurrentThreadId () returned 0xa94 [0079.490] GetCurrentThreadId () returned 0xa94 [0079.491] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.491] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.491] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.557] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2f, dwPendingType=0x1) returned 0x2 [0079.557] GetCurrentThreadId () returned 0xa94 [0079.557] GetCurrentThreadId () returned 0xa94 [0079.557] GetCurrentThreadId () returned 0xa94 [0079.558] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.558] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.558] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0079.558] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0079.617] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0079.618] GetCurrentThreadId () returned 0xa94 [0079.618] GetCurrentThreadId () returned 0xa94 [0079.618] GetCurrentThreadId () returned 0xa94 [0079.618] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0079.618] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0079.618] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0079.618] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0079.731] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x6d, dwPendingType=0x1) returned 0x2 [0079.737] GetCurrentThreadId () returned 0xa94 [0079.737] GetCurrentThreadId () returned 0xa94 [0079.738] GetCurrentThreadId () returned 0xa94 [0079.738] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0079.738] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0079.738] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0079.738] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0079.837] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xdb, dwPendingType=0x1) returned 0x2 [0079.837] GetCurrentThreadId () returned 0xa94 [0079.841] GetCurrentThreadId () returned 0xa94 [0079.842] GetCurrentThreadId () returned 0xa94 [0079.842] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0079.842] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0079.843] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0079.843] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0079.859] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xea, dwPendingType=0x1) returned 0x2 [0079.860] GetCurrentThreadId () returned 0xa94 [0079.860] GetCurrentThreadId () returned 0xa94 [0079.860] GetCurrentThreadId () returned 0xa94 [0079.861] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0079.861] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0079.861] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0079.861] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.030] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x196, dwPendingType=0x1) returned 0x2 [0080.030] GetCurrentThreadId () returned 0xa94 [0080.030] GetCurrentThreadId () returned 0xa94 [0080.030] GetCurrentThreadId () returned 0xa94 [0080.030] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.030] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.030] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0080.030] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.054] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1b5, dwPendingType=0x1) returned 0x2 [0080.054] GetCurrentThreadId () returned 0xa94 [0080.054] GetCurrentThreadId () returned 0xa94 [0080.055] GetCurrentThreadId () returned 0xa94 [0080.055] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.056] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.056] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0080.056] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.175] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x222, dwPendingType=0x1) returned 0x2 [0080.175] GetCurrentThreadId () returned 0xa94 [0080.175] GetCurrentThreadId () returned 0xa94 [0080.176] GetCurrentThreadId () returned 0xa94 [0080.177] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.177] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.177] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0080.180] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0080.180] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.391] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2fd, dwPendingType=0x1) returned 0x2 [0080.391] GetCurrentThreadId () returned 0xa94 [0080.391] GetCurrentThreadId () returned 0xa94 [0080.645] GetCurrentThreadId () returned 0xa94 [0080.645] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.672] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.672] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0080.672] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0080.672] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0080.672] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0080.672] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.724] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x444, dwPendingType=0x1) returned 0x2 [0080.724] GetCurrentThreadId () returned 0xa94 [0080.725] GetCurrentThreadId () returned 0xa94 [0080.725] GetCurrentThreadId () returned 0xa94 [0080.725] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.725] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.725] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0080.725] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.880] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x4d1, dwPendingType=0x1) returned 0x2 [0080.880] GetCurrentThreadId () returned 0xa94 [0080.881] GetCurrentThreadId () returned 0xa94 [0080.881] GetCurrentThreadId () returned 0xa94 [0080.881] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.881] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.881] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0080.881] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0080.881] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.904] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0080.904] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0080.904] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0080.904] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x4f0, dwPendingType=0x1) returned 0x2 [0080.904] GetCurrentThreadId () returned 0xa94 [0080.904] GetCurrentThreadId () returned 0xa94 [0080.904] GetCurrentThreadId () returned 0xa94 [0080.904] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.905] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.905] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.943] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x51f, dwPendingType=0x1) returned 0x2 [0080.944] GetCurrentThreadId () returned 0xa94 [0080.944] GetCurrentThreadId () returned 0xa94 [0080.944] GetCurrentThreadId () returned 0xa94 [0080.944] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.944] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0080.944] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0080.944] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0081.236] GetLastError () returned 0x0 [0081.236] SRRemoveRestorePoint (dwRPNum=0x4) returned 0x0 [0081.239] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0081.239] GetCurrentThreadId () returned 0xa94 [0081.239] GetCurrentThreadId () returned 0xa94 [0081.239] GetCurrentThreadId () returned 0xa94 [0081.239] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0081.239] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0081.239] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0081.239] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0081.239] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0081.471] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xea, dwPendingType=0x1) returned 0x2 [0081.471] GetCurrentThreadId () returned 0xa94 [0081.475] GetCurrentThreadId () returned 0xa94 [0081.489] GetCurrentThreadId () returned 0xa94 [0081.703] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0081.707] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0081.710] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0081.714] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0081.714] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0081.717] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0081.750] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0081.750] GetCurrentThreadId () returned 0xa94 [0081.750] GetCurrentThreadId () returned 0xa94 [0081.750] GetCurrentThreadId () returned 0xa94 [0081.750] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0081.750] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0081.751] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0081.751] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0081.832] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x5e, dwPendingType=0x1) returned 0x2 [0081.832] GetCurrentThreadId () returned 0xa94 [0081.832] GetCurrentThreadId () returned 0xa94 [0081.832] GetCurrentThreadId () returned 0xa94 [0081.832] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0081.833] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0081.833] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0081.833] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0081.879] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x8d, dwPendingType=0x1) returned 0x2 [0081.879] GetCurrentThreadId () returned 0xa94 [0081.879] GetCurrentThreadId () returned 0xa94 [0081.879] GetCurrentThreadId () returned 0xa94 [0081.879] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0081.879] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0081.879] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0081.879] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0081.916] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0081.916] GetCurrentThreadId () returned 0xa94 [0081.916] GetCurrentThreadId () returned 0xa94 [0081.916] GetCurrentThreadId () returned 0xa94 [0081.916] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0081.916] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0081.917] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0081.991] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x4e, dwPendingType=0x1) returned 0x2 [0081.994] GetCurrentThreadId () returned 0xa94 [0081.994] GetCurrentThreadId () returned 0xa94 [0082.058] GetCurrentThreadId () returned 0xa94 [0082.059] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0082.080] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0082.080] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0082.080] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0082.232] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0082.261] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0082.427] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0082.429] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0082.899] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x3b7, dwPendingType=0x1) returned 0x2 [0082.899] GetCurrentThreadId () returned 0xa94 [0082.899] GetCurrentThreadId () returned 0xa94 [0082.899] GetCurrentThreadId () returned 0xa94 [0082.899] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0082.899] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0082.899] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0082.899] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0082.899] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0083.266] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x51e, dwPendingType=0x1) returned 0x2 [0083.266] GetCurrentThreadId () returned 0xa94 [0083.266] GetCurrentThreadId () returned 0xa94 [0083.360] GetCurrentThreadId () returned 0xa94 [0083.360] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0083.361] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0083.361] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0083.361] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0083.361] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0083.361] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0083.361] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0083.404] GetLastError () returned 0x0 [0083.404] SRRemoveRestorePoint (dwRPNum=0x5) returned 0x0 [0083.405] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0083.406] GetCurrentThreadId () returned 0xa94 [0083.406] GetCurrentThreadId () returned 0xa94 [0083.406] GetCurrentThreadId () returned 0xa94 [0083.406] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0083.406] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0083.406] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0083.409] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0083.409] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0083.409] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0083.409] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xf, dwPendingType=0x1) returned 0x2 [0083.409] GetCurrentThreadId () returned 0xa94 [0083.409] GetCurrentThreadId () returned 0xa94 [0083.410] GetCurrentThreadId () returned 0xa94 [0083.410] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0083.410] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0083.410] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0083.421] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0083.421] GetCurrentThreadId () returned 0xa94 [0083.421] GetCurrentThreadId () returned 0xa94 [0083.421] GetCurrentThreadId () returned 0xa94 [0083.421] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0083.421] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0083.421] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0083.439] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1f, dwPendingType=0x1) returned 0x2 [0083.439] GetCurrentThreadId () returned 0xa94 [0083.439] GetCurrentThreadId () returned 0xa94 [0083.439] GetCurrentThreadId () returned 0xa94 [0083.439] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0083.439] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0083.439] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0083.440] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0083.524] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0083.524] GetCurrentThreadId () returned 0xa94 [0083.524] GetCurrentThreadId () returned 0xa94 [0083.524] GetCurrentThreadId () returned 0xa94 [0083.524] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0083.524] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0083.524] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0083.548] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x20, dwPendingType=0x1) returned 0x2 [0083.548] GetCurrentThreadId () returned 0xa94 [0083.548] GetCurrentThreadId () returned 0xa94 [0083.548] GetCurrentThreadId () returned 0xa94 [0083.548] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0083.548] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0083.548] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0083.549] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0083.642] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x7d, dwPendingType=0x1) returned 0x2 [0083.642] GetCurrentThreadId () returned 0xa94 [0083.642] GetCurrentThreadId () returned 0xa94 [0083.642] GetCurrentThreadId () returned 0xa94 [0083.642] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0083.642] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0083.642] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0083.642] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0083.657] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x8d, dwPendingType=0x1) returned 0x2 [0083.657] GetCurrentThreadId () returned 0xa94 [0083.657] GetCurrentThreadId () returned 0xa94 [0083.658] GetCurrentThreadId () returned 0xa94 [0083.658] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0083.658] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0083.658] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0083.658] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0083.766] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xfa, dwPendingType=0x1) returned 0x2 [0083.766] GetCurrentThreadId () returned 0xa94 [0083.767] GetCurrentThreadId () returned 0xa94 [0083.767] GetCurrentThreadId () returned 0xa94 [0083.767] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0083.767] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0083.767] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0083.767] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0084.244] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2ce, dwPendingType=0x1) returned 0x2 [0084.244] GetCurrentThreadId () returned 0xa94 [0084.245] GetCurrentThreadId () returned 0xa94 [0084.246] GetCurrentThreadId () returned 0xa94 [0084.246] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0084.247] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0084.247] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0084.247] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0084.247] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0084.266] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2ed, dwPendingType=0x1) returned 0x2 [0084.266] GetCurrentThreadId () returned 0xa94 [0084.266] GetCurrentThreadId () returned 0xa94 [0084.266] GetCurrentThreadId () returned 0xa94 [0084.266] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0084.266] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0084.266] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0084.266] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0084.828] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x50f, dwPendingType=0x1) returned 0x2 [0084.828] GetCurrentThreadId () returned 0xa94 [0084.828] GetCurrentThreadId () returned 0xa94 [0084.828] GetCurrentThreadId () returned 0xa94 [0084.828] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0084.829] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0084.829] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0084.829] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0084.829] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0084.896] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x54e, dwPendingType=0x1) returned 0x2 [0084.900] GetCurrentThreadId () returned 0xa94 [0084.900] GetCurrentThreadId () returned 0xa94 [0084.901] GetCurrentThreadId () returned 0xa94 [0084.901] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0084.901] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0084.901] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0084.901] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0084.943] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x57c, dwPendingType=0x1) returned 0x2 [0084.943] GetCurrentThreadId () returned 0xa94 [0084.943] GetCurrentThreadId () returned 0xa94 [0084.943] GetCurrentThreadId () returned 0xa94 [0084.943] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0084.944] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0084.944] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0084.944] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0085.006] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x5bb, dwPendingType=0x1) returned 0x2 [0085.006] GetCurrentThreadId () returned 0xa94 [0085.006] GetCurrentThreadId () returned 0xa94 [0085.006] GetCurrentThreadId () returned 0xa94 [0085.006] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0085.006] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0085.006] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0085.095] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0085.181] GetLastError () returned 0x0 [0085.182] SRRemoveRestorePoint (dwRPNum=0x6) returned 0x0 [0085.184] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0085.184] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0085.184] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0085.184] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0085.184] GetCurrentThreadId () returned 0xa94 [0085.184] GetCurrentThreadId () returned 0xa94 [0085.185] GetCurrentThreadId () returned 0xa94 [0085.185] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0085.185] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0085.185] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0085.185] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0085.189] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0085.189] GetCurrentThreadId () returned 0xa94 [0085.189] GetCurrentThreadId () returned 0xa94 [0085.189] GetCurrentThreadId () returned 0xa94 [0085.190] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0085.190] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0085.190] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0085.217] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1f, dwPendingType=0x1) returned 0x2 [0085.217] GetCurrentThreadId () returned 0xa94 [0085.217] GetCurrentThreadId () returned 0xa94 [0085.217] GetCurrentThreadId () returned 0xa94 [0085.218] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0085.218] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0085.218] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0085.218] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0085.218] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0085.254] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0085.254] GetCurrentThreadId () returned 0xa94 [0085.254] GetCurrentThreadId () returned 0xa94 [0085.254] GetCurrentThreadId () returned 0xa94 [0085.254] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0085.254] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0085.254] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0085.333] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x4e, dwPendingType=0x1) returned 0x2 [0085.333] GetCurrentThreadId () returned 0xa94 [0085.333] GetCurrentThreadId () returned 0xa94 [0085.333] GetCurrentThreadId () returned 0xa94 [0085.334] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0085.334] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0085.334] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0085.334] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0085.753] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1f4, dwPendingType=0x1) returned 0x2 [0085.753] GetCurrentThreadId () returned 0xa94 [0085.754] GetCurrentThreadId () returned 0xa94 [0085.754] GetCurrentThreadId () returned 0xa94 [0085.755] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0085.755] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0085.755] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0085.755] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0085.755] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0085.779] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x213, dwPendingType=0x1) returned 0x2 [0085.779] GetCurrentThreadId () returned 0xa94 [0085.779] GetCurrentThreadId () returned 0xa94 [0085.779] GetCurrentThreadId () returned 0xa94 [0085.779] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0085.779] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0085.779] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0085.779] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0086.281] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x406, dwPendingType=0x1) returned 0x2 [0086.281] GetCurrentThreadId () returned 0xa94 [0086.281] GetCurrentThreadId () returned 0xa94 [0086.413] GetCurrentThreadId () returned 0xa94 [0086.480] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0086.480] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0086.480] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0086.480] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0086.480] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0086.480] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0086.481] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x4d1, dwPendingType=0x1) returned 0x2 [0086.481] GetCurrentThreadId () returned 0xa94 [0086.481] GetCurrentThreadId () returned 0xa94 [0086.481] GetCurrentThreadId () returned 0xa94 [0086.481] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0086.481] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0086.481] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0086.481] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0086.507] GetLastError () returned 0x0 [0086.507] SRRemoveRestorePoint (dwRPNum=0x7) returned 0x0 [0086.510] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0086.510] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0086.510] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0086.510] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0086.510] GetCurrentThreadId () returned 0xa94 [0086.510] GetCurrentThreadId () returned 0xa94 [0086.510] GetCurrentThreadId () returned 0xa94 [0086.510] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0086.510] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0086.510] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0086.543] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0086.543] GetCurrentThreadId () returned 0xa94 [0086.543] GetCurrentThreadId () returned 0xa94 [0086.545] GetCurrentThreadId () returned 0xa94 [0086.545] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0086.546] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0086.546] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0086.546] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0086.668] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x7c, dwPendingType=0x1) returned 0x2 [0086.668] GetCurrentThreadId () returned 0xa94 [0086.668] GetCurrentThreadId () returned 0xa94 [0086.668] GetCurrentThreadId () returned 0xa94 [0086.668] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0086.668] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0086.668] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0086.668] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0086.672] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0086.672] GetCurrentThreadId () returned 0xa94 [0086.672] GetCurrentThreadId () returned 0xa94 [0086.672] GetCurrentThreadId () returned 0xa94 [0086.672] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0086.672] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0086.672] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0087.148] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1d4, dwPendingType=0x1) returned 0x2 [0087.148] GetCurrentThreadId () returned 0xa94 [0087.152] GetCurrentThreadId () returned 0xa94 [0087.155] GetCurrentThreadId () returned 0xa94 [0087.159] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0087.162] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0087.162] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0087.162] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0087.162] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0087.441] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2fd, dwPendingType=0x1) returned 0x2 [0087.441] GetCurrentThreadId () returned 0xa94 [0087.518] GetCurrentThreadId () returned 0xa94 [0087.702] GetCurrentThreadId () returned 0xa94 [0087.702] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0087.702] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0087.702] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0087.703] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0087.703] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0087.703] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0087.756] GetLastError () returned 0x0 [0087.756] SRRemoveRestorePoint (dwRPNum=0x8) returned 0x0 [0087.758] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0087.758] GetCurrentThreadId () returned 0xa94 [0087.758] GetCurrentThreadId () returned 0xa94 [0087.758] GetCurrentThreadId () returned 0xa94 [0087.758] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0087.759] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0087.759] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0087.761] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0087.761] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0087.761] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0087.761] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xf, dwPendingType=0x1) returned 0x2 [0087.761] GetCurrentThreadId () returned 0xa94 [0087.761] GetCurrentThreadId () returned 0xa94 [0087.762] GetCurrentThreadId () returned 0xa94 [0087.762] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0087.762] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0087.762] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0087.762] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0087.762] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0087.770] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0087.770] GetCurrentThreadId () returned 0xa94 [0087.770] GetCurrentThreadId () returned 0xa94 [0087.770] GetCurrentThreadId () returned 0xa94 [0087.770] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0087.771] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0087.771] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0087.842] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0087.842] GetCurrentThreadId () returned 0xa94 [0087.842] GetCurrentThreadId () returned 0xa94 [0087.843] GetCurrentThreadId () returned 0xa94 [0087.843] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0087.843] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0087.843] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0087.869] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x20, dwPendingType=0x1) returned 0x2 [0087.869] GetCurrentThreadId () returned 0xa94 [0087.870] GetCurrentThreadId () returned 0xa94 [0087.870] GetCurrentThreadId () returned 0xa94 [0087.870] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0087.870] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0087.871] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0087.871] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0088.254] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x196, dwPendingType=0x1) returned 0x2 [0088.254] GetCurrentThreadId () returned 0xa94 [0088.254] GetCurrentThreadId () returned 0xa94 [0088.254] GetCurrentThreadId () returned 0xa94 [0088.254] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0088.254] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0088.254] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0088.254] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0088.254] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0088.324] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1e4, dwPendingType=0x1) returned 0x2 [0088.325] GetCurrentThreadId () returned 0xa94 [0088.325] GetCurrentThreadId () returned 0xa94 [0088.325] GetCurrentThreadId () returned 0xa94 [0088.325] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0088.325] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0088.325] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0088.325] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0088.385] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x222, dwPendingType=0x1) returned 0x2 [0088.385] GetCurrentThreadId () returned 0xa94 [0088.385] GetCurrentThreadId () returned 0xa94 [0088.385] GetCurrentThreadId () returned 0xa94 [0088.385] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0088.386] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0088.386] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0088.386] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0088.431] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x251, dwPendingType=0x1) returned 0x2 [0088.431] GetCurrentThreadId () returned 0xa94 [0088.431] GetCurrentThreadId () returned 0xa94 [0088.431] GetCurrentThreadId () returned 0xa94 [0088.431] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0088.431] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0088.432] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0088.432] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0088.535] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0088.535] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0088.535] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0088.535] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2af, dwPendingType=0x1) returned 0x2 [0088.535] GetCurrentThreadId () returned 0xa94 [0088.536] GetCurrentThreadId () returned 0xa94 [0088.536] GetCurrentThreadId () returned 0xa94 [0088.536] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0088.536] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0088.536] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0088.540] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2be, dwPendingType=0x1) returned 0x2 [0088.540] GetCurrentThreadId () returned 0xa94 [0088.540] GetCurrentThreadId () returned 0xa94 [0088.540] GetCurrentThreadId () returned 0xa94 [0088.540] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0088.540] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0088.540] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0088.540] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.099] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x4d1, dwPendingType=0x1) returned 0x2 [0089.099] GetCurrentThreadId () returned 0xa94 [0089.099] GetCurrentThreadId () returned 0xa94 [0089.099] GetCurrentThreadId () returned 0xa94 [0089.099] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.100] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.100] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0089.100] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0089.100] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.101] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x4e0, dwPendingType=0x1) returned 0x2 [0089.102] GetCurrentThreadId () returned 0xa94 [0089.102] GetCurrentThreadId () returned 0xa94 [0089.102] GetCurrentThreadId () returned 0xa94 [0089.102] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.102] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.102] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0089.102] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.115] GetLastError () returned 0x0 [0089.115] SRRemoveRestorePoint (dwRPNum=0x9) returned 0x0 [0089.116] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0089.116] GetCurrentThreadId () returned 0xa94 [0089.116] GetCurrentThreadId () returned 0xa94 [0089.116] GetCurrentThreadId () returned 0xa94 [0089.116] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0089.117] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0089.117] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0089.120] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0089.120] GetCurrentThreadId () returned 0xa94 [0089.120] GetCurrentThreadId () returned 0xa94 [0089.120] GetCurrentThreadId () returned 0xa94 [0089.120] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0089.120] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0089.120] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0089.167] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0089.168] GetCurrentThreadId () returned 0xa94 [0089.168] GetCurrentThreadId () returned 0xa94 [0089.168] GetCurrentThreadId () returned 0xa94 [0089.168] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.168] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.168] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.211] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2f, dwPendingType=0x1) returned 0x2 [0089.211] GetCurrentThreadId () returned 0xa94 [0089.211] GetCurrentThreadId () returned 0xa94 [0089.211] GetCurrentThreadId () returned 0xa94 [0089.211] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.211] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.211] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0089.211] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.320] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x9c, dwPendingType=0x1) returned 0x2 [0089.320] GetCurrentThreadId () returned 0xa94 [0089.320] GetCurrentThreadId () returned 0xa94 [0089.320] GetCurrentThreadId () returned 0xa94 [0089.320] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.320] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.320] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0089.320] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.336] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xab, dwPendingType=0x1) returned 0x2 [0089.336] GetCurrentThreadId () returned 0xa94 [0089.336] GetCurrentThreadId () returned 0xa94 [0089.336] GetCurrentThreadId () returned 0xa94 [0089.336] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.337] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.337] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0089.337] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.438] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x109, dwPendingType=0x1) returned 0x2 [0089.438] GetCurrentThreadId () returned 0xa94 [0089.439] GetCurrentThreadId () returned 0xa94 [0089.439] GetCurrentThreadId () returned 0xa94 [0089.439] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.439] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.439] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0089.440] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.539] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x176, dwPendingType=0x1) returned 0x2 [0089.539] GetCurrentThreadId () returned 0xa94 [0089.539] GetCurrentThreadId () returned 0xa94 [0089.539] GetCurrentThreadId () returned 0xa94 [0089.539] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.539] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.539] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0089.539] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.977] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x32b, dwPendingType=0x1) returned 0x2 [0089.977] GetCurrentThreadId () returned 0xa94 [0089.977] GetCurrentThreadId () returned 0xa94 [0089.977] GetCurrentThreadId () returned 0xa94 [0089.980] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.982] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0089.982] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0089.982] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0089.982] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0090.348] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x492, dwPendingType=0x1) returned 0x2 [0090.348] GetCurrentThreadId () returned 0xa94 [0090.512] GetCurrentThreadId () returned 0xa94 [0090.512] GetCurrentThreadId () returned 0xa94 [0090.512] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0090.512] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0090.512] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0090.513] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0090.513] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0090.513] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0090.521] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x54d, dwPendingType=0x1) returned 0x2 [0090.521] GetCurrentThreadId () returned 0xa94 [0090.522] GetCurrentThreadId () returned 0xa94 [0090.522] GetCurrentThreadId () returned 0xa94 [0090.522] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0090.522] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0090.522] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0090.522] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0090.536] GetLastError () returned 0x0 [0090.536] SRRemoveRestorePoint (dwRPNum=0xa) returned 0x0 [0090.542] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0090.542] GetCurrentThreadId () returned 0xa94 [0090.542] GetCurrentThreadId () returned 0xa94 [0090.542] GetCurrentThreadId () returned 0xa94 [0090.542] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0090.542] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0090.542] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0090.545] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0090.545] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0090.545] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0090.545] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0090.545] GetCurrentThreadId () returned 0xa94 [0090.546] GetCurrentThreadId () returned 0xa94 [0090.546] GetCurrentThreadId () returned 0xa94 [0090.546] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0090.546] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0090.546] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0090.579] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0090.579] GetCurrentThreadId () returned 0xa94 [0090.579] GetCurrentThreadId () returned 0xa94 [0090.580] GetCurrentThreadId () returned 0xa94 [0090.580] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0090.580] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0090.580] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0090.584] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xf, dwPendingType=0x1) returned 0x2 [0090.584] GetCurrentThreadId () returned 0xa94 [0090.584] GetCurrentThreadId () returned 0xa94 [0090.584] GetCurrentThreadId () returned 0xa94 [0090.584] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0090.584] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0090.585] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0090.585] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0090.621] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2f, dwPendingType=0x1) returned 0x2 [0090.646] GetCurrentThreadId () returned 0xa94 [0090.646] GetCurrentThreadId () returned 0xa94 [0090.646] GetCurrentThreadId () returned 0xa94 [0090.646] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0090.646] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0090.646] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0090.646] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0090.647] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0090.740] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xab, dwPendingType=0x1) returned 0x2 [0090.740] GetCurrentThreadId () returned 0xa94 [0090.740] GetCurrentThreadId () returned 0xa94 [0090.740] GetCurrentThreadId () returned 0xa94 [0090.740] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0090.740] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0090.741] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0090.741] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0090.791] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0090.791] GetCurrentThreadId () returned 0xa94 [0090.791] GetCurrentThreadId () returned 0xa94 [0090.792] GetCurrentThreadId () returned 0xa94 [0090.792] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0090.792] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0090.792] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0090.896] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x6d, dwPendingType=0x1) returned 0x2 [0090.896] GetCurrentThreadId () returned 0xa94 [0090.896] GetCurrentThreadId () returned 0xa94 [0090.896] GetCurrentThreadId () returned 0xa94 [0090.896] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0090.896] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0090.896] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0090.896] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0090.896] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0090.958] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xac, dwPendingType=0x1) returned 0x2 [0090.958] GetCurrentThreadId () returned 0xa94 [0090.959] GetCurrentThreadId () returned 0xa94 [0090.959] GetCurrentThreadId () returned 0xa94 [0090.959] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0090.960] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0090.960] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0090.960] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0091.438] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x280, dwPendingType=0x1) returned 0x2 [0091.439] GetCurrentThreadId () returned 0xa94 [0091.439] GetCurrentThreadId () returned 0xa94 [0091.439] GetCurrentThreadId () returned 0xa94 [0091.439] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0091.440] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0091.440] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0091.440] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0091.440] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0091.903] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x454, dwPendingType=0x1) returned 0x2 [0091.903] GetCurrentThreadId () returned 0xa94 [0091.903] GetCurrentThreadId () returned 0xa94 [0091.903] GetCurrentThreadId () returned 0xa94 [0091.903] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0091.904] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0091.904] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0091.904] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0091.904] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0091.960] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x492, dwPendingType=0x1) returned 0x2 [0091.960] GetCurrentThreadId () returned 0xa94 [0091.960] GetCurrentThreadId () returned 0xa94 [0091.960] GetCurrentThreadId () returned 0xa94 [0091.960] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0091.960] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0091.960] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0091.960] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.067] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x4ff, dwPendingType=0x1) returned 0x2 [0092.067] GetCurrentThreadId () returned 0xa94 [0092.067] GetCurrentThreadId () returned 0xa94 [0092.068] GetCurrentThreadId () returned 0xa94 [0092.068] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.068] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.068] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0092.068] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.078] GetLastError () returned 0x0 [0092.078] SRRemoveRestorePoint (dwRPNum=0xb) returned 0x0 [0092.081] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0092.081] GetCurrentThreadId () returned 0xa94 [0092.081] GetCurrentThreadId () returned 0xa94 [0092.081] GetCurrentThreadId () returned 0xa94 [0092.081] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0092.082] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0092.082] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0092.088] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0092.088] GetCurrentThreadId () returned 0xa94 [0092.088] GetCurrentThreadId () returned 0xa94 [0092.088] GetCurrentThreadId () returned 0xa94 [0092.089] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0092.089] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0092.089] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0092.099] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0092.099] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0092.099] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0092.099] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0092.099] GetCurrentThreadId () returned 0xa94 [0092.099] GetCurrentThreadId () returned 0xa94 [0092.099] GetCurrentThreadId () returned 0xa94 [0092.099] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0092.100] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0092.100] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0092.144] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x3e, dwPendingType=0x1) returned 0x2 [0092.144] GetCurrentThreadId () returned 0xa94 [0092.144] GetCurrentThreadId () returned 0xa94 [0092.144] GetCurrentThreadId () returned 0xa94 [0092.144] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0092.144] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0092.144] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0092.144] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0092.154] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0092.154] GetCurrentThreadId () returned 0xa94 [0092.154] GetCurrentThreadId () returned 0xa94 [0092.154] GetCurrentThreadId () returned 0xa94 [0092.154] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.154] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.154] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.175] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x20, dwPendingType=0x1) returned 0x2 [0092.175] GetCurrentThreadId () returned 0xa94 [0092.175] GetCurrentThreadId () returned 0xa94 [0092.175] GetCurrentThreadId () returned 0xa94 [0092.175] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.175] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.175] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0092.175] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.683] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x213, dwPendingType=0x1) returned 0x2 [0092.683] GetCurrentThreadId () returned 0xa94 [0092.683] GetCurrentThreadId () returned 0xa94 [0092.683] GetCurrentThreadId () returned 0xa94 [0092.683] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.683] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.683] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0092.683] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0092.684] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.721] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x242, dwPendingType=0x1) returned 0x2 [0092.721] GetCurrentThreadId () returned 0xa94 [0092.721] GetCurrentThreadId () returned 0xa94 [0092.721] GetCurrentThreadId () returned 0xa94 [0092.721] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.721] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.722] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0092.722] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.956] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x32c, dwPendingType=0x1) returned 0x2 [0092.956] GetCurrentThreadId () returned 0xa94 [0092.957] GetCurrentThreadId () returned 0xa94 [0092.957] GetCurrentThreadId () returned 0xa94 [0092.957] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.957] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.957] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0092.957] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0092.957] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.969] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0092.969] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0092.969] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0092.969] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x32c, dwPendingType=0x1) returned 0x2 [0092.969] GetCurrentThreadId () returned 0xa94 [0092.969] GetCurrentThreadId () returned 0xa94 [0092.969] GetCurrentThreadId () returned 0xa94 [0092.970] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.970] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0092.970] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0093.049] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x389, dwPendingType=0x1) returned 0x2 [0093.049] GetCurrentThreadId () returned 0xa94 [0093.049] GetCurrentThreadId () returned 0xa94 [0093.050] GetCurrentThreadId () returned 0xa94 [0093.050] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0093.051] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0093.052] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0093.052] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0093.200] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x416, dwPendingType=0x1) returned 0x2 [0093.200] GetCurrentThreadId () returned 0xa94 [0093.200] GetCurrentThreadId () returned 0xa94 [0093.200] GetCurrentThreadId () returned 0xa94 [0093.200] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0093.200] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0093.200] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0093.200] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0093.200] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0093.231] GetLastError () returned 0x0 [0093.231] SRRemoveRestorePoint (dwRPNum=0xc) returned 0x0 [0093.233] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0093.233] GetCurrentThreadId () returned 0xa94 [0093.233] GetCurrentThreadId () returned 0xa94 [0093.234] GetCurrentThreadId () returned 0xa94 [0093.234] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0093.234] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0093.234] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0093.239] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0093.239] GetCurrentThreadId () returned 0xa94 [0093.239] GetCurrentThreadId () returned 0xa94 [0093.239] GetCurrentThreadId () returned 0xa94 [0093.239] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0093.239] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0093.239] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0093.267] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x20, dwPendingType=0x1) returned 0x2 [0093.267] GetCurrentThreadId () returned 0xa94 [0093.267] GetCurrentThreadId () returned 0xa94 [0093.267] GetCurrentThreadId () returned 0xa94 [0093.267] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0093.268] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0093.268] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0093.268] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0093.302] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0093.302] GetCurrentThreadId () returned 0xa94 [0093.302] GetCurrentThreadId () returned 0xa94 [0093.302] GetCurrentThreadId () returned 0xa94 [0093.303] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0093.303] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0093.303] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0093.763] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1c4, dwPendingType=0x1) returned 0x2 [0093.764] GetCurrentThreadId () returned 0xa94 [0093.764] GetCurrentThreadId () returned 0xa94 [0093.768] GetCurrentThreadId () returned 0xa94 [0093.768] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0093.769] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0093.769] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0093.770] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0093.770] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0093.813] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x203, dwPendingType=0x1) returned 0x2 [0093.813] GetCurrentThreadId () returned 0xa94 [0093.813] GetCurrentThreadId () returned 0xa94 [0093.813] GetCurrentThreadId () returned 0xa94 [0093.814] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0093.814] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0093.814] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0093.814] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.265] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x3b7, dwPendingType=0x1) returned 0x2 [0094.265] GetCurrentThreadId () returned 0xa94 [0094.265] GetCurrentThreadId () returned 0xa94 [0094.265] GetCurrentThreadId () returned 0xa94 [0094.265] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.265] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.265] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0094.265] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0094.265] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.277] GetLastError () returned 0x0 [0094.277] SRRemoveRestorePoint (dwRPNum=0xd) returned 0x0 [0094.279] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0094.279] GetCurrentThreadId () returned 0xa94 [0094.279] GetCurrentThreadId () returned 0xa94 [0094.279] GetCurrentThreadId () returned 0xa94 [0094.279] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0094.279] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0094.279] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0094.282] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0094.282] GetCurrentThreadId () returned 0xa94 [0094.283] GetCurrentThreadId () returned 0xa94 [0094.283] GetCurrentThreadId () returned 0xa94 [0094.283] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0094.283] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0094.283] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0094.304] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0094.304] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0094.304] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0094.305] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xf, dwPendingType=0x1) returned 0x2 [0094.305] GetCurrentThreadId () returned 0xa94 [0094.305] GetCurrentThreadId () returned 0xa94 [0094.305] GetCurrentThreadId () returned 0xa94 [0094.305] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0094.305] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0094.305] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0094.328] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2e, dwPendingType=0x1) returned 0x2 [0094.328] GetCurrentThreadId () returned 0xa94 [0094.328] GetCurrentThreadId () returned 0xa94 [0094.328] GetCurrentThreadId () returned 0xa94 [0094.328] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0094.328] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0094.328] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0094.328] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0094.359] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x4e, dwPendingType=0x1) returned 0x2 [0094.359] GetCurrentThreadId () returned 0xa94 [0094.359] GetCurrentThreadId () returned 0xa94 [0094.360] GetCurrentThreadId () returned 0xa94 [0094.360] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0094.360] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0094.360] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0094.360] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0094.363] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0094.363] GetCurrentThreadId () returned 0xa94 [0094.364] GetCurrentThreadId () returned 0xa94 [0094.364] GetCurrentThreadId () returned 0xa94 [0094.364] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.364] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.364] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.468] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x6d, dwPendingType=0x1) returned 0x2 [0094.468] GetCurrentThreadId () returned 0xa94 [0094.468] GetCurrentThreadId () returned 0xa94 [0094.468] GetCurrentThreadId () returned 0xa94 [0094.468] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.469] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.469] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0094.469] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.577] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xda, dwPendingType=0x1) returned 0x2 [0094.577] GetCurrentThreadId () returned 0xa94 [0094.577] GetCurrentThreadId () returned 0xa94 [0094.577] GetCurrentThreadId () returned 0xa94 [0094.578] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.578] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.578] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0094.578] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.640] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x118, dwPendingType=0x1) returned 0x2 [0094.640] GetCurrentThreadId () returned 0xa94 [0094.640] GetCurrentThreadId () returned 0xa94 [0094.640] GetCurrentThreadId () returned 0xa94 [0094.640] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.640] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.640] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0094.640] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.686] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x147, dwPendingType=0x1) returned 0x2 [0094.687] GetCurrentThreadId () returned 0xa94 [0094.687] GetCurrentThreadId () returned 0xa94 [0094.687] GetCurrentThreadId () returned 0xa94 [0094.687] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.687] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.687] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0094.687] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.796] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1b4, dwPendingType=0x1) returned 0x2 [0094.796] GetCurrentThreadId () returned 0xa94 [0094.796] GetCurrentThreadId () returned 0xa94 [0094.796] GetCurrentThreadId () returned 0xa94 [0094.796] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.797] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.797] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0094.797] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.907] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x222, dwPendingType=0x1) returned 0x2 [0094.908] GetCurrentThreadId () returned 0xa94 [0094.908] GetCurrentThreadId () returned 0xa94 [0094.908] GetCurrentThreadId () returned 0xa94 [0094.908] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.908] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.908] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0094.908] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.952] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x250, dwPendingType=0x1) returned 0x2 [0094.952] GetCurrentThreadId () returned 0xa94 [0094.952] GetCurrentThreadId () returned 0xa94 [0094.952] GetCurrentThreadId () returned 0xa94 [0094.952] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.952] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0094.952] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0094.952] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.014] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x28f, dwPendingType=0x1) returned 0x2 [0095.014] GetCurrentThreadId () returned 0xa94 [0095.014] GetCurrentThreadId () returned 0xa94 [0095.014] GetCurrentThreadId () returned 0xa94 [0095.014] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.015] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.015] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0095.015] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.123] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2fc, dwPendingType=0x1) returned 0x2 [0095.123] GetCurrentThreadId () returned 0xa94 [0095.123] GetCurrentThreadId () returned 0xa94 [0095.123] GetCurrentThreadId () returned 0xa94 [0095.123] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.123] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.124] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0095.124] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.232] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x369, dwPendingType=0x1) returned 0x2 [0095.232] GetCurrentThreadId () returned 0xa94 [0095.233] GetCurrentThreadId () returned 0xa94 [0095.233] GetCurrentThreadId () returned 0xa94 [0095.233] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.233] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.233] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0095.233] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.269] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x388, dwPendingType=0x1) returned 0x2 [0095.269] GetCurrentThreadId () returned 0xa94 [0095.269] GetCurrentThreadId () returned 0xa94 [0095.269] GetCurrentThreadId () returned 0xa94 [0095.269] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.269] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.269] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0095.269] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.342] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x3d6, dwPendingType=0x1) returned 0x2 [0095.342] GetCurrentThreadId () returned 0xa94 [0095.342] GetCurrentThreadId () returned 0xa94 [0095.342] GetCurrentThreadId () returned 0xa94 [0095.342] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.342] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.342] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0095.342] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.537] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x492, dwPendingType=0x1) returned 0x2 [0095.537] GetCurrentThreadId () returned 0xa94 [0095.537] GetCurrentThreadId () returned 0xa94 [0095.537] GetCurrentThreadId () returned 0xa94 [0095.537] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.538] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.538] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0095.538] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.560] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x4b1, dwPendingType=0x1) returned 0x2 [0095.560] GetCurrentThreadId () returned 0xa94 [0095.560] GetCurrentThreadId () returned 0xa94 [0095.560] GetCurrentThreadId () returned 0xa94 [0095.560] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.560] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.560] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0095.561] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.576] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x4c0, dwPendingType=0x1) returned 0x2 [0095.576] GetCurrentThreadId () returned 0xa94 [0095.576] GetCurrentThreadId () returned 0xa94 [0095.576] GetCurrentThreadId () returned 0xa94 [0095.576] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.576] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.576] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0095.576] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.851] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x58b, dwPendingType=0x1) returned 0x2 [0095.852] GetCurrentThreadId () returned 0xa94 [0095.852] GetCurrentThreadId () returned 0xa94 [0095.852] GetCurrentThreadId () returned 0xa94 [0095.852] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.852] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0095.852] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0095.852] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0096.148] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x6b4, dwPendingType=0x1) returned 0x2 [0096.148] GetCurrentThreadId () returned 0xa94 [0096.148] GetCurrentThreadId () returned 0xa94 [0096.148] GetCurrentThreadId () returned 0xa94 [0096.148] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0096.148] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0096.148] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0096.148] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0096.148] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0096.153] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0096.153] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0096.153] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0096.153] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x6c3, dwPendingType=0x1) returned 0x2 [0096.153] GetCurrentThreadId () returned 0xa94 [0096.153] GetCurrentThreadId () returned 0xa94 [0096.153] GetCurrentThreadId () returned 0xa94 [0096.153] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0096.153] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0096.153] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0096.177] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x6d3, dwPendingType=0x1) returned 0x2 [0096.177] GetCurrentThreadId () returned 0xa94 [0096.177] GetCurrentThreadId () returned 0xa94 [0096.355] GetCurrentThreadId () returned 0xa94 [0096.355] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0096.355] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0096.355] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0096.355] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0096.355] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0096.355] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0096.386] GetLastError () returned 0x0 [0096.386] SRRemoveRestorePoint (dwRPNum=0xe) returned 0x0 [0096.388] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0096.388] GetCurrentThreadId () returned 0xa94 [0096.388] GetCurrentThreadId () returned 0xa94 [0096.388] GetCurrentThreadId () returned 0xa94 [0096.388] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0096.389] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0096.389] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0096.389] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0096.400] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0096.400] GetCurrentThreadId () returned 0xa94 [0096.400] GetCurrentThreadId () returned 0xa94 [0096.400] GetCurrentThreadId () returned 0xa94 [0096.400] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0096.400] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0096.400] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0096.447] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0096.448] GetCurrentThreadId () returned 0xa94 [0096.448] GetCurrentThreadId () returned 0xa94 [0096.448] GetCurrentThreadId () returned 0xa94 [0096.448] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0096.448] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0096.448] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0096.502] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x3e, dwPendingType=0x1) returned 0x2 [0096.502] GetCurrentThreadId () returned 0xa94 [0096.509] GetCurrentThreadId () returned 0xa94 [0096.885] GetCurrentThreadId () returned 0xa94 [0096.885] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0096.887] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0096.890] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0096.890] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0096.892] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0096.892] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0096.917] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1c4, dwPendingType=0x1) returned 0x2 [0096.917] GetCurrentThreadId () returned 0xa94 [0096.918] GetCurrentThreadId () returned 0xa94 [0096.918] GetCurrentThreadId () returned 0xa94 [0096.918] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0096.918] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0096.918] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0096.918] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.140] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x29f, dwPendingType=0x1) returned 0x2 [0097.140] GetCurrentThreadId () returned 0xa94 [0097.142] GetCurrentThreadId () returned 0xa94 [0097.142] GetCurrentThreadId () returned 0xa94 [0097.142] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.142] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.142] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0097.142] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.146] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0097.146] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0097.147] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0097.147] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x29f, dwPendingType=0x1) returned 0x2 [0097.147] GetCurrentThreadId () returned 0xa94 [0097.147] GetCurrentThreadId () returned 0xa94 [0097.147] GetCurrentThreadId () returned 0xa94 [0097.147] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.147] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.147] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.236] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2fc, dwPendingType=0x1) returned 0x2 [0097.236] GetCurrentThreadId () returned 0xa94 [0097.236] GetCurrentThreadId () returned 0xa94 [0097.236] GetCurrentThreadId () returned 0xa94 [0097.237] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.237] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.237] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0097.237] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0097.237] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.326] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x35a, dwPendingType=0x1) returned 0x2 [0097.361] GetCurrentThreadId () returned 0xa94 [0097.361] GetCurrentThreadId () returned 0xa94 [0097.361] GetCurrentThreadId () returned 0xa94 [0097.361] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.361] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.361] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0097.361] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.389] GetLastError () returned 0x0 [0097.389] SRRemoveRestorePoint (dwRPNum=0xf) returned 0x0 [0097.390] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0097.390] GetCurrentThreadId () returned 0xa94 [0097.390] GetCurrentThreadId () returned 0xa94 [0097.390] GetCurrentThreadId () returned 0xa94 [0097.390] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0097.390] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0097.390] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0097.393] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0097.393] GetCurrentThreadId () returned 0xa94 [0097.394] GetCurrentThreadId () returned 0xa94 [0097.394] GetCurrentThreadId () returned 0xa94 [0097.394] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0097.394] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0097.394] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0097.401] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0097.401] GetCurrentThreadId () returned 0xa94 [0097.401] GetCurrentThreadId () returned 0xa94 [0097.401] GetCurrentThreadId () returned 0xa94 [0097.401] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0097.401] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0097.401] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0097.401] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0097.450] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0097.450] GetCurrentThreadId () returned 0xa94 [0097.450] GetCurrentThreadId () returned 0xa94 [0097.450] GetCurrentThreadId () returned 0xa94 [0097.450] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.450] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.450] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.513] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x3e, dwPendingType=0x1) returned 0x2 [0097.513] GetCurrentThreadId () returned 0xa94 [0097.513] GetCurrentThreadId () returned 0xa94 [0097.513] GetCurrentThreadId () returned 0xa94 [0097.514] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.514] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.521] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0097.521] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.931] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1d4, dwPendingType=0x1) returned 0x2 [0097.932] GetCurrentThreadId () returned 0xa94 [0097.933] GetCurrentThreadId () returned 0xa94 [0097.933] GetCurrentThreadId () returned 0xa94 [0097.933] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.933] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0097.933] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0097.933] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0097.936] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0098.122] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x29f, dwPendingType=0x1) returned 0x2 [0098.123] GetCurrentThreadId () returned 0xa94 [0098.144] GetCurrentThreadId () returned 0xa94 [0098.177] GetCurrentThreadId () returned 0xa94 [0098.177] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0098.178] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0098.178] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0098.178] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0098.178] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0098.370] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x398, dwPendingType=0x1) returned 0x2 [0098.370] GetCurrentThreadId () returned 0xa94 [0098.370] GetCurrentThreadId () returned 0xa94 [0098.370] GetCurrentThreadId () returned 0xa94 [0098.371] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0098.371] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0098.371] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0098.371] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0098.378] GetLastError () returned 0x0 [0098.378] SRRemoveRestorePoint (dwRPNum=0x10) returned 0x0 [0098.380] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0098.380] GetCurrentThreadId () returned 0xa94 [0098.380] GetCurrentThreadId () returned 0xa94 [0098.380] GetCurrentThreadId () returned 0xa94 [0098.380] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0098.380] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0098.380] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0098.409] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0098.409] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0098.410] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0098.410] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1f, dwPendingType=0x1) returned 0x2 [0098.410] GetCurrentThreadId () returned 0xa94 [0098.410] GetCurrentThreadId () returned 0xa94 [0098.410] GetCurrentThreadId () returned 0xa94 [0098.410] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0098.410] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0098.410] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0098.416] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0098.416] GetCurrentThreadId () returned 0xa94 [0098.416] GetCurrentThreadId () returned 0xa94 [0098.416] GetCurrentThreadId () returned 0xa94 [0098.416] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0098.416] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0098.416] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0098.431] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0098.431] GetCurrentThreadId () returned 0xa94 [0098.431] GetCurrentThreadId () returned 0xa94 [0098.432] GetCurrentThreadId () returned 0xa94 [0098.432] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0098.432] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0098.432] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0098.433] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0098.479] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0098.479] GetCurrentThreadId () returned 0xa94 [0098.479] GetCurrentThreadId () returned 0xa94 [0098.479] GetCurrentThreadId () returned 0xa94 [0098.480] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0098.480] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0098.480] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0098.480] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0098.548] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x3f, dwPendingType=0x1) returned 0x2 [0098.550] GetCurrentThreadId () returned 0xa94 [0098.550] GetCurrentThreadId () returned 0xa94 [0098.551] GetCurrentThreadId () returned 0xa94 [0098.551] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0098.936] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0098.936] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0098.936] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0098.937] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0098.937] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0099.039] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x222, dwPendingType=0x1) returned 0x2 [0099.039] GetCurrentThreadId () returned 0xa94 [0099.039] GetCurrentThreadId () returned 0xa94 [0099.040] GetCurrentThreadId () returned 0xa94 [0099.040] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0099.040] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0099.040] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0099.040] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0099.254] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2ed, dwPendingType=0x1) returned 0x2 [0099.254] GetCurrentThreadId () returned 0xa94 [0099.255] GetCurrentThreadId () returned 0xa94 [0099.255] GetCurrentThreadId () returned 0xa94 [0099.255] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0099.255] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0099.256] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0099.256] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0099.256] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0099.416] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x399, dwPendingType=0x1) returned 0x2 [0099.416] GetCurrentThreadId () returned 0xa94 [0099.416] GetCurrentThreadId () returned 0xa94 [0099.416] GetCurrentThreadId () returned 0xa94 [0099.416] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0099.416] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0099.416] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0099.416] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0099.423] GetLastError () returned 0x0 [0099.423] SRRemoveRestorePoint (dwRPNum=0x11) returned 0x0 [0099.424] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0099.425] GetCurrentThreadId () returned 0xa94 [0099.425] GetCurrentThreadId () returned 0xa94 [0099.425] GetCurrentThreadId () returned 0xa94 [0099.425] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0099.425] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0099.425] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0099.429] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xf, dwPendingType=0x1) returned 0x2 [0099.429] GetCurrentThreadId () returned 0xa94 [0099.429] GetCurrentThreadId () returned 0xa94 [0099.429] GetCurrentThreadId () returned 0xa94 [0099.429] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0099.429] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0099.429] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0099.429] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0099.433] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0099.433] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0099.433] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0099.433] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xf, dwPendingType=0x1) returned 0x2 [0099.433] GetCurrentThreadId () returned 0xa94 [0099.433] GetCurrentThreadId () returned 0xa94 [0099.433] GetCurrentThreadId () returned 0xa94 [0099.433] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0099.433] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0099.433] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0099.437] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0099.437] GetCurrentThreadId () returned 0xa94 [0099.438] GetCurrentThreadId () returned 0xa94 [0099.438] GetCurrentThreadId () returned 0xa94 [0099.438] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0099.438] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0099.438] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0099.474] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0099.474] GetCurrentThreadId () returned 0xa94 [0099.474] GetCurrentThreadId () returned 0xa94 [0099.474] GetCurrentThreadId () returned 0xa94 [0099.474] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0099.474] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0099.474] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0099.476] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xf, dwPendingType=0x1) returned 0x2 [0099.476] GetCurrentThreadId () returned 0xa94 [0099.476] GetCurrentThreadId () returned 0xa94 [0099.476] GetCurrentThreadId () returned 0xa94 [0099.476] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0099.476] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0099.476] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0099.476] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.022] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x222, dwPendingType=0x1) returned 0x2 [0100.022] GetCurrentThreadId () returned 0xa94 [0100.023] GetCurrentThreadId () returned 0xa94 [0100.025] GetCurrentThreadId () returned 0xa94 [0100.029] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.030] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.030] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0100.030] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0100.033] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.053] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x241, dwPendingType=0x1) returned 0x2 [0100.053] GetCurrentThreadId () returned 0xa94 [0100.053] GetCurrentThreadId () returned 0xa94 [0100.054] GetCurrentThreadId () returned 0xa94 [0100.054] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.054] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.054] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0100.054] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.084] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x260, dwPendingType=0x1) returned 0x2 [0100.084] GetCurrentThreadId () returned 0xa94 [0100.084] GetCurrentThreadId () returned 0xa94 [0100.085] GetCurrentThreadId () returned 0xa94 [0100.085] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.085] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.085] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0100.085] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.263] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x30c, dwPendingType=0x1) returned 0x2 [0100.263] GetCurrentThreadId () returned 0xa94 [0100.263] GetCurrentThreadId () returned 0xa94 [0100.263] GetCurrentThreadId () returned 0xa94 [0100.263] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.418] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.418] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0100.418] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0100.418] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0100.418] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.431] GetLastError () returned 0x0 [0100.431] SRRemoveRestorePoint (dwRPNum=0x12) returned 0x0 [0100.433] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0100.433] GetCurrentThreadId () returned 0xa94 [0100.433] GetCurrentThreadId () returned 0xa94 [0100.433] GetCurrentThreadId () returned 0xa94 [0100.433] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0100.433] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0100.433] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0100.436] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0100.436] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0100.436] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0100.436] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0100.436] GetCurrentThreadId () returned 0xa94 [0100.436] GetCurrentThreadId () returned 0xa94 [0100.436] GetCurrentThreadId () returned 0xa94 [0100.436] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0100.436] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0100.436] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0100.442] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0100.442] GetCurrentThreadId () returned 0xa94 [0100.442] GetCurrentThreadId () returned 0xa94 [0100.442] GetCurrentThreadId () returned 0xa94 [0100.442] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0100.442] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0100.442] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0100.486] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0100.486] GetCurrentThreadId () returned 0xa94 [0100.486] GetCurrentThreadId () returned 0xa94 [0100.486] GetCurrentThreadId () returned 0xa94 [0100.486] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.486] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.486] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.490] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0100.490] GetCurrentThreadId () returned 0xa94 [0100.490] GetCurrentThreadId () returned 0xa94 [0100.490] GetCurrentThreadId () returned 0xa94 [0100.490] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.490] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.490] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0100.490] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.599] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x7d, dwPendingType=0x1) returned 0x2 [0100.599] GetCurrentThreadId () returned 0xa94 [0100.599] GetCurrentThreadId () returned 0xa94 [0100.599] GetCurrentThreadId () returned 0xa94 [0100.600] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.600] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.600] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0100.600] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.710] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xea, dwPendingType=0x1) returned 0x2 [0100.710] GetCurrentThreadId () returned 0xa94 [0100.710] GetCurrentThreadId () returned 0xa94 [0100.710] GetCurrentThreadId () returned 0xa94 [0100.710] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.710] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.710] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0100.710] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0100.710] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.740] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x109, dwPendingType=0x1) returned 0x2 [0100.740] GetCurrentThreadId () returned 0xa94 [0100.740] GetCurrentThreadId () returned 0xa94 [0100.740] GetCurrentThreadId () returned 0xa94 [0100.741] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.741] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.741] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0100.741] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.817] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x157, dwPendingType=0x1) returned 0x2 [0100.817] GetCurrentThreadId () returned 0xa94 [0100.818] GetCurrentThreadId () returned 0xa94 [0100.818] GetCurrentThreadId () returned 0xa94 [0100.818] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.818] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.818] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0100.818] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.926] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1c4, dwPendingType=0x1) returned 0x2 [0100.926] GetCurrentThreadId () returned 0xa94 [0100.927] GetCurrentThreadId () returned 0xa94 [0100.927] GetCurrentThreadId () returned 0xa94 [0100.927] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.927] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0100.927] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0100.927] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.020] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x222, dwPendingType=0x1) returned 0x2 [0101.020] GetCurrentThreadId () returned 0xa94 [0101.021] GetCurrentThreadId () returned 0xa94 [0101.021] GetCurrentThreadId () returned 0xa94 [0101.021] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.021] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.021] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0101.021] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.036] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x232, dwPendingType=0x1) returned 0x2 [0101.036] GetCurrentThreadId () returned 0xa94 [0101.036] GetCurrentThreadId () returned 0xa94 [0101.036] GetCurrentThreadId () returned 0xa94 [0101.036] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.036] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.036] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0101.036] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.145] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x29f, dwPendingType=0x1) returned 0x2 [0101.145] GetCurrentThreadId () returned 0xa94 [0101.145] GetCurrentThreadId () returned 0xa94 [0101.145] GetCurrentThreadId () returned 0xa94 [0101.145] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.145] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.145] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0101.145] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.254] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x30c, dwPendingType=0x1) returned 0x2 [0101.254] GetCurrentThreadId () returned 0xa94 [0101.254] GetCurrentThreadId () returned 0xa94 [0101.255] GetCurrentThreadId () returned 0xa94 [0101.255] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.255] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.255] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0101.255] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.458] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x3d7, dwPendingType=0x1) returned 0x2 [0101.458] GetCurrentThreadId () returned 0xa94 [0101.458] GetCurrentThreadId () returned 0xa94 [0101.458] GetCurrentThreadId () returned 0xa94 [0101.459] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.459] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.459] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0101.459] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0101.459] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.473] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x3e6, dwPendingType=0x1) returned 0x2 [0101.473] GetCurrentThreadId () returned 0xa94 [0101.473] GetCurrentThreadId () returned 0xa94 [0101.473] GetCurrentThreadId () returned 0xa94 [0101.474] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.474] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.474] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0101.474] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.583] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x454, dwPendingType=0x1) returned 0x2 [0101.583] GetCurrentThreadId () returned 0xa94 [0101.583] GetCurrentThreadId () returned 0xa94 [0101.583] GetCurrentThreadId () returned 0xa94 [0101.583] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.583] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.583] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0101.583] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.620] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0101.620] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0101.620] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0101.620] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x473, dwPendingType=0x1) returned 0x2 [0101.620] GetCurrentThreadId () returned 0xa94 [0101.621] GetCurrentThreadId () returned 0xa94 [0101.621] GetCurrentThreadId () returned 0xa94 [0101.621] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.621] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.621] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.644] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x492, dwPendingType=0x1) returned 0x2 [0101.644] GetCurrentThreadId () returned 0xa94 [0101.644] GetCurrentThreadId () returned 0xa94 [0101.644] GetCurrentThreadId () returned 0xa94 [0101.645] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.645] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.645] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0101.645] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.834] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x54d, dwPendingType=0x1) returned 0x2 [0101.834] GetCurrentThreadId () returned 0xa94 [0101.834] GetCurrentThreadId () returned 0xa94 [0101.834] GetCurrentThreadId () returned 0xa94 [0101.834] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.835] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.835] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0101.835] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.940] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x5ba, dwPendingType=0x1) returned 0x2 [0101.940] GetCurrentThreadId () returned 0xa94 [0101.940] GetCurrentThreadId () returned 0xa94 [0101.941] GetCurrentThreadId () returned 0xa94 [0101.941] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.941] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.941] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0101.941] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.956] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x5ca, dwPendingType=0x1) returned 0x2 [0101.956] GetCurrentThreadId () returned 0xa94 [0101.956] GetCurrentThreadId () returned 0xa94 [0101.956] GetCurrentThreadId () returned 0xa94 [0101.956] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.956] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0101.956] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0101.956] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.050] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x628, dwPendingType=0x1) returned 0x2 [0102.050] GetCurrentThreadId () returned 0xa94 [0102.050] GetCurrentThreadId () returned 0xa94 [0102.050] GetCurrentThreadId () returned 0xa94 [0102.050] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.050] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.050] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0102.050] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.159] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x695, dwPendingType=0x1) returned 0x2 [0102.159] GetCurrentThreadId () returned 0xa94 [0102.159] GetCurrentThreadId () returned 0xa94 [0102.159] GetCurrentThreadId () returned 0xa94 [0102.159] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.159] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.159] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0102.159] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.268] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x702, dwPendingType=0x1) returned 0x2 [0102.268] GetCurrentThreadId () returned 0xa94 [0102.268] GetCurrentThreadId () returned 0xa94 [0102.268] GetCurrentThreadId () returned 0xa94 [0102.268] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.268] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.268] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0102.268] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0102.268] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.377] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x76f, dwPendingType=0x1) returned 0x2 [0102.377] GetCurrentThreadId () returned 0xa94 [0102.378] GetCurrentThreadId () returned 0xa94 [0102.378] GetCurrentThreadId () returned 0xa94 [0102.378] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.378] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.378] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0102.378] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.492] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x7dc, dwPendingType=0x1) returned 0x2 [0102.492] GetCurrentThreadId () returned 0xa94 [0102.492] GetCurrentThreadId () returned 0xa94 [0102.492] GetCurrentThreadId () returned 0xa94 [0102.492] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.492] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.492] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0102.492] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.518] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0102.518] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0102.518] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0102.518] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x7fc, dwPendingType=0x1) returned 0x2 [0102.518] GetCurrentThreadId () returned 0xa94 [0102.518] GetCurrentThreadId () returned 0xa94 [0102.518] GetCurrentThreadId () returned 0xa94 [0102.518] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.518] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.518] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.581] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x83a, dwPendingType=0x1) returned 0x2 [0102.581] GetCurrentThreadId () returned 0xa94 [0102.581] GetCurrentThreadId () returned 0xa94 [0102.581] GetCurrentThreadId () returned 0xa94 [0102.581] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.581] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.581] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0102.581] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.596] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x84a, dwPendingType=0x1) returned 0x2 [0102.596] GetCurrentThreadId () returned 0xa94 [0102.596] GetCurrentThreadId () returned 0xa94 [0102.597] GetCurrentThreadId () returned 0xa94 [0102.597] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.597] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.597] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0102.597] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.705] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x8b7, dwPendingType=0x1) returned 0x2 [0102.705] GetCurrentThreadId () returned 0xa94 [0102.705] GetCurrentThreadId () returned 0xa94 [0102.706] GetCurrentThreadId () returned 0xa94 [0102.706] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.706] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.706] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0102.706] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.830] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x924, dwPendingType=0x1) returned 0x2 [0102.830] GetCurrentThreadId () returned 0xa94 [0102.830] GetCurrentThreadId () returned 0xa94 [0102.830] GetCurrentThreadId () returned 0xa94 [0102.831] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.831] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.831] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0102.831] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.911] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x972, dwPendingType=0x1) returned 0x2 [0102.911] GetCurrentThreadId () returned 0xa94 [0102.911] GetCurrentThreadId () returned 0xa94 [0102.912] GetCurrentThreadId () returned 0xa94 [0102.912] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.912] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.912] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0102.912] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.949] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x991, dwPendingType=0x1) returned 0x2 [0102.950] GetCurrentThreadId () returned 0xa94 [0102.950] GetCurrentThreadId () returned 0xa94 [0102.950] GetCurrentThreadId () returned 0xa94 [0102.950] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.950] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.950] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0102.950] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0102.955] GetLastError () returned 0x0 [0102.955] SRRemoveRestorePoint (dwRPNum=0x13) returned 0x0 [0102.957] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0102.957] GetCurrentThreadId () returned 0xa94 [0102.957] GetCurrentThreadId () returned 0xa94 [0102.957] GetCurrentThreadId () returned 0xa94 [0102.957] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0102.957] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0102.957] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0102.965] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0102.965] GetCurrentThreadId () returned 0xa94 [0102.965] GetCurrentThreadId () returned 0xa94 [0102.966] GetCurrentThreadId () returned 0xa94 [0102.966] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0102.966] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0102.966] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0103.012] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0103.012] GetCurrentThreadId () returned 0xa94 [0103.012] GetCurrentThreadId () returned 0xa94 [0103.012] GetCurrentThreadId () returned 0xa94 [0103.012] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.012] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.012] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.049] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2e, dwPendingType=0x1) returned 0x2 [0103.050] GetCurrentThreadId () returned 0xa94 [0103.051] GetCurrentThreadId () returned 0xa94 [0103.434] GetCurrentThreadId () returned 0xa94 [0103.434] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.434] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.434] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0103.434] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0103.434] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0103.434] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.516] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x202, dwPendingType=0x1) returned 0x2 [0103.516] GetCurrentThreadId () returned 0xa94 [0103.516] GetCurrentThreadId () returned 0xa94 [0103.516] GetCurrentThreadId () returned 0xa94 [0103.516] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.517] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.517] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0103.517] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.547] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x222, dwPendingType=0x1) returned 0x2 [0103.547] GetCurrentThreadId () returned 0xa94 [0103.547] GetCurrentThreadId () returned 0xa94 [0103.547] GetCurrentThreadId () returned 0xa94 [0103.547] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.548] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.548] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0103.548] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.629] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x270, dwPendingType=0x1) returned 0x2 [0103.629] GetCurrentThreadId () returned 0xa94 [0103.629] GetCurrentThreadId () returned 0xa94 [0103.630] GetCurrentThreadId () returned 0xa94 [0103.630] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.630] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.630] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0103.630] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.741] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2dd, dwPendingType=0x1) returned 0x2 [0103.741] GetCurrentThreadId () returned 0xa94 [0103.741] GetCurrentThreadId () returned 0xa94 [0103.741] GetCurrentThreadId () returned 0xa94 [0103.742] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.742] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.742] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0103.742] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.844] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x34a, dwPendingType=0x1) returned 0x2 [0103.844] GetCurrentThreadId () returned 0xa94 [0103.844] GetCurrentThreadId () returned 0xa94 [0103.845] GetCurrentThreadId () returned 0xa94 [0103.845] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.845] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.845] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0103.845] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.860] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x35a, dwPendingType=0x1) returned 0x2 [0103.860] GetCurrentThreadId () returned 0xa94 [0103.860] GetCurrentThreadId () returned 0xa94 [0103.860] GetCurrentThreadId () returned 0xa94 [0103.861] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.861] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.861] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0103.861] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.953] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x3b7, dwPendingType=0x1) returned 0x2 [0103.953] GetCurrentThreadId () returned 0xa94 [0103.953] GetCurrentThreadId () returned 0xa94 [0103.953] GetCurrentThreadId () returned 0xa94 [0103.953] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.954] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.954] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0103.954] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0103.961] GetLastError () returned 0x0 [0103.961] SRRemoveRestorePoint (dwRPNum=0x14) returned 0x0 [0103.963] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0103.963] GetCurrentThreadId () returned 0xa94 [0103.963] GetCurrentThreadId () returned 0xa94 [0103.963] GetCurrentThreadId () returned 0xa94 [0103.963] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0103.964] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0103.964] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0103.970] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0103.970] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0103.970] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0103.970] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0103.970] GetCurrentThreadId () returned 0xa94 [0103.970] GetCurrentThreadId () returned 0xa94 [0103.971] GetCurrentThreadId () returned 0xa94 [0103.971] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0103.971] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0103.971] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0103.976] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0103.976] GetCurrentThreadId () returned 0xa94 [0103.976] GetCurrentThreadId () returned 0xa94 [0103.976] GetCurrentThreadId () returned 0xa94 [0103.977] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0103.977] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0103.977] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0104.015] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0104.015] GetCurrentThreadId () returned 0xa94 [0104.015] GetCurrentThreadId () returned 0xa94 [0104.015] GetCurrentThreadId () returned 0xa94 [0104.015] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.015] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.016] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.072] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x3e, dwPendingType=0x1) returned 0x2 [0104.072] GetCurrentThreadId () returned 0xa94 [0104.216] GetCurrentThreadId () returned 0xa94 [0104.492] GetCurrentThreadId () returned 0xa94 [0104.494] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.495] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.495] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0104.495] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0104.497] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0104.497] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.531] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x212, dwPendingType=0x1) returned 0x2 [0104.531] GetCurrentThreadId () returned 0xa94 [0104.531] GetCurrentThreadId () returned 0xa94 [0104.531] GetCurrentThreadId () returned 0xa94 [0104.531] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.531] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.531] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0104.531] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0104.531] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.640] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x280, dwPendingType=0x1) returned 0x2 [0104.640] GetCurrentThreadId () returned 0xa94 [0104.640] GetCurrentThreadId () returned 0xa94 [0104.640] GetCurrentThreadId () returned 0xa94 [0104.641] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.641] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.641] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0104.641] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.749] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2ed, dwPendingType=0x1) returned 0x2 [0104.749] GetCurrentThreadId () returned 0xa94 [0104.749] GetCurrentThreadId () returned 0xa94 [0104.749] GetCurrentThreadId () returned 0xa94 [0104.749] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.749] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.749] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0104.750] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.811] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x32b, dwPendingType=0x1) returned 0x2 [0104.811] GetCurrentThreadId () returned 0xa94 [0104.812] GetCurrentThreadId () returned 0xa94 [0104.812] GetCurrentThreadId () returned 0xa94 [0104.812] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.812] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.812] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0104.813] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.858] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x35a, dwPendingType=0x1) returned 0x2 [0104.858] GetCurrentThreadId () returned 0xa94 [0104.859] GetCurrentThreadId () returned 0xa94 [0104.859] GetCurrentThreadId () returned 0xa94 [0104.859] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.859] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.859] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0104.859] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.913] GetLastError () returned 0x0 [0104.913] SRRemoveRestorePoint (dwRPNum=0x15) returned 0x0 [0104.915] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0104.915] GetCurrentThreadId () returned 0xa94 [0104.916] GetCurrentThreadId () returned 0xa94 [0104.916] GetCurrentThreadId () returned 0xa94 [0104.916] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0104.916] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0104.916] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0104.932] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0104.932] GetCurrentThreadId () returned 0xa94 [0104.932] GetCurrentThreadId () returned 0xa94 [0104.932] GetCurrentThreadId () returned 0xa94 [0104.932] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0104.932] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0104.932] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0104.942] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0104.942] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0104.942] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0104.942] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0104.942] GetCurrentThreadId () returned 0xa94 [0104.942] GetCurrentThreadId () returned 0xa94 [0104.942] GetCurrentThreadId () returned 0xa94 [0104.942] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0104.942] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0104.942] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0104.967] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2f, dwPendingType=0x1) returned 0x2 [0104.967] GetCurrentThreadId () returned 0xa94 [0104.967] GetCurrentThreadId () returned 0xa94 [0104.967] GetCurrentThreadId () returned 0xa94 [0104.967] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0104.967] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0104.967] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0104.967] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0104.974] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0104.974] GetCurrentThreadId () returned 0xa94 [0104.974] GetCurrentThreadId () returned 0xa94 [0104.974] GetCurrentThreadId () returned 0xa94 [0104.974] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.975] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0104.975] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0105.448] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1d4, dwPendingType=0x1) returned 0x2 [0105.448] GetCurrentThreadId () returned 0xa94 [0105.448] GetCurrentThreadId () returned 0xa94 [0105.448] GetCurrentThreadId () returned 0xa94 [0105.449] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0105.449] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0105.449] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0105.449] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0105.449] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0105.529] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x232, dwPendingType=0x1) returned 0x2 [0105.529] GetCurrentThreadId () returned 0xa94 [0105.533] GetCurrentThreadId () returned 0xa94 [0105.533] GetCurrentThreadId () returned 0xa94 [0105.533] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0105.533] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0105.533] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0105.533] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0105.638] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x29f, dwPendingType=0x1) returned 0x2 [0105.638] GetCurrentThreadId () returned 0xa94 [0105.638] GetCurrentThreadId () returned 0xa94 [0105.638] GetCurrentThreadId () returned 0xa94 [0105.639] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0105.639] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0105.639] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0105.639] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0105.760] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x30c, dwPendingType=0x1) returned 0x2 [0105.760] GetCurrentThreadId () returned 0xa94 [0105.760] GetCurrentThreadId () returned 0xa94 [0105.760] GetCurrentThreadId () returned 0xa94 [0105.761] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0105.761] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0105.761] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0105.761] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0105.761] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0105.856] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x379, dwPendingType=0x1) returned 0x2 [0105.856] GetCurrentThreadId () returned 0xa94 [0105.856] GetCurrentThreadId () returned 0xa94 [0105.856] GetCurrentThreadId () returned 0xa94 [0105.857] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0105.857] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0105.857] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0105.857] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0105.965] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x3e7, dwPendingType=0x1) returned 0x2 [0105.965] GetCurrentThreadId () returned 0xa94 [0105.965] GetCurrentThreadId () returned 0xa94 [0105.965] GetCurrentThreadId () returned 0xa94 [0105.965] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0105.966] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0105.966] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0105.966] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.059] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x444, dwPendingType=0x1) returned 0x2 [0106.059] GetCurrentThreadId () returned 0xa94 [0106.059] GetCurrentThreadId () returned 0xa94 [0106.060] GetCurrentThreadId () returned 0xa94 [0106.060] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.060] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.060] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0106.060] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.074] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x454, dwPendingType=0x1) returned 0x2 [0106.074] GetCurrentThreadId () returned 0xa94 [0106.075] GetCurrentThreadId () returned 0xa94 [0106.075] GetCurrentThreadId () returned 0xa94 [0106.075] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.075] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.075] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0106.075] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.184] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x4c1, dwPendingType=0x1) returned 0x2 [0106.185] GetCurrentThreadId () returned 0xa94 [0106.185] GetCurrentThreadId () returned 0xa94 [0106.185] GetCurrentThreadId () returned 0xa94 [0106.185] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.186] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.186] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0106.186] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.293] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x52e, dwPendingType=0x1) returned 0x2 [0106.293] GetCurrentThreadId () returned 0xa94 [0106.293] GetCurrentThreadId () returned 0xa94 [0106.293] GetCurrentThreadId () returned 0xa94 [0106.294] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.294] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.294] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0106.294] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.371] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x57c, dwPendingType=0x1) returned 0x2 [0106.371] GetCurrentThreadId () returned 0xa94 [0106.371] GetCurrentThreadId () returned 0xa94 [0106.371] GetCurrentThreadId () returned 0xa94 [0106.372] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.372] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.372] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0106.372] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.402] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x59b, dwPendingType=0x1) returned 0x2 [0106.402] GetCurrentThreadId () returned 0xa94 [0106.403] GetCurrentThreadId () returned 0xa94 [0106.403] GetCurrentThreadId () returned 0xa94 [0106.403] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.403] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.403] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0106.403] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.444] GetLastError () returned 0x0 [0106.444] SRRemoveRestorePoint (dwRPNum=0x16) returned 0x0 [0106.446] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0106.446] GetCurrentThreadId () returned 0xa94 [0106.446] GetCurrentThreadId () returned 0xa94 [0106.446] GetCurrentThreadId () returned 0xa94 [0106.446] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0106.446] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0106.446] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0106.459] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0106.459] GetCurrentThreadId () returned 0xa94 [0106.459] GetCurrentThreadId () returned 0xa94 [0106.459] GetCurrentThreadId () returned 0xa94 [0106.459] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0106.459] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0106.459] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0106.469] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0106.470] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0106.470] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0106.470] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0106.470] GetCurrentThreadId () returned 0xa94 [0106.470] GetCurrentThreadId () returned 0xa94 [0106.470] GetCurrentThreadId () returned 0xa94 [0106.470] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0106.470] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0106.471] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0106.507] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0106.508] GetCurrentThreadId () returned 0xa94 [0106.508] GetCurrentThreadId () returned 0xa94 [0106.508] GetCurrentThreadId () returned 0xa94 [0106.508] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.508] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.508] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.511] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0106.511] GetCurrentThreadId () returned 0xa94 [0106.511] GetCurrentThreadId () returned 0xa94 [0106.511] GetCurrentThreadId () returned 0xa94 [0106.512] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.512] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.512] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0106.512] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.741] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xea, dwPendingType=0x1) returned 0x2 [0106.950] GetCurrentThreadId () returned 0xa94 [0106.969] GetCurrentThreadId () returned 0xa94 [0106.970] GetCurrentThreadId () returned 0xa94 [0106.970] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.976] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.981] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0106.981] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0106.982] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0106.982] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.995] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1f3, dwPendingType=0x1) returned 0x2 [0106.995] GetCurrentThreadId () returned 0xa94 [0106.995] GetCurrentThreadId () returned 0xa94 [0106.995] GetCurrentThreadId () returned 0xa94 [0106.996] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.996] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0106.996] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0106.996] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.057] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x232, dwPendingType=0x1) returned 0x2 [0107.057] GetCurrentThreadId () returned 0xa94 [0107.057] GetCurrentThreadId () returned 0xa94 [0107.057] GetCurrentThreadId () returned 0xa94 [0107.057] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.058] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.058] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0107.058] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.167] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x29f, dwPendingType=0x1) returned 0x2 [0107.167] GetCurrentThreadId () returned 0xa94 [0107.167] GetCurrentThreadId () returned 0xa94 [0107.167] GetCurrentThreadId () returned 0xa94 [0107.167] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.168] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.168] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0107.168] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.276] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x30c, dwPendingType=0x1) returned 0x2 [0107.276] GetCurrentThreadId () returned 0xa94 [0107.276] GetCurrentThreadId () returned 0xa94 [0107.277] GetCurrentThreadId () returned 0xa94 [0107.277] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.277] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.277] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0107.277] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.307] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x32b, dwPendingType=0x1) returned 0x2 [0107.307] GetCurrentThreadId () returned 0xa94 [0107.308] GetCurrentThreadId () returned 0xa94 [0107.308] GetCurrentThreadId () returned 0xa94 [0107.308] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.308] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.308] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0107.308] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.372] GetLastError () returned 0x0 [0107.372] SRRemoveRestorePoint (dwRPNum=0x17) returned 0x0 [0107.373] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0107.373] GetCurrentThreadId () returned 0xa94 [0107.373] GetCurrentThreadId () returned 0xa94 [0107.374] GetCurrentThreadId () returned 0xa94 [0107.374] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0107.374] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0107.374] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0107.379] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0107.379] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0107.380] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0107.380] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0107.380] GetCurrentThreadId () returned 0xa94 [0107.380] GetCurrentThreadId () returned 0xa94 [0107.380] GetCurrentThreadId () returned 0xa94 [0107.380] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0107.380] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0107.380] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0107.385] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xf, dwPendingType=0x1) returned 0x2 [0107.385] GetCurrentThreadId () returned 0xa94 [0107.385] GetCurrentThreadId () returned 0xa94 [0107.385] GetCurrentThreadId () returned 0xa94 [0107.385] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0107.385] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0107.385] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0107.385] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0107.392] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0107.392] GetCurrentThreadId () returned 0xa94 [0107.392] GetCurrentThreadId () returned 0xa94 [0107.392] GetCurrentThreadId () returned 0xa94 [0107.392] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0107.392] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0107.392] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0107.432] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0107.432] GetCurrentThreadId () returned 0xa94 [0107.432] GetCurrentThreadId () returned 0xa94 [0107.432] GetCurrentThreadId () returned 0xa94 [0107.432] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.433] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.433] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.495] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x4e, dwPendingType=0x1) returned 0x2 [0107.495] GetCurrentThreadId () returned 0xa94 [0107.495] GetCurrentThreadId () returned 0xa94 [0107.495] GetCurrentThreadId () returned 0xa94 [0107.495] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.495] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.495] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0107.495] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.603] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xbc, dwPendingType=0x1) returned 0x2 [0107.603] GetCurrentThreadId () returned 0xa94 [0107.603] GetCurrentThreadId () returned 0xa94 [0107.603] GetCurrentThreadId () returned 0xa94 [0107.603] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.604] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.604] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0107.604] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.619] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xcb, dwPendingType=0x1) returned 0x2 [0107.619] GetCurrentThreadId () returned 0xa94 [0107.619] GetCurrentThreadId () returned 0xa94 [0107.619] GetCurrentThreadId () returned 0xa94 [0107.619] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.620] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.620] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0107.620] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.713] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x129, dwPendingType=0x1) returned 0x2 [0107.713] GetCurrentThreadId () returned 0xa94 [0107.713] GetCurrentThreadId () returned 0xa94 [0107.713] GetCurrentThreadId () returned 0xa94 [0107.713] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.713] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.713] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0107.713] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.868] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x196, dwPendingType=0x1) returned 0x2 [0107.868] GetCurrentThreadId () returned 0xa94 [0107.868] GetCurrentThreadId () returned 0xa94 [0107.869] GetCurrentThreadId () returned 0xa94 [0107.869] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.869] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.869] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0107.869] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.978] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x203, dwPendingType=0x1) returned 0x2 [0107.978] GetCurrentThreadId () returned 0xa94 [0107.978] GetCurrentThreadId () returned 0xa94 [0107.978] GetCurrentThreadId () returned 0xa94 [0107.978] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.978] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0107.978] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0107.978] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0107.978] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.087] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x271, dwPendingType=0x1) returned 0x2 [0108.087] GetCurrentThreadId () returned 0xa94 [0108.087] GetCurrentThreadId () returned 0xa94 [0108.087] GetCurrentThreadId () returned 0xa94 [0108.087] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.087] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.088] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0108.088] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.203] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2de, dwPendingType=0x1) returned 0x2 [0108.203] GetCurrentThreadId () returned 0xa94 [0108.204] GetCurrentThreadId () returned 0xa94 [0108.204] GetCurrentThreadId () returned 0xa94 [0108.204] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.204] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.204] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0108.204] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.385] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x399, dwPendingType=0x1) returned 0x2 [0108.386] GetCurrentThreadId () returned 0xa94 [0108.386] GetCurrentThreadId () returned 0xa94 [0108.386] GetCurrentThreadId () returned 0xa94 [0108.386] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.386] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.386] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0108.386] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0108.413] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.430] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x3c8, dwPendingType=0x1) returned 0x2 [0108.430] GetCurrentThreadId () returned 0xa94 [0108.430] GetCurrentThreadId () returned 0xa94 [0108.430] GetCurrentThreadId () returned 0xa94 [0108.431] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.431] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.433] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0108.433] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.611] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x473, dwPendingType=0x1) returned 0x2 [0108.611] GetCurrentThreadId () returned 0xa94 [0108.612] GetCurrentThreadId () returned 0xa94 [0108.635] GetCurrentThreadId () returned 0xa94 [0108.635] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.635] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.635] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0108.635] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0108.635] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.649] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x4a2, dwPendingType=0x1) returned 0x2 [0108.649] GetCurrentThreadId () returned 0xa94 [0108.649] GetCurrentThreadId () returned 0xa94 [0108.649] GetCurrentThreadId () returned 0xa94 [0108.649] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.649] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.649] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0108.649] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.758] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x50f, dwPendingType=0x1) returned 0x2 [0108.758] GetCurrentThreadId () returned 0xa94 [0108.758] GetCurrentThreadId () returned 0xa94 [0108.758] GetCurrentThreadId () returned 0xa94 [0108.758] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.758] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.758] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0108.758] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.869] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x57d, dwPendingType=0x1) returned 0x2 [0108.869] GetCurrentThreadId () returned 0xa94 [0108.869] GetCurrentThreadId () returned 0xa94 [0108.869] GetCurrentThreadId () returned 0xa94 [0108.869] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.869] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.869] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0108.869] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.914] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x5ab, dwPendingType=0x1) returned 0x2 [0108.914] GetCurrentThreadId () returned 0xa94 [0108.914] GetCurrentThreadId () returned 0xa94 [0108.914] GetCurrentThreadId () returned 0xa94 [0108.914] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.914] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.915] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0108.915] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.977] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x5ea, dwPendingType=0x1) returned 0x2 [0108.977] GetCurrentThreadId () returned 0xa94 [0108.977] GetCurrentThreadId () returned 0xa94 [0108.977] GetCurrentThreadId () returned 0xa94 [0108.977] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.977] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0108.977] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0108.977] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.092] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x657, dwPendingType=0x1) returned 0x2 [0109.092] GetCurrentThreadId () returned 0xa94 [0109.093] GetCurrentThreadId () returned 0xa94 [0109.093] GetCurrentThreadId () returned 0xa94 [0109.093] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.093] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.093] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0109.093] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.119] GetLastError () returned 0x0 [0109.119] SRRemoveRestorePoint (dwRPNum=0x18) returned 0x0 [0109.121] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0109.121] GetCurrentThreadId () returned 0xa94 [0109.121] GetCurrentThreadId () returned 0xa94 [0109.121] GetCurrentThreadId () returned 0xa94 [0109.122] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0109.122] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0109.122] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0109.132] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0109.132] GetCurrentThreadId () returned 0xa94 [0109.132] GetCurrentThreadId () returned 0xa94 [0109.133] GetCurrentThreadId () returned 0xa94 [0109.133] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0109.133] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0109.133] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0109.141] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0109.142] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0109.142] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0109.142] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0109.142] GetCurrentThreadId () returned 0xa94 [0109.142] GetCurrentThreadId () returned 0xa94 [0109.142] GetCurrentThreadId () returned 0xa94 [0109.142] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0109.142] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0109.142] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0109.162] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0109.162] GetCurrentThreadId () returned 0xa94 [0109.162] GetCurrentThreadId () returned 0xa94 [0109.162] GetCurrentThreadId () returned 0xa94 [0109.162] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.163] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.163] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.196] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2f, dwPendingType=0x1) returned 0x2 [0109.203] GetCurrentThreadId () returned 0xa94 [0109.209] GetCurrentThreadId () returned 0xa94 [0109.370] GetCurrentThreadId () returned 0xa94 [0109.370] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.370] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.370] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0109.398] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0109.398] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0109.398] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.541] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x186, dwPendingType=0x1) returned 0x2 [0109.563] GetCurrentThreadId () returned 0xa94 [0109.565] GetCurrentThreadId () returned 0xa94 [0109.567] GetCurrentThreadId () returned 0xa94 [0109.569] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.573] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.574] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0109.575] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0109.578] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.632] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1e4, dwPendingType=0x1) returned 0x2 [0109.632] GetCurrentThreadId () returned 0xa94 [0109.632] GetCurrentThreadId () returned 0xa94 [0109.632] GetCurrentThreadId () returned 0xa94 [0109.633] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.633] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.633] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0109.633] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.741] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x251, dwPendingType=0x1) returned 0x2 [0109.741] GetCurrentThreadId () returned 0xa94 [0109.741] GetCurrentThreadId () returned 0xa94 [0109.741] GetCurrentThreadId () returned 0xa94 [0109.741] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.741] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.741] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0109.741] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.850] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2be, dwPendingType=0x1) returned 0x2 [0109.850] GetCurrentThreadId () returned 0xa94 [0109.850] GetCurrentThreadId () returned 0xa94 [0109.850] GetCurrentThreadId () returned 0xa94 [0109.850] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.850] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.850] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0109.850] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.865] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2ce, dwPendingType=0x1) returned 0x2 [0109.866] GetCurrentThreadId () returned 0xa94 [0109.866] GetCurrentThreadId () returned 0xa94 [0109.866] GetCurrentThreadId () returned 0xa94 [0109.866] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.866] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.866] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0109.866] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.914] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0109.914] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0109.914] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0109.914] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2fd, dwPendingType=0x1) returned 0x2 [0109.914] GetCurrentThreadId () returned 0xa94 [0109.914] GetCurrentThreadId () returned 0xa94 [0109.914] GetCurrentThreadId () returned 0xa94 [0109.914] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.915] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.915] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.942] GetLastError () returned 0x0 [0109.942] SRRemoveRestorePoint (dwRPNum=0x19) returned 0x0 [0109.951] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0109.951] GetCurrentThreadId () returned 0xa94 [0109.951] GetCurrentThreadId () returned 0xa94 [0109.951] GetCurrentThreadId () returned 0xa94 [0109.951] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0109.951] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0109.951] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0109.957] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0109.957] GetCurrentThreadId () returned 0xa94 [0109.957] GetCurrentThreadId () returned 0xa94 [0109.957] GetCurrentThreadId () returned 0xa94 [0109.958] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0109.958] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0109.958] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0109.959] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0109.959] GetCurrentThreadId () returned 0xa94 [0109.959] GetCurrentThreadId () returned 0xa94 [0109.959] GetCurrentThreadId () returned 0xa94 [0109.959] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0109.959] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0109.959] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0109.959] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0109.985] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0109.985] GetCurrentThreadId () returned 0xa94 [0109.986] GetCurrentThreadId () returned 0xa94 [0109.986] GetCurrentThreadId () returned 0xa94 [0109.986] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.986] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0109.986] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0110.069] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x5e, dwPendingType=0x1) returned 0x2 [0110.069] GetCurrentThreadId () returned 0xa94 [0110.069] GetCurrentThreadId () returned 0xa94 [0110.069] GetCurrentThreadId () returned 0xa94 [0110.069] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0110.069] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0110.069] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 1 [0110.069] PeekMessageA (in: lpMsg=0x18e4c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4c4) returned 0 [0110.086] GetLastError () returned 0x0 [0110.086] SRRemoveRestorePoint (dwRPNum=0x1a) returned 0x2 [0110.087] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.087] GetCurrentThreadId () returned 0xa94 [0110.087] GetCurrentThreadId () returned 0xa94 [0110.087] GetCurrentThreadId () returned 0xa94 [0110.088] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.088] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.088] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.096] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.096] GetCurrentThreadId () returned 0xa94 [0110.096] GetCurrentThreadId () returned 0xa94 [0110.096] GetCurrentThreadId () returned 0xa94 [0110.096] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.096] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.096] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.107] NtdllDefWindowProc_A (hWnd=0x5026a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0110.107] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0110.107] NtdllDefWindowProc_A (hWnd=0x30160, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0110.107] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0110.108] GetCurrentThreadId () returned 0xa94 [0110.108] GetCurrentThreadId () returned 0xa94 [0110.108] GetCurrentThreadId () returned 0xa94 [0110.108] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.108] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.108] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.152] GetLastError () returned 0x2 [0110.152] SRRemoveRestorePoint (dwRPNum=0x1b) returned 0x2 [0110.154] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.154] GetCurrentThreadId () returned 0xa94 [0110.154] GetCurrentThreadId () returned 0xa94 [0110.154] GetCurrentThreadId () returned 0xa94 [0110.154] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.154] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.154] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.164] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.164] GetCurrentThreadId () returned 0xa94 [0110.164] GetCurrentThreadId () returned 0xa94 [0110.164] GetCurrentThreadId () returned 0xa94 [0110.164] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.164] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.164] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.177] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0110.177] GetCurrentThreadId () returned 0xa94 [0110.177] GetCurrentThreadId () returned 0xa94 [0110.177] GetCurrentThreadId () returned 0xa94 [0110.178] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.178] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.178] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0110.178] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0110.178] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.204] GetLastError () returned 0x2 [0110.204] SRRemoveRestorePoint (dwRPNum=0x1c) returned 0x2 [0110.206] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.206] GetCurrentThreadId () returned 0xa94 [0110.206] GetCurrentThreadId () returned 0xa94 [0110.206] GetCurrentThreadId () returned 0xa94 [0110.207] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.207] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.207] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.211] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.211] GetCurrentThreadId () returned 0xa94 [0110.212] GetCurrentThreadId () returned 0xa94 [0110.212] GetCurrentThreadId () returned 0xa94 [0110.212] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.213] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.213] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.240] GetLastError () returned 0x2 [0110.240] SRRemoveRestorePoint (dwRPNum=0x1d) returned 0x2 [0110.242] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.242] GetCurrentThreadId () returned 0xa94 [0110.242] GetCurrentThreadId () returned 0xa94 [0110.242] GetCurrentThreadId () returned 0xa94 [0110.243] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.243] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.243] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.247] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.247] GetCurrentThreadId () returned 0xa94 [0110.247] GetCurrentThreadId () returned 0xa94 [0110.247] GetCurrentThreadId () returned 0xa94 [0110.248] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.248] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.248] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.275] GetLastError () returned 0x2 [0110.275] SRRemoveRestorePoint (dwRPNum=0x1e) returned 0x2 [0110.276] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.276] GetCurrentThreadId () returned 0xa94 [0110.277] GetCurrentThreadId () returned 0xa94 [0110.277] GetCurrentThreadId () returned 0xa94 [0110.277] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.277] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.277] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.280] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.281] GetCurrentThreadId () returned 0xa94 [0110.281] GetCurrentThreadId () returned 0xa94 [0110.281] GetCurrentThreadId () returned 0xa94 [0110.281] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.281] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.282] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.289] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xf, dwPendingType=0x1) returned 0x2 [0110.289] GetCurrentThreadId () returned 0xa94 [0110.290] GetCurrentThreadId () returned 0xa94 [0110.290] GetCurrentThreadId () returned 0xa94 [0110.290] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.290] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.290] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0110.290] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.309] GetLastError () returned 0x2 [0110.309] SRRemoveRestorePoint (dwRPNum=0x1f) returned 0x2 [0110.310] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.310] GetCurrentThreadId () returned 0xa94 [0110.311] GetCurrentThreadId () returned 0xa94 [0110.311] GetCurrentThreadId () returned 0xa94 [0110.311] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.311] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.311] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.315] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.315] GetCurrentThreadId () returned 0xa94 [0110.315] GetCurrentThreadId () returned 0xa94 [0110.315] GetCurrentThreadId () returned 0xa94 [0110.315] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.315] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.315] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.355] GetLastError () returned 0x2 [0110.355] SRRemoveRestorePoint (dwRPNum=0x20) returned 0x2 [0110.357] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.357] GetCurrentThreadId () returned 0xa94 [0110.357] GetCurrentThreadId () returned 0xa94 [0110.357] GetCurrentThreadId () returned 0xa94 [0110.357] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.358] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.358] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.362] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.362] GetCurrentThreadId () returned 0xa94 [0110.362] GetCurrentThreadId () returned 0xa94 [0110.362] GetCurrentThreadId () returned 0xa94 [0110.363] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.363] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.363] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.387] GetLastError () returned 0x2 [0110.387] SRRemoveRestorePoint (dwRPNum=0x21) returned 0x2 [0110.388] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.388] GetCurrentThreadId () returned 0xa94 [0110.388] GetCurrentThreadId () returned 0xa94 [0110.388] GetCurrentThreadId () returned 0xa94 [0110.388] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.388] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.388] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.392] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.392] GetCurrentThreadId () returned 0xa94 [0110.392] GetCurrentThreadId () returned 0xa94 [0110.392] GetCurrentThreadId () returned 0xa94 [0110.392] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.392] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.393] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.396] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xf, dwPendingType=0x1) returned 0x2 [0110.396] GetCurrentThreadId () returned 0xa94 [0110.396] GetCurrentThreadId () returned 0xa94 [0110.396] GetCurrentThreadId () returned 0xa94 [0110.396] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.396] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.396] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0110.396] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.430] GetLastError () returned 0x2 [0110.430] SRRemoveRestorePoint (dwRPNum=0x22) returned 0x2 [0110.432] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.432] GetCurrentThreadId () returned 0xa94 [0110.432] GetCurrentThreadId () returned 0xa94 [0110.432] GetCurrentThreadId () returned 0xa94 [0110.432] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.433] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.433] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.437] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.437] GetCurrentThreadId () returned 0xa94 [0110.438] GetCurrentThreadId () returned 0xa94 [0110.438] GetCurrentThreadId () returned 0xa94 [0110.438] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.438] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.438] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.479] GetLastError () returned 0x2 [0110.480] SRRemoveRestorePoint (dwRPNum=0x23) returned 0x2 [0110.481] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.481] GetCurrentThreadId () returned 0xa94 [0110.482] GetCurrentThreadId () returned 0xa94 [0110.482] GetCurrentThreadId () returned 0xa94 [0110.482] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.482] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.482] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.486] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.486] GetCurrentThreadId () returned 0xa94 [0110.487] GetCurrentThreadId () returned 0xa94 [0110.487] GetCurrentThreadId () returned 0xa94 [0110.487] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.487] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.487] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.489] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0110.489] GetCurrentThreadId () returned 0xa94 [0110.489] GetCurrentThreadId () returned 0xa94 [0110.490] GetCurrentThreadId () returned 0xa94 [0110.490] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.490] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.490] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0110.490] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.505] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x20, dwPendingType=0x1) returned 0x2 [0110.505] GetCurrentThreadId () returned 0xa94 [0110.505] GetCurrentThreadId () returned 0xa94 [0110.505] GetCurrentThreadId () returned 0xa94 [0110.505] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.505] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.505] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0110.505] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.516] GetLastError () returned 0x2 [0110.516] SRRemoveRestorePoint (dwRPNum=0x24) returned 0x2 [0110.517] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.518] GetCurrentThreadId () returned 0xa94 [0110.518] GetCurrentThreadId () returned 0xa94 [0110.518] GetCurrentThreadId () returned 0xa94 [0110.518] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.518] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.518] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.522] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.522] GetCurrentThreadId () returned 0xa94 [0110.522] GetCurrentThreadId () returned 0xa94 [0110.522] GetCurrentThreadId () returned 0xa94 [0110.522] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.522] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.522] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.543] GetLastError () returned 0x2 [0110.543] SRRemoveRestorePoint (dwRPNum=0x25) returned 0x2 [0110.544] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.544] GetCurrentThreadId () returned 0xa94 [0110.544] GetCurrentThreadId () returned 0xa94 [0110.545] GetCurrentThreadId () returned 0xa94 [0110.545] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.545] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.545] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.548] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.548] GetCurrentThreadId () returned 0xa94 [0110.548] GetCurrentThreadId () returned 0xa94 [0110.548] GetCurrentThreadId () returned 0xa94 [0110.548] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.548] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.548] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.572] GetLastError () returned 0x2 [0110.573] SRRemoveRestorePoint (dwRPNum=0x26) returned 0x2 [0110.574] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.574] GetCurrentThreadId () returned 0xa94 [0110.574] GetCurrentThreadId () returned 0xa94 [0110.574] GetCurrentThreadId () returned 0xa94 [0110.574] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.574] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.574] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.578] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.578] GetCurrentThreadId () returned 0xa94 [0110.578] GetCurrentThreadId () returned 0xa94 [0110.578] GetCurrentThreadId () returned 0xa94 [0110.578] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.578] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.578] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.619] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2f, dwPendingType=0x1) returned 0x2 [0110.619] GetCurrentThreadId () returned 0xa94 [0110.619] GetCurrentThreadId () returned 0xa94 [0110.619] GetCurrentThreadId () returned 0xa94 [0110.619] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.619] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.619] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0110.619] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.631] GetLastError () returned 0x2 [0110.631] SRRemoveRestorePoint (dwRPNum=0x27) returned 0x2 [0110.632] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.633] GetCurrentThreadId () returned 0xa94 [0110.633] GetCurrentThreadId () returned 0xa94 [0110.633] GetCurrentThreadId () returned 0xa94 [0110.633] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.633] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.633] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.636] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.636] GetCurrentThreadId () returned 0xa94 [0110.636] GetCurrentThreadId () returned 0xa94 [0110.636] GetCurrentThreadId () returned 0xa94 [0110.637] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.637] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.637] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.663] GetLastError () returned 0x2 [0110.663] SRRemoveRestorePoint (dwRPNum=0x28) returned 0x2 [0110.664] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.664] GetCurrentThreadId () returned 0xa94 [0110.664] GetCurrentThreadId () returned 0xa94 [0110.664] GetCurrentThreadId () returned 0xa94 [0110.664] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.664] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.664] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.667] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.667] GetCurrentThreadId () returned 0xa94 [0110.668] GetCurrentThreadId () returned 0xa94 [0110.668] GetCurrentThreadId () returned 0xa94 [0110.668] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.668] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.668] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.693] GetLastError () returned 0x2 [0110.693] SRRemoveRestorePoint (dwRPNum=0x29) returned 0x2 [0110.694] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.694] GetCurrentThreadId () returned 0xa94 [0110.694] GetCurrentThreadId () returned 0xa94 [0110.694] GetCurrentThreadId () returned 0xa94 [0110.694] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.695] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.695] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.698] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.698] GetCurrentThreadId () returned 0xa94 [0110.698] GetCurrentThreadId () returned 0xa94 [0110.698] GetCurrentThreadId () returned 0xa94 [0110.698] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.698] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.698] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.719] GetLastError () returned 0x2 [0110.719] SRRemoveRestorePoint (dwRPNum=0x2a) returned 0x2 [0110.720] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.720] GetCurrentThreadId () returned 0xa94 [0110.720] GetCurrentThreadId () returned 0xa94 [0110.721] GetCurrentThreadId () returned 0xa94 [0110.721] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.721] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.721] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.724] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.724] GetCurrentThreadId () returned 0xa94 [0110.724] GetCurrentThreadId () returned 0xa94 [0110.724] GetCurrentThreadId () returned 0xa94 [0110.725] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.725] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.725] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0110.725] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.749] GetLastError () returned 0x2 [0110.749] SRRemoveRestorePoint (dwRPNum=0x2b) returned 0x2 [0110.750] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.750] GetCurrentThreadId () returned 0xa94 [0110.750] GetCurrentThreadId () returned 0xa94 [0110.750] GetCurrentThreadId () returned 0xa94 [0110.750] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.751] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.751] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.754] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.754] GetCurrentThreadId () returned 0xa94 [0110.754] GetCurrentThreadId () returned 0xa94 [0110.754] GetCurrentThreadId () returned 0xa94 [0110.754] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.754] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.755] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.774] GetLastError () returned 0x2 [0110.774] SRRemoveRestorePoint (dwRPNum=0x2c) returned 0x2 [0110.775] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.775] GetCurrentThreadId () returned 0xa94 [0110.775] GetCurrentThreadId () returned 0xa94 [0110.775] GetCurrentThreadId () returned 0xa94 [0110.775] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.776] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.776] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.779] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.779] GetCurrentThreadId () returned 0xa94 [0110.779] GetCurrentThreadId () returned 0xa94 [0110.779] GetCurrentThreadId () returned 0xa94 [0110.779] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.779] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.779] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.801] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1f, dwPendingType=0x1) returned 0x2 [0110.801] GetCurrentThreadId () returned 0xa94 [0110.801] GetCurrentThreadId () returned 0xa94 [0110.801] GetCurrentThreadId () returned 0xa94 [0110.801] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.802] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.802] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0110.802] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0110.802] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.856] GetLastError () returned 0x2 [0110.856] SRRemoveRestorePoint (dwRPNum=0x2d) returned 0x2 [0110.857] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.857] GetCurrentThreadId () returned 0xa94 [0110.857] GetCurrentThreadId () returned 0xa94 [0110.857] GetCurrentThreadId () returned 0xa94 [0110.857] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.857] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.857] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.860] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.860] GetCurrentThreadId () returned 0xa94 [0110.861] GetCurrentThreadId () returned 0xa94 [0110.861] GetCurrentThreadId () returned 0xa94 [0110.861] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.861] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.861] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.864] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xf, dwPendingType=0x1) returned 0x2 [0110.864] GetCurrentThreadId () returned 0xa94 [0110.864] GetCurrentThreadId () returned 0xa94 [0110.864] GetCurrentThreadId () returned 0xa94 [0110.864] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.864] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.864] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0110.864] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.889] GetLastError () returned 0x2 [0110.889] SRRemoveRestorePoint (dwRPNum=0x2e) returned 0x2 [0110.890] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.890] GetCurrentThreadId () returned 0xa94 [0110.891] GetCurrentThreadId () returned 0xa94 [0110.891] GetCurrentThreadId () returned 0xa94 [0110.891] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.891] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.891] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.894] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.895] GetCurrentThreadId () returned 0xa94 [0110.895] GetCurrentThreadId () returned 0xa94 [0110.895] GetCurrentThreadId () returned 0xa94 [0110.895] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.895] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.895] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.923] GetLastError () returned 0x2 [0110.923] SRRemoveRestorePoint (dwRPNum=0x2f) returned 0x2 [0110.924] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.924] GetCurrentThreadId () returned 0xa94 [0110.925] GetCurrentThreadId () returned 0xa94 [0110.925] GetCurrentThreadId () returned 0xa94 [0110.925] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.925] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.925] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.929] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.929] GetCurrentThreadId () returned 0xa94 [0110.929] GetCurrentThreadId () returned 0xa94 [0110.929] GetCurrentThreadId () returned 0xa94 [0110.929] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.929] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.929] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.962] GetLastError () returned 0x2 [0110.962] SRRemoveRestorePoint (dwRPNum=0x30) returned 0x2 [0110.963] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.964] GetCurrentThreadId () returned 0xa94 [0110.964] GetCurrentThreadId () returned 0xa94 [0110.964] GetCurrentThreadId () returned 0xa94 [0110.964] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.964] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.964] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0110.968] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0110.968] GetCurrentThreadId () returned 0xa94 [0110.969] GetCurrentThreadId () returned 0xa94 [0110.969] GetCurrentThreadId () returned 0xa94 [0110.969] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.969] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.969] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.981] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xf, dwPendingType=0x1) returned 0x2 [0110.981] GetCurrentThreadId () returned 0xa94 [0110.981] GetCurrentThreadId () returned 0xa94 [0110.982] GetCurrentThreadId () returned 0xa94 [0110.982] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.982] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.982] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0110.982] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0110.999] GetLastError () returned 0x2 [0110.999] SRRemoveRestorePoint (dwRPNum=0x31) returned 0x2 [0111.000] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.000] GetCurrentThreadId () returned 0xa94 [0111.000] GetCurrentThreadId () returned 0xa94 [0111.000] GetCurrentThreadId () returned 0xa94 [0111.000] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.000] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.000] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.012] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.012] GetCurrentThreadId () returned 0xa94 [0111.012] GetCurrentThreadId () returned 0xa94 [0111.012] GetCurrentThreadId () returned 0xa94 [0111.012] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.012] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.012] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.033] GetLastError () returned 0x2 [0111.033] SRRemoveRestorePoint (dwRPNum=0x32) returned 0x2 [0111.034] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.034] GetCurrentThreadId () returned 0xa94 [0111.034] GetCurrentThreadId () returned 0xa94 [0111.035] GetCurrentThreadId () returned 0xa94 [0111.035] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.035] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.035] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.038] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.038] GetCurrentThreadId () returned 0xa94 [0111.039] GetCurrentThreadId () returned 0xa94 [0111.039] GetCurrentThreadId () returned 0xa94 [0111.039] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.039] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.039] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.058] GetLastError () returned 0x2 [0111.058] SRRemoveRestorePoint (dwRPNum=0x33) returned 0x2 [0111.059] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.059] GetCurrentThreadId () returned 0xa94 [0111.059] GetCurrentThreadId () returned 0xa94 [0111.059] GetCurrentThreadId () returned 0xa94 [0111.059] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.059] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.059] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.062] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.062] GetCurrentThreadId () returned 0xa94 [0111.062] GetCurrentThreadId () returned 0xa94 [0111.062] GetCurrentThreadId () returned 0xa94 [0111.062] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.063] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.063] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.081] GetLastError () returned 0x2 [0111.081] SRRemoveRestorePoint (dwRPNum=0x34) returned 0x2 [0111.083] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.083] GetCurrentThreadId () returned 0xa94 [0111.083] GetCurrentThreadId () returned 0xa94 [0111.083] GetCurrentThreadId () returned 0xa94 [0111.083] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.083] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.083] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0111.083] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.087] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.087] GetCurrentThreadId () returned 0xa94 [0111.087] GetCurrentThreadId () returned 0xa94 [0111.087] GetCurrentThreadId () returned 0xa94 [0111.088] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.088] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.088] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.110] GetLastError () returned 0x2 [0111.110] SRRemoveRestorePoint (dwRPNum=0x35) returned 0x2 [0111.111] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.111] GetCurrentThreadId () returned 0xa94 [0111.111] GetCurrentThreadId () returned 0xa94 [0111.112] GetCurrentThreadId () returned 0xa94 [0111.112] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.112] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.112] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.115] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.115] GetCurrentThreadId () returned 0xa94 [0111.116] GetCurrentThreadId () returned 0xa94 [0111.116] GetCurrentThreadId () returned 0xa94 [0111.116] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.116] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.116] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.139] GetLastError () returned 0x2 [0111.139] SRRemoveRestorePoint (dwRPNum=0x36) returned 0x2 [0111.141] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.141] GetCurrentThreadId () returned 0xa94 [0111.141] GetCurrentThreadId () returned 0xa94 [0111.141] GetCurrentThreadId () returned 0xa94 [0111.141] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.141] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.141] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.145] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.145] GetCurrentThreadId () returned 0xa94 [0111.145] GetCurrentThreadId () returned 0xa94 [0111.146] GetCurrentThreadId () returned 0xa94 [0111.146] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.146] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.146] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0111.146] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.170] GetLastError () returned 0x2 [0111.170] SRRemoveRestorePoint (dwRPNum=0x37) returned 0x2 [0111.171] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.171] GetCurrentThreadId () returned 0xa94 [0111.172] GetCurrentThreadId () returned 0xa94 [0111.172] GetCurrentThreadId () returned 0xa94 [0111.172] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.172] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.172] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.177] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.177] GetCurrentThreadId () returned 0xa94 [0111.177] GetCurrentThreadId () returned 0xa94 [0111.177] GetCurrentThreadId () returned 0xa94 [0111.178] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.178] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.178] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.191] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1f, dwPendingType=0x1) returned 0x2 [0111.191] GetCurrentThreadId () returned 0xa94 [0111.191] GetCurrentThreadId () returned 0xa94 [0111.191] GetCurrentThreadId () returned 0xa94 [0111.192] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.192] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.192] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0111.192] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.197] GetLastError () returned 0x2 [0111.198] SRRemoveRestorePoint (dwRPNum=0x38) returned 0x2 [0111.199] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.199] GetCurrentThreadId () returned 0xa94 [0111.199] GetCurrentThreadId () returned 0xa94 [0111.199] GetCurrentThreadId () returned 0xa94 [0111.200] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.200] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.200] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.203] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.203] GetCurrentThreadId () returned 0xa94 [0111.203] GetCurrentThreadId () returned 0xa94 [0111.204] GetCurrentThreadId () returned 0xa94 [0111.204] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.204] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.204] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.225] GetLastError () returned 0x2 [0111.225] SRRemoveRestorePoint (dwRPNum=0x39) returned 0x2 [0111.226] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.226] GetCurrentThreadId () returned 0xa94 [0111.226] GetCurrentThreadId () returned 0xa94 [0111.227] GetCurrentThreadId () returned 0xa94 [0111.227] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.227] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.227] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.230] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.230] GetCurrentThreadId () returned 0xa94 [0111.230] GetCurrentThreadId () returned 0xa94 [0111.231] GetCurrentThreadId () returned 0xa94 [0111.231] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.231] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.231] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.251] GetLastError () returned 0x2 [0111.252] SRRemoveRestorePoint (dwRPNum=0x3a) returned 0x2 [0111.253] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.253] GetCurrentThreadId () returned 0xa94 [0111.253] GetCurrentThreadId () returned 0xa94 [0111.253] GetCurrentThreadId () returned 0xa94 [0111.253] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.253] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.253] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.257] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.257] GetCurrentThreadId () returned 0xa94 [0111.257] GetCurrentThreadId () returned 0xa94 [0111.257] GetCurrentThreadId () returned 0xa94 [0111.257] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.257] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.257] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.277] GetLastError () returned 0x2 [0111.277] SRRemoveRestorePoint (dwRPNum=0x3b) returned 0x2 [0111.278] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.279] GetCurrentThreadId () returned 0xa94 [0111.279] GetCurrentThreadId () returned 0xa94 [0111.279] GetCurrentThreadId () returned 0xa94 [0111.279] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.279] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.279] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.282] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.282] GetCurrentThreadId () returned 0xa94 [0111.283] GetCurrentThreadId () returned 0xa94 [0111.283] GetCurrentThreadId () returned 0xa94 [0111.283] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.283] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.283] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.312] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1f, dwPendingType=0x1) returned 0x2 [0111.312] GetCurrentThreadId () returned 0xa94 [0111.312] GetCurrentThreadId () returned 0xa94 [0111.312] GetCurrentThreadId () returned 0xa94 [0111.313] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.313] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.313] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0111.313] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.324] GetLastError () returned 0x2 [0111.324] SRRemoveRestorePoint (dwRPNum=0x3c) returned 0x2 [0111.325] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.325] GetCurrentThreadId () returned 0xa94 [0111.325] GetCurrentThreadId () returned 0xa94 [0111.325] GetCurrentThreadId () returned 0xa94 [0111.325] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.325] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.325] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.328] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.329] GetCurrentThreadId () returned 0xa94 [0111.329] GetCurrentThreadId () returned 0xa94 [0111.329] GetCurrentThreadId () returned 0xa94 [0111.329] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.329] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.329] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.363] GetLastError () returned 0x2 [0111.363] SRRemoveRestorePoint (dwRPNum=0x3d) returned 0x2 [0111.365] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.365] GetCurrentThreadId () returned 0xa94 [0111.365] GetCurrentThreadId () returned 0xa94 [0111.365] GetCurrentThreadId () returned 0xa94 [0111.365] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.365] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.365] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.369] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.369] GetCurrentThreadId () returned 0xa94 [0111.369] GetCurrentThreadId () returned 0xa94 [0111.369] GetCurrentThreadId () returned 0xa94 [0111.369] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.369] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.369] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.408] GetLastError () returned 0x2 [0111.408] SRRemoveRestorePoint (dwRPNum=0x3e) returned 0x2 [0111.409] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.410] GetCurrentThreadId () returned 0xa94 [0111.410] GetCurrentThreadId () returned 0xa94 [0111.410] GetCurrentThreadId () returned 0xa94 [0111.410] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.410] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.410] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0111.410] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.413] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.413] GetCurrentThreadId () returned 0xa94 [0111.413] GetCurrentThreadId () returned 0xa94 [0111.413] GetCurrentThreadId () returned 0xa94 [0111.413] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.413] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.413] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.468] GetLastError () returned 0x2 [0111.468] SRRemoveRestorePoint (dwRPNum=0x3f) returned 0x2 [0111.469] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.470] GetCurrentThreadId () returned 0xa94 [0111.470] GetCurrentThreadId () returned 0xa94 [0111.470] GetCurrentThreadId () returned 0xa94 [0111.470] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.470] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.470] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.472] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0111.472] GetCurrentThreadId () returned 0xa94 [0111.472] GetCurrentThreadId () returned 0xa94 [0111.472] GetCurrentThreadId () returned 0xa94 [0111.473] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.473] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.473] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0111.473] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.475] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.475] GetCurrentThreadId () returned 0xa94 [0111.475] GetCurrentThreadId () returned 0xa94 [0111.475] GetCurrentThreadId () returned 0xa94 [0111.476] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.476] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.476] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.498] GetLastError () returned 0x2 [0111.498] SRRemoveRestorePoint (dwRPNum=0x40) returned 0x2 [0111.499] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.499] GetCurrentThreadId () returned 0xa94 [0111.499] GetCurrentThreadId () returned 0xa94 [0111.499] GetCurrentThreadId () returned 0xa94 [0111.499] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.500] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.500] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.503] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.503] GetCurrentThreadId () returned 0xa94 [0111.503] GetCurrentThreadId () returned 0xa94 [0111.503] GetCurrentThreadId () returned 0xa94 [0111.503] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.503] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.503] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.542] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2e, dwPendingType=0x1) returned 0x2 [0111.542] GetCurrentThreadId () returned 0xa94 [0111.542] GetCurrentThreadId () returned 0xa94 [0111.542] GetCurrentThreadId () returned 0xa94 [0111.542] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.543] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.543] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0111.543] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.568] GetLastError () returned 0x2 [0111.568] SRRemoveRestorePoint (dwRPNum=0x41) returned 0x2 [0111.569] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.570] GetCurrentThreadId () returned 0xa94 [0111.570] GetCurrentThreadId () returned 0xa94 [0111.570] GetCurrentThreadId () returned 0xa94 [0111.570] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.570] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.570] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.573] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.573] GetCurrentThreadId () returned 0xa94 [0111.573] GetCurrentThreadId () returned 0xa94 [0111.573] GetCurrentThreadId () returned 0xa94 [0111.574] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.574] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.574] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.602] GetLastError () returned 0x2 [0111.602] SRRemoveRestorePoint (dwRPNum=0x42) returned 0x2 [0111.603] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.603] GetCurrentThreadId () returned 0xa94 [0111.604] GetCurrentThreadId () returned 0xa94 [0111.604] GetCurrentThreadId () returned 0xa94 [0111.604] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.604] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.604] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.609] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.609] GetCurrentThreadId () returned 0xa94 [0111.609] GetCurrentThreadId () returned 0xa94 [0111.609] GetCurrentThreadId () returned 0xa94 [0111.609] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.610] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.610] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.626] GetLastError () returned 0x2 [0111.626] SRRemoveRestorePoint (dwRPNum=0x43) returned 0x2 [0111.627] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.627] GetCurrentThreadId () returned 0xa94 [0111.627] GetCurrentThreadId () returned 0xa94 [0111.627] GetCurrentThreadId () returned 0xa94 [0111.627] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.627] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.627] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.642] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.642] GetCurrentThreadId () returned 0xa94 [0111.642] GetCurrentThreadId () returned 0xa94 [0111.642] GetCurrentThreadId () returned 0xa94 [0111.642] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.642] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.642] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.644] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0111.644] GetCurrentThreadId () returned 0xa94 [0111.644] GetCurrentThreadId () returned 0xa94 [0111.644] GetCurrentThreadId () returned 0xa94 [0111.644] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.644] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.644] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0111.644] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.686] GetLastError () returned 0x2 [0111.686] SRRemoveRestorePoint (dwRPNum=0x44) returned 0x2 [0111.687] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.687] GetCurrentThreadId () returned 0xa94 [0111.687] GetCurrentThreadId () returned 0xa94 [0111.687] GetCurrentThreadId () returned 0xa94 [0111.687] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.687] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.687] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.693] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.694] GetCurrentThreadId () returned 0xa94 [0111.694] GetCurrentThreadId () returned 0xa94 [0111.694] GetCurrentThreadId () returned 0xa94 [0111.694] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.694] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.694] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.719] GetLastError () returned 0x2 [0111.719] SRRemoveRestorePoint (dwRPNum=0x45) returned 0x2 [0111.720] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.720] GetCurrentThreadId () returned 0xa94 [0111.721] GetCurrentThreadId () returned 0xa94 [0111.721] GetCurrentThreadId () returned 0xa94 [0111.721] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.721] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.724] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.732] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.732] GetCurrentThreadId () returned 0xa94 [0111.732] GetCurrentThreadId () returned 0xa94 [0111.732] GetCurrentThreadId () returned 0xa94 [0111.732] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.732] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.733] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.750] GetLastError () returned 0x2 [0111.750] SRRemoveRestorePoint (dwRPNum=0x46) returned 0x2 [0111.751] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.751] GetCurrentThreadId () returned 0xa94 [0111.752] GetCurrentThreadId () returned 0xa94 [0111.752] GetCurrentThreadId () returned 0xa94 [0111.752] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.752] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.752] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.753] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0111.753] GetCurrentThreadId () returned 0xa94 [0111.753] GetCurrentThreadId () returned 0xa94 [0111.753] GetCurrentThreadId () returned 0xa94 [0111.753] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.753] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.753] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0111.753] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.756] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.756] GetCurrentThreadId () returned 0xa94 [0111.756] GetCurrentThreadId () returned 0xa94 [0111.756] GetCurrentThreadId () returned 0xa94 [0111.756] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.757] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.757] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.780] GetLastError () returned 0x2 [0111.780] SRRemoveRestorePoint (dwRPNum=0x47) returned 0x2 [0111.781] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.781] GetCurrentThreadId () returned 0xa94 [0111.781] GetCurrentThreadId () returned 0xa94 [0111.781] GetCurrentThreadId () returned 0xa94 [0111.782] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.782] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.782] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.784] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0111.784] GetCurrentThreadId () returned 0xa94 [0111.784] GetCurrentThreadId () returned 0xa94 [0111.785] GetCurrentThreadId () returned 0xa94 [0111.785] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.785] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.785] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0111.785] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.787] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.787] GetCurrentThreadId () returned 0xa94 [0111.787] GetCurrentThreadId () returned 0xa94 [0111.787] GetCurrentThreadId () returned 0xa94 [0111.787] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.787] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.787] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.805] GetLastError () returned 0x2 [0111.805] SRRemoveRestorePoint (dwRPNum=0x48) returned 0x2 [0111.806] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.806] GetCurrentThreadId () returned 0xa94 [0111.807] GetCurrentThreadId () returned 0xa94 [0111.807] GetCurrentThreadId () returned 0xa94 [0111.807] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.807] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.807] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.810] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.810] GetCurrentThreadId () returned 0xa94 [0111.810] GetCurrentThreadId () returned 0xa94 [0111.810] GetCurrentThreadId () returned 0xa94 [0111.810] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.810] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.811] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.862] GetLastError () returned 0x2 [0111.862] SRRemoveRestorePoint (dwRPNum=0x49) returned 0x2 [0111.863] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.863] GetCurrentThreadId () returned 0xa94 [0111.864] GetCurrentThreadId () returned 0xa94 [0111.864] GetCurrentThreadId () returned 0xa94 [0111.864] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.864] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.864] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.867] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.867] GetCurrentThreadId () returned 0xa94 [0111.867] GetCurrentThreadId () returned 0xa94 [0111.867] GetCurrentThreadId () returned 0xa94 [0111.867] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.867] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.867] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.878] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0111.878] GetCurrentThreadId () returned 0xa94 [0111.878] GetCurrentThreadId () returned 0xa94 [0111.878] GetCurrentThreadId () returned 0xa94 [0111.878] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.878] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.878] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0111.878] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.888] GetLastError () returned 0x2 [0111.888] SRRemoveRestorePoint (dwRPNum=0x4a) returned 0x2 [0111.889] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.889] GetCurrentThreadId () returned 0xa94 [0111.889] GetCurrentThreadId () returned 0xa94 [0111.890] GetCurrentThreadId () returned 0xa94 [0111.890] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.890] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.890] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.892] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.892] GetCurrentThreadId () returned 0xa94 [0111.893] GetCurrentThreadId () returned 0xa94 [0111.893] GetCurrentThreadId () returned 0xa94 [0111.893] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.893] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.893] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.909] GetLastError () returned 0x2 [0111.909] SRRemoveRestorePoint (dwRPNum=0x4b) returned 0x2 [0111.910] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.910] GetCurrentThreadId () returned 0xa94 [0111.911] GetCurrentThreadId () returned 0xa94 [0111.911] GetCurrentThreadId () returned 0xa94 [0111.911] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.911] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.911] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.914] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.914] GetCurrentThreadId () returned 0xa94 [0111.914] GetCurrentThreadId () returned 0xa94 [0111.914] GetCurrentThreadId () returned 0xa94 [0111.914] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.915] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.915] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.948] GetLastError () returned 0x2 [0111.948] SRRemoveRestorePoint (dwRPNum=0x4c) returned 0x2 [0111.950] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.950] GetCurrentThreadId () returned 0xa94 [0111.950] GetCurrentThreadId () returned 0xa94 [0111.950] GetCurrentThreadId () returned 0xa94 [0111.950] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.951] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.951] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.955] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0111.956] GetCurrentThreadId () returned 0xa94 [0111.956] GetCurrentThreadId () returned 0xa94 [0111.956] GetCurrentThreadId () returned 0xa94 [0111.956] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.956] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.956] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.979] GetLastError () returned 0x2 [0111.979] SRRemoveRestorePoint (dwRPNum=0x4d) returned 0x2 [0111.981] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.981] GetCurrentThreadId () returned 0xa94 [0111.981] GetCurrentThreadId () returned 0xa94 [0111.981] GetCurrentThreadId () returned 0xa94 [0111.981] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.981] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.981] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0111.985] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0111.985] GetCurrentThreadId () returned 0xa94 [0111.985] GetCurrentThreadId () returned 0xa94 [0111.985] GetCurrentThreadId () returned 0xa94 [0111.985] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.985] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.985] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.987] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xf, dwPendingType=0x1) returned 0x2 [0111.987] GetCurrentThreadId () returned 0xa94 [0111.987] GetCurrentThreadId () returned 0xa94 [0111.987] GetCurrentThreadId () returned 0xa94 [0111.987] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.988] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0111.988] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0111.988] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.015] GetLastError () returned 0x2 [0112.015] SRRemoveRestorePoint (dwRPNum=0x4e) returned 0x2 [0112.016] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.016] GetCurrentThreadId () returned 0xa94 [0112.016] GetCurrentThreadId () returned 0xa94 [0112.016] GetCurrentThreadId () returned 0xa94 [0112.016] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.016] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.016] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.019] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.020] GetCurrentThreadId () returned 0xa94 [0112.020] GetCurrentThreadId () returned 0xa94 [0112.020] GetCurrentThreadId () returned 0xa94 [0112.020] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.020] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.020] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.037] GetLastError () returned 0x2 [0112.037] SRRemoveRestorePoint (dwRPNum=0x4f) returned 0x2 [0112.038] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.038] GetCurrentThreadId () returned 0xa94 [0112.039] GetCurrentThreadId () returned 0xa94 [0112.039] GetCurrentThreadId () returned 0xa94 [0112.039] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.039] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.039] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.042] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.042] GetCurrentThreadId () returned 0xa94 [0112.042] GetCurrentThreadId () returned 0xa94 [0112.042] GetCurrentThreadId () returned 0xa94 [0112.042] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.042] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.042] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.062] GetLastError () returned 0x2 [0112.062] SRRemoveRestorePoint (dwRPNum=0x50) returned 0x2 [0112.063] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.063] GetCurrentThreadId () returned 0xa94 [0112.063] GetCurrentThreadId () returned 0xa94 [0112.063] GetCurrentThreadId () returned 0xa94 [0112.063] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.064] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.064] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.067] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.067] GetCurrentThreadId () returned 0xa94 [0112.067] GetCurrentThreadId () returned 0xa94 [0112.067] GetCurrentThreadId () returned 0xa94 [0112.067] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.068] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.068] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.087] GetLastError () returned 0x2 [0112.087] SRRemoveRestorePoint (dwRPNum=0x51) returned 0x2 [0112.088] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.088] GetCurrentThreadId () returned 0xa94 [0112.088] GetCurrentThreadId () returned 0xa94 [0112.088] GetCurrentThreadId () returned 0xa94 [0112.088] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.088] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.088] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.091] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.091] GetCurrentThreadId () returned 0xa94 [0112.092] GetCurrentThreadId () returned 0xa94 [0112.092] GetCurrentThreadId () returned 0xa94 [0112.092] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.092] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.092] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.096] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xf, dwPendingType=0x1) returned 0x2 [0112.096] GetCurrentThreadId () returned 0xa94 [0112.096] GetCurrentThreadId () returned 0xa94 [0112.096] GetCurrentThreadId () returned 0xa94 [0112.096] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.097] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.097] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0112.097] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.112] GetLastError () returned 0x2 [0112.112] SRRemoveRestorePoint (dwRPNum=0x52) returned 0x2 [0112.113] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.113] GetCurrentThreadId () returned 0xa94 [0112.114] GetCurrentThreadId () returned 0xa94 [0112.114] GetCurrentThreadId () returned 0xa94 [0112.114] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.114] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.114] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 1 [0112.114] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.118] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.118] GetCurrentThreadId () returned 0xa94 [0112.118] GetCurrentThreadId () returned 0xa94 [0112.118] GetCurrentThreadId () returned 0xa94 [0112.118] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.119] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.119] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.140] GetLastError () returned 0x2 [0112.140] SRRemoveRestorePoint (dwRPNum=0x53) returned 0x2 [0112.141] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.141] GetCurrentThreadId () returned 0xa94 [0112.141] GetCurrentThreadId () returned 0xa94 [0112.142] GetCurrentThreadId () returned 0xa94 [0112.142] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.142] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.142] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.145] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.145] GetCurrentThreadId () returned 0xa94 [0112.145] GetCurrentThreadId () returned 0xa94 [0112.145] GetCurrentThreadId () returned 0xa94 [0112.145] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.146] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.146] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.165] GetLastError () returned 0x2 [0112.165] SRRemoveRestorePoint (dwRPNum=0x54) returned 0x2 [0112.166] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.166] GetCurrentThreadId () returned 0xa94 [0112.166] GetCurrentThreadId () returned 0xa94 [0112.166] GetCurrentThreadId () returned 0xa94 [0112.167] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.167] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.167] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.174] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xf, dwPendingType=0x1) returned 0x2 [0112.174] GetCurrentThreadId () returned 0xa94 [0112.174] GetCurrentThreadId () returned 0xa94 [0112.174] GetCurrentThreadId () returned 0xa94 [0112.174] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.174] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.174] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.197] GetLastError () returned 0x2 [0112.197] SRRemoveRestorePoint (dwRPNum=0x55) returned 0x2 [0112.199] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.199] GetCurrentThreadId () returned 0xa94 [0112.199] GetCurrentThreadId () returned 0xa94 [0112.199] GetCurrentThreadId () returned 0xa94 [0112.200] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.200] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.200] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.204] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.205] GetCurrentThreadId () returned 0xa94 [0112.205] GetCurrentThreadId () returned 0xa94 [0112.205] GetCurrentThreadId () returned 0xa94 [0112.205] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.206] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.206] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0112.206] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.229] GetLastError () returned 0x2 [0112.229] SRRemoveRestorePoint (dwRPNum=0x56) returned 0x2 [0112.231] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.231] GetCurrentThreadId () returned 0xa94 [0112.231] GetCurrentThreadId () returned 0xa94 [0112.231] GetCurrentThreadId () returned 0xa94 [0112.231] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.232] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.232] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.235] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.235] GetCurrentThreadId () returned 0xa94 [0112.236] GetCurrentThreadId () returned 0xa94 [0112.236] GetCurrentThreadId () returned 0xa94 [0112.236] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.236] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.236] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.263] GetLastError () returned 0x2 [0112.263] SRRemoveRestorePoint (dwRPNum=0x57) returned 0x2 [0112.265] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.265] GetCurrentThreadId () returned 0xa94 [0112.265] GetCurrentThreadId () returned 0xa94 [0112.265] GetCurrentThreadId () returned 0xa94 [0112.265] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.266] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.266] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.269] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.269] GetCurrentThreadId () returned 0xa94 [0112.270] GetCurrentThreadId () returned 0xa94 [0112.270] GetCurrentThreadId () returned 0xa94 [0112.270] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.270] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.270] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.292] GetLastError () returned 0x2 [0112.292] SRRemoveRestorePoint (dwRPNum=0x58) returned 0x2 [0112.293] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.294] GetCurrentThreadId () returned 0xa94 [0112.294] GetCurrentThreadId () returned 0xa94 [0112.294] GetCurrentThreadId () returned 0xa94 [0112.294] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.294] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.294] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.298] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.298] GetCurrentThreadId () returned 0xa94 [0112.298] GetCurrentThreadId () returned 0xa94 [0112.298] GetCurrentThreadId () returned 0xa94 [0112.298] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.298] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.298] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.314] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1f, dwPendingType=0x1) returned 0x2 [0112.315] GetCurrentThreadId () returned 0xa94 [0112.315] GetCurrentThreadId () returned 0xa94 [0112.315] GetCurrentThreadId () returned 0xa94 [0112.315] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.316] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.316] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0112.316] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.321] GetLastError () returned 0x2 [0112.321] SRRemoveRestorePoint (dwRPNum=0x59) returned 0x2 [0112.334] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xf, dwPendingType=0x1) returned 0x2 [0112.334] GetCurrentThreadId () returned 0xa94 [0112.335] GetCurrentThreadId () returned 0xa94 [0112.335] GetCurrentThreadId () returned 0xa94 [0112.335] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.335] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.336] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.353] GetLastError () returned 0x2 [0112.354] SRRemoveRestorePoint (dwRPNum=0x5a) returned 0x2 [0112.355] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.356] GetCurrentThreadId () returned 0xa94 [0112.356] GetCurrentThreadId () returned 0xa94 [0112.356] GetCurrentThreadId () returned 0xa94 [0112.356] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.356] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.356] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.360] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.360] GetCurrentThreadId () returned 0xa94 [0112.360] GetCurrentThreadId () returned 0xa94 [0112.360] GetCurrentThreadId () returned 0xa94 [0112.361] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.361] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.361] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.382] GetLastError () returned 0x2 [0112.382] SRRemoveRestorePoint (dwRPNum=0x5b) returned 0x2 [0112.383] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.383] GetCurrentThreadId () returned 0xa94 [0112.383] GetCurrentThreadId () returned 0xa94 [0112.383] GetCurrentThreadId () returned 0xa94 [0112.383] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.383] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.383] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.386] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.386] GetCurrentThreadId () returned 0xa94 [0112.386] GetCurrentThreadId () returned 0xa94 [0112.386] GetCurrentThreadId () returned 0xa94 [0112.387] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.387] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.387] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.407] GetLastError () returned 0x2 [0112.408] SRRemoveRestorePoint (dwRPNum=0x5c) returned 0x2 [0112.409] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.409] GetCurrentThreadId () returned 0xa94 [0112.409] GetCurrentThreadId () returned 0xa94 [0112.409] GetCurrentThreadId () returned 0xa94 [0112.409] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.409] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.409] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.413] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.413] GetCurrentThreadId () returned 0xa94 [0112.413] GetCurrentThreadId () returned 0xa94 [0112.413] GetCurrentThreadId () returned 0xa94 [0112.413] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.414] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.414] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.424] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0112.424] GetCurrentThreadId () returned 0xa94 [0112.424] GetCurrentThreadId () returned 0xa94 [0112.424] GetCurrentThreadId () returned 0xa94 [0112.424] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.424] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.424] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0112.424] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0112.424] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.436] GetLastError () returned 0x2 [0112.436] SRRemoveRestorePoint (dwRPNum=0x5d) returned 0x2 [0112.437] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.437] GetCurrentThreadId () returned 0xa94 [0112.437] GetCurrentThreadId () returned 0xa94 [0112.437] GetCurrentThreadId () returned 0xa94 [0112.438] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.438] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.438] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.441] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.441] GetCurrentThreadId () returned 0xa94 [0112.441] GetCurrentThreadId () returned 0xa94 [0112.442] GetCurrentThreadId () returned 0xa94 [0112.442] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.442] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.442] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.467] GetLastError () returned 0x2 [0112.467] SRRemoveRestorePoint (dwRPNum=0x5e) returned 0x2 [0112.469] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.469] GetCurrentThreadId () returned 0xa94 [0112.469] GetCurrentThreadId () returned 0xa94 [0112.470] GetCurrentThreadId () returned 0xa94 [0112.470] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.470] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.470] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.475] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.475] GetCurrentThreadId () returned 0xa94 [0112.475] GetCurrentThreadId () returned 0xa94 [0112.475] GetCurrentThreadId () returned 0xa94 [0112.476] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.476] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.476] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.499] GetLastError () returned 0x2 [0112.500] SRRemoveRestorePoint (dwRPNum=0x5f) returned 0x2 [0112.501] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.501] GetCurrentThreadId () returned 0xa94 [0112.501] GetCurrentThreadId () returned 0xa94 [0112.502] GetCurrentThreadId () returned 0xa94 [0112.502] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.502] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.502] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.506] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.506] GetCurrentThreadId () returned 0xa94 [0112.506] GetCurrentThreadId () returned 0xa94 [0112.506] GetCurrentThreadId () returned 0xa94 [0112.506] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.507] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.507] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.523] GetLastError () returned 0x2 [0112.523] SRRemoveRestorePoint (dwRPNum=0x60) returned 0x2 [0112.524] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.524] GetCurrentThreadId () returned 0xa94 [0112.525] GetCurrentThreadId () returned 0xa94 [0112.525] GetCurrentThreadId () returned 0xa94 [0112.525] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.525] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.525] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.528] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.528] GetCurrentThreadId () returned 0xa94 [0112.528] GetCurrentThreadId () returned 0xa94 [0112.528] GetCurrentThreadId () returned 0xa94 [0112.528] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.528] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.528] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.533] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xf, dwPendingType=0x1) returned 0x2 [0112.533] GetCurrentThreadId () returned 0xa94 [0112.533] GetCurrentThreadId () returned 0xa94 [0112.533] GetCurrentThreadId () returned 0xa94 [0112.534] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.534] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.534] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0112.534] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.550] GetLastError () returned 0x2 [0112.550] SRRemoveRestorePoint (dwRPNum=0x61) returned 0x2 [0112.551] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.551] GetCurrentThreadId () returned 0xa94 [0112.552] GetCurrentThreadId () returned 0xa94 [0112.552] GetCurrentThreadId () returned 0xa94 [0112.552] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.553] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.553] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.556] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.556] GetCurrentThreadId () returned 0xa94 [0112.557] GetCurrentThreadId () returned 0xa94 [0112.557] GetCurrentThreadId () returned 0xa94 [0112.557] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.558] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.558] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.583] GetLastError () returned 0x2 [0112.583] SRRemoveRestorePoint (dwRPNum=0x62) returned 0x2 [0112.585] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.585] GetCurrentThreadId () returned 0xa94 [0112.585] GetCurrentThreadId () returned 0xa94 [0112.585] GetCurrentThreadId () returned 0xa94 [0112.586] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.586] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.586] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.589] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.589] GetCurrentThreadId () returned 0xa94 [0112.590] GetCurrentThreadId () returned 0xa94 [0112.590] GetCurrentThreadId () returned 0xa94 [0112.590] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.590] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.590] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.614] GetLastError () returned 0x2 [0112.614] SRRemoveRestorePoint (dwRPNum=0x63) returned 0x2 [0112.616] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.616] GetCurrentThreadId () returned 0xa94 [0112.616] GetCurrentThreadId () returned 0xa94 [0112.617] GetCurrentThreadId () returned 0xa94 [0112.617] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.617] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.617] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.621] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.621] GetCurrentThreadId () returned 0xa94 [0112.621] GetCurrentThreadId () returned 0xa94 [0112.622] GetCurrentThreadId () returned 0xa94 [0112.622] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.622] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.622] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.642] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x1f, dwPendingType=0x1) returned 0x2 [0112.642] GetCurrentThreadId () returned 0xa94 [0112.642] GetCurrentThreadId () returned 0xa94 [0112.643] GetCurrentThreadId () returned 0xa94 [0112.643] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.643] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.643] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 1 [0112.644] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.646] GetLastError () returned 0x2 [0112.646] SRRemoveRestorePoint (dwRPNum=0x64) returned 0x2 [0112.647] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.647] GetCurrentThreadId () returned 0xa94 [0112.647] GetCurrentThreadId () returned 0xa94 [0112.647] GetCurrentThreadId () returned 0xa94 [0112.648] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.648] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.648] PeekMessageA (in: lpMsg=0x18d928, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d928) returned 0 [0112.656] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.656] GetCurrentThreadId () returned 0xa94 [0112.656] GetCurrentThreadId () returned 0xa94 [0112.657] GetCurrentThreadId () returned 0xa94 [0112.657] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.657] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.657] PeekMessageA (in: lpMsg=0x18e4cc, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e4cc) returned 0 [0112.686] GetLastError () returned 0x2 [0112.687] CreateBindCtx (in: reserved=0x0, ppbc=0x18ec40 | out: ppbc=0x18ec40*=0x4fed030) returned 0x0 [0112.688] MkParseDisplayName (in: pbc=0x4fed030, szUserName="winmgmts:", pchEaten=0x18ec3c, ppmk=0x18ec44 | out: pchEaten=0x18ec3c, ppmk=0x18ec44*=0x2fd640) returned 0x0 [0112.690] DllGetClassObject (in: rclsid=0x342cac*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x7666f084*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb94 | out: ppv=0x18eb94*=0x0) returned 0x80004002 [0112.690] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeb458 [0112.690] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.690] DllGetClassObject (in: rclsid=0x342cac*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x7666ee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ea18 | out: ppv=0x18ea18*=0x4aeb458) returned 0x0 [0112.690] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeb458 [0112.691] WinMGMTS:IClassFactory:CreateInstance (in: This=0x4aeb458, pUnkOuter=0x0, riid=0x7666f084*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9c4 | out: ppvObject=0x18e9c4*=0x4ae0810) returned 0x0 [0112.691] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0810 [0112.692] WinMGMTS:IUnknown:Release (This=0x4aeb458) returned 0x0 [0112.692] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.692] WinMGMTS:IParseDisplayName:ParseDisplayName (in: This=0x4ae0810, pbc=0x4fed030, pszDisplayName="winmgmts:", pchEaten=0x18ebdc, ppmkOut=0x18ebe0 | out: pchEaten=0x18ebdc*=0x9, ppmkOut=0x18ebe0*=0x2fd640) returned 0x0 [0112.692] _wcsnicmp (_String1="winmgmts:", _String2="WINMGMTS:", _MaxCount=0x9) returned 0 [0112.693] IBindCtx:GetObjectParam (in: This=0x4fed030, pszKey="WmiObject", ppunk=0x18eae4 | out: ppunk=0x18eae4*=0x0) returned 0x80004005 [0112.693] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece58 [0112.693] _wcsnicmp (_String1="", _String2="{", _MaxCount=0x1) returned -123 [0112.693] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aecdc0 [0112.693] CoCreateInstance (in: rclsid=0x753e42b0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x753e42a0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x4aecdd8 | out: ppv=0x4aecdd8*=0x4aece28) returned 0x0 [0112.695] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0850 [0112.695] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae08b8 [0112.695] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece78 [0112.695] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0112.695] GetCurrentThreadId () returned 0xa94 [0112.696] _wcsnicmp (_String1="", _String2="[", _MaxCount=0x1) returned -91 [0112.696] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0112.696] GetCurrentThreadId () returned 0xa94 [0112.696] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x18e9cc | out: phkResult=0x18e9cc*=0x1dc) returned 0x0 [0112.697] RegQueryValueExW (in: hKey=0x1dc, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x18e9d4*=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x18e9d4*=0x16) returned 0x0 [0112.697] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0112.697] RegQueryValueExW (in: hKey=0x1dc, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x4aeceb8, lpcbData=0x18e9d4*=0x16 | out: lpType=0x0, lpData=0x4aeceb8*=0x72, lpcbData=0x18e9d4*=0x16) returned 0x0 [0112.697] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece98 [0112.697] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.697] RegCloseKey (hKey=0x1dc) returned 0x0 [0112.697] CoCreateInstance (in: rclsid=0x753e53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x753e50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x18ea00 | out: ppv=0x18ea00*=0x4ae0918) returned 0x0 [0112.699] SysStringLen (param_1=".") returned 0x1 [0112.699] WbemDefPath:IWbemPath:SetServer (This=0x4ae0918, Name=".") returned 0x0 [0112.699] CoCreateInstance (in: rclsid=0x753e53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x753e50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x18e9b8 | out: ppv=0x18e9b8*=0x4ae09b0) returned 0x0 [0112.700] CoCreateInstance (in: rclsid=0x753e53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x753e50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x18e95c | out: ppv=0x18e95c*=0x4ae0a48) returned 0x0 [0112.700] WbemDefPath:IWbemPath:SetText (This=0x4ae0a48, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0112.700] WbemDefPath:IUnknown:Release (This=0x4ae0a48) returned 0x0 [0112.700] SysStringLen (param_1="root\\cimv2") returned 0xa [0112.701] WbemDefPath:IWbemPath:SetText (This=0x4ae09b0, uMode=0xc, pszPath="root\\cimv2") returned 0x0 [0112.701] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4ae09b0, puCount=0x18e9c8 | out: puCount=0x18e9c8*=0x2) returned 0x0 [0112.701] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x4ae0918) returned 0x0 [0112.701] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4ae09b0, uIndex=0x0, puNameBufLength=0x18e990*=0x0, pName=0x0 | out: puNameBufLength=0x18e990*=0x5, pName=0x0) returned 0x0 [0112.701] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeb530 [0112.701] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4ae09b0, uIndex=0x0, puNameBufLength=0x18e990*=0x5, pName="\x17⯀막䶗㖰" | out: puNameBufLength=0x18e990*=0x5, pName="root") returned 0x0 [0112.701] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.701] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4ae0918, uIndex=0x0, pszName="root") returned 0x0 [0112.702] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4ae09b0, uIndex=0x1, puNameBufLength=0x18e990*=0x0, pName=0x0 | out: puNameBufLength=0x18e990*=0x6, pName=0x0) returned 0x0 [0112.702] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeb500 [0112.702] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4ae09b0, uIndex=0x1, puNameBufLength=0x18e990*=0x6, pName="\x0boot" | out: puNameBufLength=0x18e990*=0x6, pName="cimv2") returned 0x0 [0112.702] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.702] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4ae0918, uIndex=0x1, pszName="cimv2") returned 0x0 [0112.702] WbemDefPath:IUnknown:Release (This=0x4ae09b0) returned 0x0 [0112.703] WbemDefPath:IWbemPath:GetText (in: This=0x4ae0918, lFlags=4, puBuffLength=0x18e9e4*=0x0, pszText=0x0 | out: puBuffLength=0x18e9e4*=0xf, pszText=0x0) returned 0x0 [0112.703] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0112.703] WbemDefPath:IWbemPath:GetText (in: This=0x4ae0918, lFlags=4, puBuffLength=0x18e9e4*=0xf, pszText="রҮநҮ2" | out: puBuffLength=0x18e9e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0112.703] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.703] WbemDefPath:IUnknown:Release (This=0x4ae0918) returned 0x0 [0112.703] WbemLocator:IWbemLocator:ConnectServer (in: This=0x4aece28, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x18ea6c | out: ppNamespace=0x18ea6c*=0x4ae0a04) returned 0x0 [0112.705] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.706] GetCurrentThreadId () returned 0xa94 [0112.706] GetCurrentThreadId () returned 0xa94 [0112.706] GetCurrentThreadId () returned 0xa94 [0112.706] PeekMessageA (in: lpMsg=0x18d538, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d538) returned 0 [0112.706] PeekMessageA (in: lpMsg=0x18d538, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d538) returned 0 [0112.707] PeekMessageA (in: lpMsg=0x18d538, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d538) returned 0 [0112.712] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.712] GetCurrentThreadId () returned 0xa94 [0112.713] GetCurrentThreadId () returned 0xa94 [0112.713] GetCurrentThreadId () returned 0xa94 [0112.713] PeekMessageA (in: lpMsg=0x18df58, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18df58) returned 0 [0112.713] PeekMessageA (in: lpMsg=0x18df58, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18df58) returned 0 [0112.713] PeekMessageA (in: lpMsg=0x18df58, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18df58) returned 0 [0112.714] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.714] GetCurrentThreadId () returned 0xa94 [0112.715] GetCurrentThreadId () returned 0xa94 [0112.715] GetCurrentThreadId () returned 0xa94 [0112.715] PeekMessageA (in: lpMsg=0x18e0a8, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e0a8) returned 0 [0112.715] PeekMessageA (in: lpMsg=0x18e0a8, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e0a8) returned 0 [0112.715] PeekMessageA (in: lpMsg=0x18e0a8, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e0a8) returned 0 [0112.718] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.718] GetCurrentThreadId () returned 0xa94 [0112.718] GetCurrentThreadId () returned 0xa94 [0112.718] GetCurrentThreadId () returned 0xa94 [0112.718] PeekMessageA (in: lpMsg=0x18e118, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e118) returned 0 [0112.718] PeekMessageA (in: lpMsg=0x18e118, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e118) returned 0 [0112.719] PeekMessageA (in: lpMsg=0x18e118, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e118) returned 0 [0112.719] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.720] GetCurrentThreadId () returned 0xa94 [0112.725] GetCurrentThreadId () returned 0xa94 [0112.725] GetCurrentThreadId () returned 0xa94 [0112.725] PeekMessageA (in: lpMsg=0x18e110, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e110) returned 0 [0112.725] PeekMessageA (in: lpMsg=0x18e110, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e110) returned 0 [0112.725] PeekMessageA (in: lpMsg=0x18e110, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e110) returned 0 [0112.728] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0918 [0112.728] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0a18 [0112.728] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0a78 [0112.728] WbemLocator:IUnknown:QueryInterface (in: This=0x4ae0a04, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e93c | out: ppvObject=0x18e93c*=0x4ff004c) returned 0x0 [0112.729] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4ff004c, pProxy=0x4ae0a04, pAuthnSvc=0x18e92c, pAuthzSvc=0x18e930, pServerPrincName=0x0, pAuthnLevel=0x18e958, pImpLevel=0x18e954, pAuthInfo=0x0, pCapabilites=0x18e944 | out: pAuthnSvc=0x18e92c*=0xa, pAuthzSvc=0x18e930*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18e958*=0x6, pImpLevel=0x18e954*=0x2, pAuthInfo=0x0, pCapabilites=0x18e944*=0x1) returned 0x0 [0112.729] WbemLocator:IUnknown:Release (This=0x4ff004c) returned 0x1 [0112.729] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0112.729] GetCurrentThreadId () returned 0xa94 [0112.729] WbemLocator:IUnknown:QueryInterface (in: This=0x4ae0a04, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e96c | out: ppvObject=0x18e96c*=0x4ff004c) returned 0x0 [0112.729] WbemLocator:IClientSecurity:CopyProxy (in: This=0x4ff004c, pProxy=0x4ae0a04, ppCopy=0x18e970 | out: ppCopy=0x18e970*=0x4aed684) returned 0x0 [0112.729] WbemLocator:IUnknown:QueryInterface (in: This=0x4aed684, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e888 | out: ppvObject=0x18e888*=0x4ff004c) returned 0x0 [0112.729] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4ff004c, pProxy=0x4aed684, pAuthnSvc=0x18e8ac, pAuthzSvc=0x18e89c, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x18e8ac*=0xa, pAuthzSvc=0x18e89c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0112.729] WbemLocator:IUnknown:Release (This=0x4ff004c) returned 0x3 [0112.729] WbemLocator:IUnknown:QueryInterface (in: This=0x4aed684, riid=0x753e34f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e860 | out: ppvObject=0x18e860*=0x4ff006c) returned 0x0 [0112.729] WbemLocator:IUnknown:QueryInterface (in: This=0x4aed684, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e864 | out: ppvObject=0x18e864*=0x4ff004c) returned 0x0 [0112.729] WbemLocator:IClientSecurity:SetBlanket (This=0x4ff004c, pProxy=0x4aed684, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0112.730] WbemLocator:IUnknown:Release (This=0x4ff004c) returned 0x4 [0112.730] WbemLocator:IUnknown:Release (This=0x4ff006c) returned 0x3 [0112.730] WbemLocator:IUnknown:Release (This=0x4ff004c) returned 0x2 [0112.730] WbemLocator:IUnknown:AddRef (This=0x4aed684) returned 0x3 [0112.730] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aed698 [0112.730] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeced8 [0112.730] WbemLocator:IUnknown:Release (This=0x4ae0a04) returned 0x2 [0112.730] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0112.730] GetCurrentThreadId () returned 0xa94 [0112.730] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0112.731] GetCurrentThreadId () returned 0xa94 [0112.731] WbemLocator:IUnknown:QueryInterface (in: This=0x4aed684, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea30 | out: ppvObject=0x18ea30*=0x4ff004c) returned 0x0 [0112.731] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4ff004c, pProxy=0x4aed684, pAuthnSvc=0x18ea20, pAuthzSvc=0x18ea24, pServerPrincName=0x0, pAuthnLevel=0x18ea50, pImpLevel=0x18ea54, pAuthInfo=0x0, pCapabilites=0x18ea38 | out: pAuthnSvc=0x18ea20*=0xa, pAuthzSvc=0x18ea24*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ea50*=0x6, pImpLevel=0x18ea54*=0x3, pAuthInfo=0x0, pCapabilites=0x18ea38*=0x20) returned 0x0 [0112.731] WbemLocator:IUnknown:Release (This=0x4ff004c) returned 0x2 [0112.731] CreatePointerMoniker (in: punk=0x4ae0918, ppmk=0x18ebe0 | out: ppmk=0x18ebe0*=0x2fd640) returned 0x0 [0112.731] IUnknown:AddRef (This=0x4ae0918) returned 0x2 [0112.731] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.731] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.731] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.731] WbemLocator:IUnknown:Release (This=0x4aece28) returned 0x0 [0112.731] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.732] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.732] WinMGMTS:IUnknown:Release (This=0x4ae0810) returned 0x0 [0112.732] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.732] IUnknown:Release (This=0x4fed030) returned 0x0 [0112.732] BindMoniker (in: pmk=0x2fd640, grfOpt=0x0, iidResult=0x7295a460*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvResult=0x18ec58 | out: ppvResult=0x18ec58*=0x4ae0918) returned 0x0 [0112.732] IUnknown:QueryInterface (in: This=0x4ae0918, riid=0x7295a460*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec58 | out: ppvObject=0x18ec58*=0x4ae0918) returned 0x0 [0112.732] IUnknown:Release (This=0x2fd640) returned 0x0 [0112.732] IUnknown:Release (This=0x4ae0918) returned 0x1 [0112.734] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18eb8c*=0x0 | out: pptlib=0x18eb8c*=0x4ff0410) returned 0x0 [0112.739] ITypeLib:GetTypeInfoOfGuid (in: This=0x4ff0410, GUID=0x4ae094c*(Data1=0xd2f68443, Data2=0x85dc, Data3=0x427e, Data4=([0]=0x91, [1]=0xd8, [2]=0x36, [3]=0x65, [4]=0x54, [5]=0xcc, [6]=0x75, [7]=0x4c)), ppTInfo=0x4ae0940 | out: ppTInfo=0x4ae0940*=0x4ffa63c) returned 0x0 [0112.739] IUnknown:Release (This=0x4ff0410) returned 0x1 [0112.739] IUnknown:AddRef (This=0x4ffa63c) returned 0x2 [0112.739] DispGetIDsOfNames (in: ptinfo=0x4ffa63c, rgszNames=0x18ebe8*="ExecQuery", cNames=0x1, rgdispid=0x18ebec | out: rgdispid=0x18ebec*=9) returned 0x0 [0112.740] IUnknown:Release (This=0x4ffa63c) returned 0x1 [0112.740] IUnknown:AddRef (This=0x4ffa63c) returned 0x2 [0112.740] ITypeInfo:LocalInvoke (This=0x4ffa63c) returned 0x0 [0112.740] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0112.740] GetCurrentThreadId () returned 0xa94 [0112.740] WbemLocator:IUnknown:AddRef (This=0x4aed684) returned 0x3 [0112.740] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0112.740] GetCurrentThreadId () returned 0xa94 [0112.741] IWbemServices:ExecQuery (in: This=0x4aed684, strQueryLanguage="WQL", strQuery="SELECT Name FROM Win32_Process WHERE Name='ccSvcHst.exe'", lFlags=272, pCtx=0x0, ppEnum=0x18e95c | out: ppEnum=0x18e95c*=0x4ae08dc) returned 0x0 [0112.741] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.741] GetCurrentThreadId () returned 0xa94 [0112.741] GetCurrentThreadId () returned 0xa94 [0112.741] GetCurrentThreadId () returned 0xa94 [0112.741] PeekMessageA (in: lpMsg=0x18e15c, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e15c) returned 0 [0112.741] PeekMessageA (in: lpMsg=0x18e15c, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e15c) returned 0 [0112.742] PeekMessageA (in: lpMsg=0x18e15c, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e15c) returned 1 [0112.742] PeekMessageA (in: lpMsg=0x18e15c, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e15c) returned 0 [0112.745] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aecdc0 [0112.745] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aed6f8 [0112.746] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aed758 [0112.746] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece58 [0112.746] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aed7b8 [0112.746] IUnknown:QueryInterface (in: This=0x4ae08dc, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e874 | out: ppvObject=0x18e874*=0x4ae08e0) returned 0x0 [0112.746] IClientSecurity:QueryBlanket (in: This=0x4ae08e0, pProxy=0x4ae08dc, pAuthnSvc=0x18e864, pAuthzSvc=0x18e868, pServerPrincName=0x0, pAuthnLevel=0x18e890, pImpLevel=0x18e88c, pAuthInfo=0x0, pCapabilites=0x18e87c | out: pAuthnSvc=0x18e864*=0xa, pAuthzSvc=0x18e868*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18e890*=0x6, pImpLevel=0x18e88c*=0x2, pAuthInfo=0x0, pCapabilites=0x18e87c*=0x1) returned 0x0 [0112.746] IUnknown:Release (This=0x4ae08e0) returned 0x1 [0112.746] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0112.747] GetCurrentThreadId () returned 0xa94 [0112.747] WbemLocator:IUnknown:QueryInterface (in: This=0x4aed684, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e858 | out: ppvObject=0x18e858*=0x4ff004c) returned 0x0 [0112.747] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4ff004c, pProxy=0x4aed684, pAuthnSvc=0x18e848, pAuthzSvc=0x18e84c, pServerPrincName=0x0, pAuthnLevel=0x18e878, pImpLevel=0x18e87c, pAuthInfo=0x0, pCapabilites=0x18e860 | out: pAuthnSvc=0x18e848*=0xa, pAuthzSvc=0x18e84c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18e878*=0x6, pImpLevel=0x18e87c*=0x3, pAuthInfo=0x0, pCapabilites=0x18e860*=0x20) returned 0x0 [0112.747] WbemLocator:IUnknown:Release (This=0x4ff004c) returned 0x3 [0112.747] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0112.747] GetCurrentThreadId () returned 0xa94 [0112.747] WbemLocator:IUnknown:QueryInterface (in: This=0x4aed684, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e858 | out: ppvObject=0x18e858*=0x4ff004c) returned 0x0 [0112.748] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4ff004c, pProxy=0x4aed684, pAuthnSvc=0x18e848, pAuthzSvc=0x18e84c, pServerPrincName=0x0, pAuthnLevel=0x18e87c, pImpLevel=0x18e878, pAuthInfo=0x0, pCapabilites=0x18e860 | out: pAuthnSvc=0x18e848*=0xa, pAuthzSvc=0x18e84c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18e87c*=0x6, pImpLevel=0x18e878*=0x3, pAuthInfo=0x0, pCapabilites=0x18e860*=0x20) returned 0x0 [0112.748] WbemLocator:IUnknown:Release (This=0x4ff004c) returned 0x3 [0112.748] IUnknown:QueryInterface (in: This=0x4ae08dc, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e8a4 | out: ppvObject=0x18e8a4*=0x4ae08e0) returned 0x0 [0112.748] IClientSecurity:CopyProxy (in: This=0x4ae08e0, pProxy=0x4ae08dc, ppCopy=0x18e8a8 | out: ppCopy=0x18e8a8*=0x4aed8fc) returned 0x0 [0112.748] IUnknown:QueryInterface (in: This=0x4aed8fc, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e7c0 | out: ppvObject=0x18e7c0*=0x4aed900) returned 0x0 [0112.748] IClientSecurity:QueryBlanket (in: This=0x4aed900, pProxy=0x4aed8fc, pAuthnSvc=0x18e7e4, pAuthzSvc=0x18e7d4, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x18e7e4*=0xa, pAuthzSvc=0x18e7d4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0112.748] IUnknown:Release (This=0x4aed900) returned 0x3 [0112.748] IUnknown:QueryInterface (in: This=0x4aed8fc, riid=0x753e34f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e798 | out: ppvObject=0x18e798*=0x4fefe7c) returned 0x0 [0112.748] IUnknown:QueryInterface (in: This=0x4aed8fc, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e79c | out: ppvObject=0x18e79c*=0x4aed900) returned 0x0 [0112.749] IClientSecurity:SetBlanket (This=0x4aed900, pProxy=0x4aed8fc, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0112.749] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.749] GetCurrentThreadId () returned 0xa94 [0112.749] GetCurrentThreadId () returned 0xa94 [0112.749] GetCurrentThreadId () returned 0xa94 [0112.749] PeekMessageA (in: lpMsg=0x18de08, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18de08) returned 0 [0112.750] PeekMessageA (in: lpMsg=0x18de08, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18de08) returned 0 [0112.750] PeekMessageA (in: lpMsg=0x18de08, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18de08) returned 0 [0112.751] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0112.751] GetCurrentThreadId () returned 0xa94 [0112.752] GetCurrentThreadId () returned 0xa94 [0112.752] GetCurrentThreadId () returned 0xa94 [0112.752] PeekMessageA (in: lpMsg=0x18df54, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18df54) returned 0 [0112.752] PeekMessageA (in: lpMsg=0x18df54, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18df54) returned 0 [0112.752] PeekMessageA (in: lpMsg=0x18df54, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18df54) returned 1 [0112.752] PeekMessageA (in: lpMsg=0x18df54, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18df54) returned 0 [0112.753] IUnknown:Release (This=0x4aed900) returned 0x4 [0112.754] WbemLocator:IUnknown:Release (This=0x4fefe7c) returned 0x3 [0112.754] IUnknown:Release (This=0x4ae08e0) returned 0x2 [0112.754] IUnknown:AddRef (This=0x4aed8fc) returned 0x3 [0112.754] IUnknown:Release (This=0x4ae08dc) returned 0x2 [0112.754] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18e914 | out: pperrinfo=0x18e914*=0x0) returned 0x1 [0112.754] WbemLocator:IUnknown:Release (This=0x4aed684) returned 0x2 [0112.755] IUnknown:Release (This=0x4ffa63c) returned 0x1 [0112.755] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18eba4*=0x0 | out: pptlib=0x18eba4*=0x4ff0410) returned 0x0 [0112.756] ITypeLib:GetTypeInfoOfGuid (in: This=0x4ff0410, GUID=0x4aecde8*(Data1=0x76a6415f, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x4aecddc | out: ppTInfo=0x4aecddc*=0x4ffa6ec) returned 0x0 [0112.757] IUnknown:Release (This=0x4ff0410) returned 0x2 [0112.757] IUnknown:AddRef (This=0x4ffa6ec) returned 0x2 [0112.757] DispGetIDsOfNames (in: ptinfo=0x4ffa6ec, rgszNames=0x18ec00*="Count", cNames=0x1, rgdispid=0x18ec04 | out: rgdispid=0x18ec04*=1) returned 0x0 [0112.757] IUnknown:Release (This=0x4ffa6ec) returned 0x1 [0112.757] IUnknown:AddRef (This=0x4ffa6ec) returned 0x2 [0112.757] ITypeInfo:LocalInvoke (This=0x4ffa6ec) returned 0x0 [0112.757] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0112.757] GetCurrentThreadId () returned 0xa94 [0112.757] IUnknown:AddRef (This=0x4aed8fc) returned 0x3 [0112.757] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0112.758] GetCurrentThreadId () returned 0xa94 [0112.758] IEnumWbemClassObject:Clone (in: This=0x4aed8fc, ppEnum=0x18ea2c | out: ppEnum=0x18ea2c*=0x4aed9c4) returned 0x0 [0112.758] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.758] GetCurrentThreadId () returned 0xa94 [0112.758] GetCurrentThreadId () returned 0xa94 [0112.758] GetCurrentThreadId () returned 0xa94 [0112.758] PeekMessageA (in: lpMsg=0x18e260, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e260) returned 0 [0112.759] PeekMessageA (in: lpMsg=0x18e260, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e260) returned 0 [0112.759] PeekMessageA (in: lpMsg=0x18e260, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e260) returned 0 [0112.761] IUnknown:QueryInterface (in: This=0x4aed8fc, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9e4 | out: ppvObject=0x18e9e4*=0x4aed900) returned 0x0 [0112.761] IClientSecurity:QueryBlanket (in: This=0x4aed900, pProxy=0x4aed8fc, pAuthnSvc=0x18e9d4, pAuthzSvc=0x18e9d8, pServerPrincName=0x0, pAuthnLevel=0x18e9f4, pImpLevel=0x18e9f8, pAuthInfo=0x0, pCapabilites=0x18e9ec | out: pAuthnSvc=0x18e9d4*=0xa, pAuthzSvc=0x18e9d8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18e9f4*=0x6, pImpLevel=0x18e9f8*=0x3, pAuthInfo=0x0, pCapabilites=0x18e9ec*=0x20) returned 0x0 [0112.761] IUnknown:Release (This=0x4aed900) returned 0x3 [0112.761] IUnknown:QueryInterface (in: This=0x4aed9c4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e930 | out: ppvObject=0x18e930*=0x4aed9c8) returned 0x0 [0112.761] IClientSecurity:QueryBlanket (in: This=0x4aed9c8, pProxy=0x4aed9c4, pAuthnSvc=0x18e954, pAuthzSvc=0x18e944, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x18e954*=0xa, pAuthzSvc=0x18e944*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0112.761] IUnknown:Release (This=0x4aed9c8) returned 0x1 [0112.761] IUnknown:QueryInterface (in: This=0x4aed9c4, riid=0x753e34f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e908 | out: ppvObject=0x18e908*=0x4ff0d5c) returned 0x0 [0112.761] IUnknown:QueryInterface (in: This=0x4aed9c4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e90c | out: ppvObject=0x18e90c*=0x4aed9c8) returned 0x0 [0112.761] IClientSecurity:SetBlanket (This=0x4aed9c8, pProxy=0x4aed9c4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0112.762] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.762] GetCurrentThreadId () returned 0xa94 [0112.762] GetCurrentThreadId () returned 0xa94 [0112.762] GetCurrentThreadId () returned 0xa94 [0112.763] PeekMessageA (in: lpMsg=0x18df78, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18df78) returned 0 [0112.763] PeekMessageA (in: lpMsg=0x18df78, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18df78) returned 0 [0112.763] PeekMessageA (in: lpMsg=0x18df78, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18df78) returned 0 [0112.765] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.765] GetCurrentThreadId () returned 0xa94 [0112.765] GetCurrentThreadId () returned 0xa94 [0112.765] GetCurrentThreadId () returned 0xa94 [0112.766] PeekMessageA (in: lpMsg=0x18e0c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e0c4) returned 0 [0112.766] PeekMessageA (in: lpMsg=0x18e0c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e0c4) returned 0 [0112.766] PeekMessageA (in: lpMsg=0x18e0c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e0c4) returned 0 [0112.768] IUnknown:Release (This=0x4aed9c8) returned 0x2 [0112.768] WbemLocator:IUnknown:Release (This=0x4ff0d5c) returned 0x1 [0112.768] IEnumWbemClassObject:Reset (This=0x4aed9c4) returned 0x0 [0112.768] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.768] GetCurrentThreadId () returned 0xa94 [0112.769] GetCurrentThreadId () returned 0xa94 [0112.769] GetCurrentThreadId () returned 0xa94 [0112.769] PeekMessageA (in: lpMsg=0x18e268, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e268) returned 0 [0112.769] PeekMessageA (in: lpMsg=0x18e268, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e268) returned 0 [0112.769] PeekMessageA (in: lpMsg=0x18e268, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e268) returned 0 [0112.770] IEnumWbemClassObject:Next (in: This=0x4aed9c4, lTimeout=-1, uCount=0x1, apObjects=0x18ea1c, puReturned=0x18ea20 | out: apObjects=0x18ea1c*=0x0, puReturned=0x18ea20*=0x0) returned 0x1 [0112.770] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0112.771] GetCurrentThreadId () returned 0xa94 [0112.771] GetCurrentThreadId () returned 0xa94 [0112.771] GetCurrentThreadId () returned 0xa94 [0112.771] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0112.771] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0112.771] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0112.876] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x6d, dwPendingType=0x1) returned 0x2 [0112.876] GetCurrentThreadId () returned 0xa94 [0112.876] GetCurrentThreadId () returned 0xa94 [0112.877] GetCurrentThreadId () returned 0xa94 [0112.877] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0112.877] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0112.877] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 1 [0112.877] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0112.908] IUnknown:Release (This=0x4aed9c4) returned 0x0 [0112.909] IUnknown:Release (This=0x4aed8fc) returned 0x2 [0112.909] IUnknown:Release (This=0x4ffa6ec) returned 0x1 [0112.910] WbemLocator:IUnknown:Release (This=0x4aed684) returned 0x1 [0112.910] WbemLocator:IUnknown:Release (This=0x4aed684) returned 0x0 [0112.911] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.911] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.911] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.911] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.911] IUnknown:Release (This=0x4ffa63c) returned 0x0 [0112.911] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.911] IUnknown:Release (This=0x4aed8fc) returned 0x1 [0112.911] IUnknown:Release (This=0x4aed8fc) returned 0x0 [0112.913] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.913] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.913] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.914] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.914] IUnknown:Release (This=0x4ffa6ec) returned 0x0 [0112.914] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0112.915] SysStringLen (param_1="delete catalog -quiet") returned 0x15 [0112.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="delete catalog -quiet", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0112.915] SysStringLen (param_1="delete catalog -quiet") returned 0x15 [0112.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="delete catalog -quiet", cchWideChar=22, lpMultiByteStr=0x2fd0cc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="delete catalog -quiet", lpUsedDefaultChar=0x0) returned 22 [0112.915] SysStringLen (param_1="wbadmin.exe") returned 0xb [0112.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbadmin.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0112.915] SysStringLen (param_1="wbadmin.exe") returned 0xb [0112.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wbadmin.exe", cchWideChar=12, lpMultiByteStr=0x2fd0f4, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbadmin.exe", lpUsedDefaultChar=0x0) returned 12 [0112.916] SysStringLen (param_1="open") returned 0x4 [0112.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="open", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0112.916] SysStringLen (param_1="open") returned 0x4 [0112.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="open", cchWideChar=5, lpMultiByteStr=0x2fd0a4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="open", lpUsedDefaultChar=0x0) returned 5 [0112.916] SetErrorMode (uMode=0x8001) returned 0x8001 [0112.916] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x759d0000 [0112.916] SetErrorMode (uMode=0x8001) returned 0x8001 [0112.917] GetProcAddress (hModule=0x759d0000, lpProcName="ShellExecuteA") returned 0x75c17078 [0114.057] ShellExecuteA (hwnd=0x5026a, lpOperation="open", lpFile="wbadmin.exe", lpParameters="delete catalog -quiet", lpDirectory=0x0, nShowCmd=0) returned 0x2 [0114.151] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0123.661] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0123.661] GetLastError () returned 0x2 [0123.662] SysStringLen (param_1="/set {default} bootstatuspolicy ignoreallfailures") returned 0x31 [0123.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="/set {default} bootstatuspolicy ignoreallfailures", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0123.662] SysStringLen (param_1="/set {default} bootstatuspolicy ignoreallfailures") returned 0x31 [0123.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="/set {default} bootstatuspolicy ignoreallfailures", cchWideChar=50, lpMultiByteStr=0x2e3424, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/set {default} bootstatuspolicy ignoreallfailures", lpUsedDefaultChar=0x0) returned 50 [0123.663] SysStringLen (param_1="bcdedit.exe") returned 0xb [0123.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcdedit.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0123.663] SysStringLen (param_1="bcdedit.exe") returned 0xb [0123.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcdedit.exe", cchWideChar=12, lpMultiByteStr=0x2fd0a4, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcdedit.exe", lpUsedDefaultChar=0x0) returned 12 [0123.663] SysStringLen (param_1="open") returned 0x4 [0123.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="open", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0123.663] SysStringLen (param_1="open") returned 0x4 [0123.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="open", cchWideChar=5, lpMultiByteStr=0x2fd0f4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="open", lpUsedDefaultChar=0x0) returned 5 [0123.664] ShellExecuteA (hwnd=0x5026a, lpOperation="open", lpFile="bcdedit.exe", lpParameters="/set {default} bootstatuspolicy ignoreallfailures", lpDirectory=0x0, nShowCmd=0) returned 0x2 [0123.664] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0123.673] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0123.673] GetLastError () returned 0x2 [0123.674] SysStringLen (param_1="/set {default} recoveryenabled no") returned 0x21 [0123.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="/set {default} recoveryenabled no", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0123.674] SysStringLen (param_1="/set {default} recoveryenabled no") returned 0x21 [0123.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="/set {default} recoveryenabled no", cchWideChar=34, lpMultiByteStr=0x2e3424, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/set {default} recoveryenabled no", lpUsedDefaultChar=0x0) returned 34 [0123.674] SysStringLen (param_1="bcdedit.exe") returned 0xb [0123.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcdedit.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0123.675] SysStringLen (param_1="bcdedit.exe") returned 0xb [0123.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bcdedit.exe", cchWideChar=12, lpMultiByteStr=0x2fd0f4, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcdedit.exe", lpUsedDefaultChar=0x0) returned 12 [0123.675] SysStringLen (param_1="open") returned 0x4 [0123.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="open", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0123.675] SysStringLen (param_1="open") returned 0x4 [0123.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="open", cchWideChar=5, lpMultiByteStr=0x2fd0a4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="open", lpUsedDefaultChar=0x0) returned 5 [0123.676] ShellExecuteA (hwnd=0x5026a, lpOperation="open", lpFile="bcdedit.exe", lpParameters="/set {default} recoveryenabled no", lpDirectory=0x0, nShowCmd=0) returned 0x2 [0123.676] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0123.687] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0123.687] GetLastError () returned 0x2 [0123.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eae8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0123.688] GetVersionExA (in: lpVersionInformation=0x18ead4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18ead4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0123.689] GetLastError () returned 0x0 [0123.689] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18eae8, cbMultiByte=128, lpWideCharStr=0x18eb88, cchWideChar=128 | out: lpWideCharStr="Service Pack 1") returned 128 [0123.689] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9f0) returned 0x22c [0123.693] GetLastError () returned 0x0 [0123.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=260, lpMultiByteStr=0x18e8e4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 260 [0123.693] Process32First (in: hSnapshot=0x22c, lppe=0x18e8c0 | out: lppe=0x18e8c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.693] GetLastError () returned 0x0 [0123.693] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e8e4, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="[System Process]") returned 260 [0123.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.695] CharLowerBuffW (in: lpsz="[System Process]", cchLength=0x11 | out: lpsz="[system process]") returned 0x11 [0123.695] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.695] VarBstrCmp (bstrLeft="m process]", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="[System Process]", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[System Process]", lpUsedDefaultChar=0x0) returned 260 [0123.695] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0123.696] GetLastError () returned 0x0 [0123.696] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="System") returned 260 [0123.696] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.697] CharLowerBuffW (in: lpsz="System", cchLength=0x7 | out: lpsz="system") returned 0x7 [0123.697] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.698] VarBstrCmp (bstrLeft="system", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="System", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="System", lpUsedDefaultChar=0x0) returned 260 [0123.698] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0123.698] GetLastError () returned 0x0 [0123.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="smss.exe") returned 260 [0123.699] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.699] CharLowerBuffW (in: lpsz="smss.exe", cchLength=0x9 | out: lpsz="smss.exe") returned 0x9 [0123.699] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.699] VarBstrCmp (bstrLeft="smss.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smss.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="smss.exe", lpUsedDefaultChar=0x0) returned 260 [0123.700] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.700] GetLastError () returned 0x0 [0123.700] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0123.700] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.701] CharLowerBuffW (in: lpsz="csrss.exe", cchLength=0xa | out: lpsz="csrss.exe") returned 0xa [0123.702] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.702] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csrss.exe", lpUsedDefaultChar=0x0) returned 260 [0123.702] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0123.702] GetLastError () returned 0x0 [0123.703] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="wininit.exe") returned 260 [0123.703] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.703] CharLowerBuffW (in: lpsz="wininit.exe", cchLength=0xc | out: lpsz="wininit.exe") returned 0xc [0123.704] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.704] VarBstrCmp (bstrLeft="ininit.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wininit.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wininit.exe", lpUsedDefaultChar=0x0) returned 260 [0123.704] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.704] GetLastError () returned 0x0 [0123.705] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0123.705] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.705] CharLowerBuffW (in: lpsz="csrss.exe", cchLength=0xa | out: lpsz="csrss.exe") returned 0xa [0123.705] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.706] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csrss.exe", lpUsedDefaultChar=0x0) returned 260 [0123.706] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0123.706] GetLastError () returned 0x0 [0123.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="winlogon.exe") returned 260 [0123.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.707] CharLowerBuffW (in: lpsz="winlogon.exe", cchLength=0xd | out: lpsz="winlogon.exe") returned 0xd [0123.707] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.707] VarBstrCmp (bstrLeft="nlogon.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winlogon.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="winlogon.exe", lpUsedDefaultChar=0x0) returned 260 [0123.707] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0123.707] GetLastError () returned 0x0 [0123.708] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="services.exe") returned 260 [0123.708] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.708] CharLowerBuffW (in: lpsz="services.exe", cchLength=0xd | out: lpsz="services.exe") returned 0xd [0123.708] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.708] VarBstrCmp (bstrLeft="rvices.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services.exe", lpUsedDefaultChar=0x0) returned 260 [0123.709] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0123.709] GetLastError () returned 0x0 [0123.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="lsass.exe") returned 260 [0123.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.710] CharLowerBuffW (in: lpsz="lsass.exe", cchLength=0xa | out: lpsz="lsass.exe") returned 0xa [0123.710] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.710] VarBstrCmp (bstrLeft="lsass.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsass.exe", lpUsedDefaultChar=0x0) returned 260 [0123.710] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0123.711] GetLastError () returned 0x0 [0123.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="lsm.exe") returned 260 [0123.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.711] CharLowerBuffW (in: lpsz="lsm.exe", cchLength=0x8 | out: lpsz="lsm.exe") returned 0x8 [0123.711] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.711] VarBstrCmp (bstrLeft="lsm.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsm.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsm.exe", lpUsedDefaultChar=0x0) returned 260 [0123.711] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.712] GetLastError () returned 0x0 [0123.712] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.712] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.712] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.712] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.712] VarBstrCmp (bstrLeft="vchost.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.713] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.713] GetLastError () returned 0x0 [0123.713] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.713] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.713] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.714] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.714] VarBstrCmp (bstrLeft="vchost.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.714] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.714] GetLastError () returned 0x0 [0123.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.715] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.715] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.715] VarBstrCmp (bstrLeft="vchost.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.715] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.715] GetLastError () returned 0x0 [0123.715] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.716] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.716] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.716] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.716] VarBstrCmp (bstrLeft="vchost.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.716] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.717] GetLastError () returned 0x0 [0123.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.717] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.717] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.717] VarBstrCmp (bstrLeft="vchost.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.718] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0123.718] GetLastError () returned 0x0 [0123.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="audiodg.exe") returned 260 [0123.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.719] CharLowerBuffW (in: lpsz="audiodg.exe", cchLength=0xc | out: lpsz="audiodg.exe") returned 0xc [0123.719] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.719] VarBstrCmp (bstrLeft="udiodg.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiodg.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiodg.exe", lpUsedDefaultChar=0x0) returned 260 [0123.719] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.719] GetLastError () returned 0x0 [0123.719] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.720] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.720] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.720] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.720] VarBstrCmp (bstrLeft="vchost.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.720] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.721] GetLastError () returned 0x0 [0123.721] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.721] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.721] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.721] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.722] VarBstrCmp (bstrLeft="vchost.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.722] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0123.722] GetLastError () returned 0x0 [0123.722] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="dwm.exe") returned 260 [0123.722] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.722] CharLowerBuffW (in: lpsz="dwm.exe", cchLength=0x8 | out: lpsz="dwm.exe") returned 0x8 [0123.723] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.723] VarBstrCmp (bstrLeft="dwm.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dwm.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwm.exe", lpUsedDefaultChar=0x0) returned 260 [0123.723] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0123.723] GetLastError () returned 0x0 [0123.723] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="explorer.exe") returned 260 [0123.723] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.724] CharLowerBuffW (in: lpsz="explorer.exe", cchLength=0xd | out: lpsz="explorer.exe") returned 0xd [0123.724] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.724] VarBstrCmp (bstrLeft="plorer.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer.exe", lpUsedDefaultChar=0x0) returned 260 [0123.724] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0123.724] GetLastError () returned 0x0 [0123.724] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="spoolsv.exe") returned 260 [0123.725] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.725] CharLowerBuffW (in: lpsz="spoolsv.exe", cchLength=0xc | out: lpsz="spoolsv.exe") returned 0xc [0123.725] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.725] VarBstrCmp (bstrLeft="poolsv.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="spoolsv.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spoolsv.exe", lpUsedDefaultChar=0x0) returned 260 [0123.725] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.726] GetLastError () returned 0x0 [0123.726] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.726] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.727] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.727] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.727] VarBstrCmp (bstrLeft="vchost.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.727] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.727] GetLastError () returned 0x0 [0123.727] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.728] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.728] CharLowerBuffW (in: lpsz="taskhost.exe", cchLength=0xd | out: lpsz="taskhost.exe") returned 0xd [0123.728] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.728] VarBstrCmp (bstrLeft="skhost.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskhost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskhost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.728] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0123.729] GetLastError () returned 0x0 [0123.729] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskeng.exe") returned 260 [0123.729] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.729] CharLowerBuffW (in: lpsz="taskeng.exe", cchLength=0xc | out: lpsz="taskeng.exe") returned 0xc [0123.729] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.729] VarBstrCmp (bstrLeft="askeng.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskeng.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskeng.exe", lpUsedDefaultChar=0x0) returned 260 [0123.730] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0123.730] GetLastError () returned 0x0 [0123.730] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0123.730] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.730] CharLowerBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xd | out: lpsz="wmiprvse.exe") returned 0xd [0123.731] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.731] VarBstrCmp (bstrLeft="iprvse.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WmiPrvSE.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WmiPrvSE.exe", lpUsedDefaultChar=0x0) returned 260 [0123.731] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0123.731] GetLastError () returned 0x0 [0123.731] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0123.731] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.732] CharLowerBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xd | out: lpsz="wmiprvse.exe") returned 0xd [0123.732] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.732] VarBstrCmp (bstrLeft="iprvse.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WmiPrvSE.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WmiPrvSE.exe", lpUsedDefaultChar=0x0) returned 260 [0123.732] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.734] GetLastError () returned 0x0 [0123.734] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.734] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.735] CharLowerBuffW (in: lpsz="taskhost.exe", cchLength=0xd | out: lpsz="taskhost.exe") returned 0xd [0123.735] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.735] VarBstrCmp (bstrLeft="skhost.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskhost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskhost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.735] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zhang.exe")) returned 1 [0123.735] GetLastError () returned 0x0 [0123.735] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="zhang.exe") returned 260 [0123.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.736] CharLowerBuffW (in: lpsz="zhang.exe", cchLength=0xa | out: lpsz="zhang.exe") returned 0xa [0123.736] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.736] VarBstrCmp (bstrLeft="zhang.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="zhang.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zhang.exe", lpUsedDefaultChar=0x0) returned 260 [0123.736] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0123.737] GetLastError () returned 0x0 [0123.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="dllhost.exe") returned 260 [0123.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.737] CharLowerBuffW (in: lpsz="dllhost.exe", cchLength=0xc | out: lpsz="dllhost.exe") returned 0xc [0123.738] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.738] VarBstrCmp (bstrLeft="llhost.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dllhost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dllhost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.738] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0123.738] GetLastError () returned 0x0 [0123.738] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="VSSVC.exe") returned 260 [0123.738] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.739] CharLowerBuffW (in: lpsz="VSSVC.exe", cchLength=0xa | out: lpsz="vssvc.exe") returned 0xa [0123.739] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.739] VarBstrCmp (bstrLeft="vssvc.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VSSVC.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VSSVC.exe", lpUsedDefaultChar=0x0) returned 260 [0123.739] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.740] GetLastError () returned 0x0 [0123.740] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.740] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.740] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.740] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.741] VarBstrCmp (bstrLeft="vchost.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.741] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.741] GetLastError () returned 0x0 [0123.741] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.741] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.742] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.742] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.742] VarBstrCmp (bstrLeft="vchost.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.742] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.742] GetLastError () returned 0x0 [0123.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.743] CharLowerBuffW (in: lpsz="taskhost.exe", cchLength=0xd | out: lpsz="taskhost.exe") returned 0xd [0123.744] CharLowerBuffW (in: lpsz="mysqld.exe", cchLength=0xb | out: lpsz="mysqld.exe") returned 0xb [0123.744] VarBstrCmp (bstrLeft="skhost.exe", bstrRight="mysqld.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskhost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskhost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.744] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0123.745] GetLastError () returned 0x12 [0123.745] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.745] CloseHandle (hObject=0x22c) returned 1 [0123.745] GetLastError () returned 0x0 [0123.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eae8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0123.745] GetVersionExA (in: lpVersionInformation=0x18ead4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18ead4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0123.745] GetLastError () returned 0x0 [0123.746] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18eae8, cbMultiByte=128, lpWideCharStr=0x18eb88, cchWideChar=128 | out: lpWideCharStr="Service Pack 1") returned 128 [0123.746] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9f0) returned 0x22c [0123.748] GetLastError () returned 0x0 [0123.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=260, lpMultiByteStr=0x18e8e4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 260 [0123.748] Process32First (in: hSnapshot=0x22c, lppe=0x18e8c0 | out: lppe=0x18e8c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.749] GetLastError () returned 0x0 [0123.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e8e4, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="[System Process]") returned 260 [0123.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.750] CharLowerBuffW (in: lpsz="[System Process]", cchLength=0x11 | out: lpsz="[system process]") returned 0x11 [0123.750] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.750] VarBstrCmp (bstrLeft="tem process]", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="[System Process]", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[System Process]", lpUsedDefaultChar=0x0) returned 260 [0123.750] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0123.751] GetLastError () returned 0x0 [0123.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="System") returned 260 [0123.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.752] CharLowerBuffW (in: lpsz="System", cchLength=0x7 | out: lpsz="system") returned 0x7 [0123.752] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.752] VarBstrCmp (bstrLeft="system", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="System", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="System", lpUsedDefaultChar=0x0) returned 260 [0123.752] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0123.752] GetLastError () returned 0x0 [0123.753] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="smss.exe") returned 260 [0123.753] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.753] CharLowerBuffW (in: lpsz="smss.exe", cchLength=0x9 | out: lpsz="smss.exe") returned 0x9 [0123.754] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.754] VarBstrCmp (bstrLeft="smss.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smss.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="smss.exe", lpUsedDefaultChar=0x0) returned 260 [0123.754] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.754] GetLastError () returned 0x0 [0123.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0123.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0f4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.755] CharLowerBuffW (in: lpsz="csrss.exe", cchLength=0xa | out: lpsz="csrss.exe") returned 0xa [0123.755] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.755] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csrss.exe", lpUsedDefaultChar=0x0) returned 260 [0123.756] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0123.756] GetLastError () returned 0x0 [0123.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="wininit.exe") returned 260 [0123.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.757] CharLowerBuffW (in: lpsz="wininit.exe", cchLength=0xc | out: lpsz="wininit.exe") returned 0xc [0123.757] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.757] VarBstrCmp (bstrLeft="wininit.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wininit.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wininit.exe", lpUsedDefaultChar=0x0) returned 260 [0123.757] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.758] GetLastError () returned 0x0 [0123.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0123.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.758] CharLowerBuffW (in: lpsz="csrss.exe", cchLength=0xa | out: lpsz="csrss.exe") returned 0xa [0123.759] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.759] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csrss.exe", lpUsedDefaultChar=0x0) returned 260 [0123.759] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0123.759] GetLastError () returned 0x0 [0123.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="winlogon.exe") returned 260 [0123.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0f4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.760] CharLowerBuffW (in: lpsz="winlogon.exe", cchLength=0xd | out: lpsz="winlogon.exe") returned 0xd [0123.761] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.761] VarBstrCmp (bstrLeft="winlogon.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winlogon.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="winlogon.exe", lpUsedDefaultChar=0x0) returned 260 [0123.761] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0123.761] GetLastError () returned 0x0 [0123.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="services.exe") returned 260 [0123.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.762] CharLowerBuffW (in: lpsz="services.exe", cchLength=0xd | out: lpsz="services.exe") returned 0xd [0123.762] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.763] VarBstrCmp (bstrLeft="services.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="services.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services.exe", lpUsedDefaultChar=0x0) returned 260 [0123.763] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0123.763] GetLastError () returned 0x0 [0123.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="lsass.exe") returned 260 [0123.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.764] CharLowerBuffW (in: lpsz="lsass.exe", cchLength=0xa | out: lpsz="lsass.exe") returned 0xa [0123.764] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.764] VarBstrCmp (bstrLeft="lsass.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsass.exe", lpUsedDefaultChar=0x0) returned 260 [0123.765] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0123.766] GetLastError () returned 0x0 [0123.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="lsm.exe") returned 260 [0123.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0f4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.766] CharLowerBuffW (in: lpsz="lsm.exe", cchLength=0x8 | out: lpsz="lsm.exe") returned 0x8 [0123.767] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.767] VarBstrCmp (bstrLeft="lsm.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lsm.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsm.exe", lpUsedDefaultChar=0x0) returned 260 [0123.767] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.767] GetLastError () returned 0x0 [0123.767] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.767] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.768] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.768] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.768] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.768] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.769] GetLastError () returned 0x0 [0123.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.769] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.769] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.769] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.770] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.770] GetLastError () returned 0x0 [0123.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0f4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.770] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.770] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.771] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.771] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.771] GetLastError () returned 0x0 [0123.771] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.771] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.771] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.772] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.772] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.772] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.772] GetLastError () returned 0x0 [0123.772] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.772] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.772] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.773] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.773] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.773] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0123.773] GetLastError () returned 0x0 [0123.773] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="audiodg.exe") returned 260 [0123.773] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0f4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.774] CharLowerBuffW (in: lpsz="audiodg.exe", cchLength=0xc | out: lpsz="audiodg.exe") returned 0xc [0123.774] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.774] VarBstrCmp (bstrLeft="audiodg.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="audiodg.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiodg.exe", lpUsedDefaultChar=0x0) returned 260 [0123.774] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.774] GetLastError () returned 0x0 [0123.774] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.775] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.775] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.775] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.775] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.776] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.776] GetLastError () returned 0x0 [0123.776] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.776] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.776] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.777] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.777] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.777] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0123.777] GetLastError () returned 0x0 [0123.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="dwm.exe") returned 260 [0123.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0f4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.777] CharLowerBuffW (in: lpsz="dwm.exe", cchLength=0x8 | out: lpsz="dwm.exe") returned 0x8 [0123.778] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.778] VarBstrCmp (bstrLeft="dwm.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dwm.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwm.exe", lpUsedDefaultChar=0x0) returned 260 [0123.778] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0123.778] GetLastError () returned 0x0 [0123.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="explorer.exe") returned 260 [0123.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.779] CharLowerBuffW (in: lpsz="explorer.exe", cchLength=0xd | out: lpsz="explorer.exe") returned 0xd [0123.779] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.779] VarBstrCmp (bstrLeft="explorer.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="explorer.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer.exe", lpUsedDefaultChar=0x0) returned 260 [0123.779] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0123.779] GetLastError () returned 0x0 [0123.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="spoolsv.exe") returned 260 [0123.780] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.780] CharLowerBuffW (in: lpsz="spoolsv.exe", cchLength=0xc | out: lpsz="spoolsv.exe") returned 0xc [0123.780] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.780] VarBstrCmp (bstrLeft="spoolsv.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="spoolsv.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spoolsv.exe", lpUsedDefaultChar=0x0) returned 260 [0123.781] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.781] GetLastError () returned 0x0 [0123.781] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0f4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.782] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.782] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.783] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.783] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.783] GetLastError () returned 0x0 [0123.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.784] CharLowerBuffW (in: lpsz="taskhost.exe", cchLength=0xd | out: lpsz="taskhost.exe") returned 0xd [0123.784] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.784] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskhost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskhost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.784] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0123.784] GetLastError () returned 0x0 [0123.785] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskeng.exe") returned 260 [0123.785] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.785] CharLowerBuffW (in: lpsz="taskeng.exe", cchLength=0xc | out: lpsz="taskeng.exe") returned 0xc [0123.785] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.785] VarBstrCmp (bstrLeft="taskeng.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskeng.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskeng.exe", lpUsedDefaultChar=0x0) returned 260 [0123.785] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0123.786] GetLastError () returned 0x0 [0123.786] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0123.786] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0f4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.786] CharLowerBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xd | out: lpsz="wmiprvse.exe") returned 0xd [0123.786] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.786] VarBstrCmp (bstrLeft="wmiprvse.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WmiPrvSE.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WmiPrvSE.exe", lpUsedDefaultChar=0x0) returned 260 [0123.787] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0123.787] GetLastError () returned 0x0 [0123.787] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0123.787] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.787] CharLowerBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xd | out: lpsz="wmiprvse.exe") returned 0xd [0123.788] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.788] VarBstrCmp (bstrLeft="wmiprvse.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WmiPrvSE.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WmiPrvSE.exe", lpUsedDefaultChar=0x0) returned 260 [0123.788] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.788] GetLastError () returned 0x0 [0123.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.789] CharLowerBuffW (in: lpsz="taskhost.exe", cchLength=0xd | out: lpsz="taskhost.exe") returned 0xd [0123.789] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.789] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="taskhost.exe", cchWideChar=260, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskhost.exe", lpUsedDefaultChar=0x0) returned 260 [0123.789] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zhang.exe")) returned 1 [0123.789] GetLastError () returned 0x0 [0123.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="zhang.exe") returned 260 [0123.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0f4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.790] CharLowerBuffW (in: lpsz="zhang.exe", cchLength=0xa | out: lpsz="zhang.exe") returned 0xa [0123.790] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.790] VarBstrCmp (bstrLeft="zhang.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.790] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0123.791] GetLastError () returned 0x0 [0123.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="dllhost.exe") returned 260 [0123.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.791] CharLowerBuffW (in: lpsz="dllhost.exe", cchLength=0xc | out: lpsz="dllhost.exe") returned 0xc [0123.791] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.791] VarBstrCmp (bstrLeft="dllhost.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.791] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0123.792] GetLastError () returned 0x0 [0123.792] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="VSSVC.exe") returned 260 [0123.792] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.792] CharLowerBuffW (in: lpsz="VSSVC.exe", cchLength=0xa | out: lpsz="vssvc.exe") returned 0xa [0123.792] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.792] VarBstrCmp (bstrLeft="vssvc.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.792] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.793] GetLastError () returned 0x0 [0123.793] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.793] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0f4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.793] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.793] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.793] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.793] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.794] GetLastError () returned 0x0 [0123.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.794] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.794] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.794] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.794] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.794] GetLastError () returned 0x0 [0123.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.795] CharLowerBuffW (in: lpsz="taskhost.exe", cchLength=0xd | out: lpsz="taskhost.exe") returned 0xd [0123.795] CharLowerBuffW (in: lpsz="sqlservr.exe", cchLength=0xd | out: lpsz="sqlservr.exe") returned 0xd [0123.795] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="sqlservr.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.795] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0123.795] GetLastError () returned 0x12 [0123.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.795] CloseHandle (hObject=0x22c) returned 1 [0123.795] GetLastError () returned 0x0 [0123.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eae8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0123.796] GetVersionExA (in: lpVersionInformation=0x18ead4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18ead4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0123.796] GetLastError () returned 0x0 [0123.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18eae8, cbMultiByte=128, lpWideCharStr=0x18eb88, cchWideChar=128 | out: lpWideCharStr="Service Pack 1") returned 128 [0123.796] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9f0) returned 0x22c [0123.798] GetLastError () returned 0x0 [0123.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=260, lpMultiByteStr=0x18e8e4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 260 [0123.798] Process32First (in: hSnapshot=0x22c, lppe=0x18e8c0 | out: lppe=0x18e8c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.799] GetLastError () returned 0x0 [0123.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e8e4, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="[System Process]") returned 260 [0123.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.799] CharLowerBuffW (in: lpsz="[System Process]", cchLength=0x11 | out: lpsz="[system process]") returned 0x11 [0123.799] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.799] VarBstrCmp (bstrLeft="stem process]", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.799] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0123.800] GetLastError () returned 0x0 [0123.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="System") returned 260 [0123.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.800] CharLowerBuffW (in: lpsz="System", cchLength=0x7 | out: lpsz="system") returned 0x7 [0123.800] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.800] VarBstrCmp (bstrLeft="system", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.800] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0123.800] GetLastError () returned 0x0 [0123.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="smss.exe") returned 260 [0123.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.801] CharLowerBuffW (in: lpsz="smss.exe", cchLength=0x9 | out: lpsz="smss.exe") returned 0x9 [0123.801] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.801] VarBstrCmp (bstrLeft="smss.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.801] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.801] GetLastError () returned 0x0 [0123.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0123.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.802] CharLowerBuffW (in: lpsz="csrss.exe", cchLength=0xa | out: lpsz="csrss.exe") returned 0xa [0123.802] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.802] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.802] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0123.802] GetLastError () returned 0x0 [0123.802] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="wininit.exe") returned 260 [0123.802] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.803] CharLowerBuffW (in: lpsz="wininit.exe", cchLength=0xc | out: lpsz="wininit.exe") returned 0xc [0123.803] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.803] VarBstrCmp (bstrLeft="wininit.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.803] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.803] GetLastError () returned 0x0 [0123.803] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0123.803] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.803] CharLowerBuffW (in: lpsz="csrss.exe", cchLength=0xa | out: lpsz="csrss.exe") returned 0xa [0123.804] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.804] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.804] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0123.804] GetLastError () returned 0x0 [0123.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="winlogon.exe") returned 260 [0123.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.805] CharLowerBuffW (in: lpsz="winlogon.exe", cchLength=0xd | out: lpsz="winlogon.exe") returned 0xd [0123.805] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.805] VarBstrCmp (bstrLeft="winlogon.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.805] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0123.805] GetLastError () returned 0x0 [0123.805] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="services.exe") returned 260 [0123.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.806] CharLowerBuffW (in: lpsz="services.exe", cchLength=0xd | out: lpsz="services.exe") returned 0xd [0123.806] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.806] VarBstrCmp (bstrLeft="services.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.806] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0123.806] GetLastError () returned 0x0 [0123.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="lsass.exe") returned 260 [0123.807] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.807] CharLowerBuffW (in: lpsz="lsass.exe", cchLength=0xa | out: lpsz="lsass.exe") returned 0xa [0123.807] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.807] VarBstrCmp (bstrLeft="lsass.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.807] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0123.807] GetLastError () returned 0x0 [0123.807] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="lsm.exe") returned 260 [0123.807] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.808] CharLowerBuffW (in: lpsz="lsm.exe", cchLength=0x8 | out: lpsz="lsm.exe") returned 0x8 [0123.808] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.808] VarBstrCmp (bstrLeft="lsm.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.808] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.808] GetLastError () returned 0x0 [0123.808] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.808] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.809] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.809] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.809] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.809] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.809] GetLastError () returned 0x0 [0123.809] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.809] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.810] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.810] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.810] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.810] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.810] GetLastError () returned 0x0 [0123.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.811] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.811] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.811] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.811] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.811] GetLastError () returned 0x0 [0123.842] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.842] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.843] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.843] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.843] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.844] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.844] GetLastError () returned 0x0 [0123.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.845] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.845] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.845] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.845] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0123.846] GetLastError () returned 0x0 [0123.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="audiodg.exe") returned 260 [0123.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.847] CharLowerBuffW (in: lpsz="audiodg.exe", cchLength=0xc | out: lpsz="audiodg.exe") returned 0xc [0123.847] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.847] VarBstrCmp (bstrLeft="audiodg.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.847] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.847] GetLastError () returned 0x0 [0123.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.848] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.848] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.848] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.849] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.849] GetLastError () returned 0x0 [0123.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.850] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.850] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.850] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.850] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0123.851] GetLastError () returned 0x0 [0123.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="dwm.exe") returned 260 [0123.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.851] CharLowerBuffW (in: lpsz="dwm.exe", cchLength=0x8 | out: lpsz="dwm.exe") returned 0x8 [0123.852] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.852] VarBstrCmp (bstrLeft="dwm.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.852] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0123.852] GetLastError () returned 0x0 [0123.852] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="explorer.exe") returned 260 [0123.852] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.853] CharLowerBuffW (in: lpsz="explorer.exe", cchLength=0xd | out: lpsz="explorer.exe") returned 0xd [0123.853] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.853] VarBstrCmp (bstrLeft="explorer.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.853] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0123.854] GetLastError () returned 0x0 [0123.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="spoolsv.exe") returned 260 [0123.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.854] CharLowerBuffW (in: lpsz="spoolsv.exe", cchLength=0xc | out: lpsz="spoolsv.exe") returned 0xc [0123.854] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.854] VarBstrCmp (bstrLeft="spoolsv.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.854] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.855] GetLastError () returned 0x0 [0123.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.855] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.855] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.855] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.855] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.855] GetLastError () returned 0x0 [0123.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.856] CharLowerBuffW (in: lpsz="taskhost.exe", cchLength=0xd | out: lpsz="taskhost.exe") returned 0xd [0123.856] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.856] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.856] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0123.856] GetLastError () returned 0x0 [0123.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskeng.exe") returned 260 [0123.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.857] CharLowerBuffW (in: lpsz="taskeng.exe", cchLength=0xc | out: lpsz="taskeng.exe") returned 0xc [0123.857] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.857] VarBstrCmp (bstrLeft="taskeng.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.857] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0123.857] GetLastError () returned 0x0 [0123.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0123.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.858] CharLowerBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xd | out: lpsz="wmiprvse.exe") returned 0xd [0123.858] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.858] VarBstrCmp (bstrLeft="wmiprvse.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.858] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0123.858] GetLastError () returned 0x0 [0123.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0123.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.858] CharLowerBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xd | out: lpsz="wmiprvse.exe") returned 0xd [0123.859] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.859] VarBstrCmp (bstrLeft="wmiprvse.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.859] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.859] GetLastError () returned 0x0 [0123.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.859] CharLowerBuffW (in: lpsz="taskhost.exe", cchLength=0xd | out: lpsz="taskhost.exe") returned 0xd [0123.859] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.859] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.859] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zhang.exe")) returned 1 [0123.860] GetLastError () returned 0x0 [0123.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="zhang.exe") returned 260 [0123.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.860] CharLowerBuffW (in: lpsz="zhang.exe", cchLength=0xa | out: lpsz="zhang.exe") returned 0xa [0123.860] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.860] VarBstrCmp (bstrLeft="zhang.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.860] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0123.860] GetLastError () returned 0x0 [0123.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="dllhost.exe") returned 260 [0123.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.861] CharLowerBuffW (in: lpsz="dllhost.exe", cchLength=0xc | out: lpsz="dllhost.exe") returned 0xc [0123.861] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.861] VarBstrCmp (bstrLeft="dllhost.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.861] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0123.861] GetLastError () returned 0x0 [0123.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="VSSVC.exe") returned 260 [0123.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.862] CharLowerBuffW (in: lpsz="VSSVC.exe", cchLength=0xa | out: lpsz="vssvc.exe") returned 0xa [0123.862] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.862] VarBstrCmp (bstrLeft="vssvc.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.862] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.862] GetLastError () returned 0x0 [0123.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0cc, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.862] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.862] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.863] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.863] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.863] GetLastError () returned 0x0 [0123.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.863] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.863] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.863] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.863] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.864] GetLastError () returned 0x0 [0123.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0a4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.864] CharLowerBuffW (in: lpsz="taskhost.exe", cchLength=0xd | out: lpsz="taskhost.exe") returned 0xd [0123.864] CharLowerBuffW (in: lpsz="sqlwriter.exe", cchLength=0xe | out: lpsz="sqlwriter.exe") returned 0xe [0123.864] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="sqlwriter.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.864] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0123.864] GetLastError () returned 0x12 [0123.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.864] CloseHandle (hObject=0x22c) returned 1 [0123.865] GetLastError () returned 0x0 [0123.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eae8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0123.865] GetVersionExA (in: lpVersionInformation=0x18ead4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18ead4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0123.865] GetLastError () returned 0x0 [0123.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18eae8, cbMultiByte=128, lpWideCharStr=0x18eb88, cchWideChar=128 | out: lpWideCharStr="Service Pack 1") returned 128 [0123.865] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9f0) returned 0x22c [0123.867] GetLastError () returned 0x0 [0123.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=260, lpMultiByteStr=0x18e8e4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 260 [0123.867] Process32First (in: hSnapshot=0x22c, lppe=0x18e8c0 | out: lppe=0x18e8c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.867] GetLastError () returned 0x0 [0123.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e8e4, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="[System Process]") returned 260 [0123.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.868] CharLowerBuffW (in: lpsz="[System Process]", cchLength=0x11 | out: lpsz="[system process]") returned 0x11 [0123.868] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.868] VarBstrCmp (bstrLeft="em process]", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.868] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0123.868] GetLastError () returned 0x0 [0123.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="System") returned 260 [0123.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.869] CharLowerBuffW (in: lpsz="System", cchLength=0x7 | out: lpsz="system") returned 0x7 [0123.869] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.869] VarBstrCmp (bstrLeft="system", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.869] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0123.869] GetLastError () returned 0x0 [0123.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="smss.exe") returned 260 [0123.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.870] CharLowerBuffW (in: lpsz="smss.exe", cchLength=0x9 | out: lpsz="smss.exe") returned 0x9 [0123.870] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.870] VarBstrCmp (bstrLeft="smss.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.870] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.870] GetLastError () returned 0x0 [0123.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0123.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.871] CharLowerBuffW (in: lpsz="csrss.exe", cchLength=0xa | out: lpsz="csrss.exe") returned 0xa [0123.871] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.871] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.871] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0123.871] GetLastError () returned 0x0 [0123.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="wininit.exe") returned 260 [0123.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0f4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.872] CharLowerBuffW (in: lpsz="wininit.exe", cchLength=0xc | out: lpsz="wininit.exe") returned 0xc [0123.872] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.872] VarBstrCmp (bstrLeft="wininit.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.872] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.872] GetLastError () returned 0x0 [0123.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0123.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.873] CharLowerBuffW (in: lpsz="csrss.exe", cchLength=0xa | out: lpsz="csrss.exe") returned 0xa [0123.873] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.873] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.873] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0123.873] GetLastError () returned 0x0 [0123.873] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="winlogon.exe") returned 260 [0123.873] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.874] CharLowerBuffW (in: lpsz="winlogon.exe", cchLength=0xd | out: lpsz="winlogon.exe") returned 0xd [0123.874] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.874] VarBstrCmp (bstrLeft="inlogon.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.874] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0123.874] GetLastError () returned 0x0 [0123.874] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="services.exe") returned 260 [0123.874] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0f4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.875] CharLowerBuffW (in: lpsz="services.exe", cchLength=0xd | out: lpsz="services.exe") returned 0xd [0123.875] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.875] VarBstrCmp (bstrLeft="ervices.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.875] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0123.875] GetLastError () returned 0x0 [0123.875] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="lsass.exe") returned 260 [0123.875] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.876] CharLowerBuffW (in: lpsz="lsass.exe", cchLength=0xa | out: lpsz="lsass.exe") returned 0xa [0123.876] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.876] VarBstrCmp (bstrLeft="lsass.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.876] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0123.876] GetLastError () returned 0x0 [0123.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="lsm.exe") returned 260 [0123.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.877] CharLowerBuffW (in: lpsz="lsm.exe", cchLength=0x8 | out: lpsz="lsm.exe") returned 0x8 [0123.877] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.877] VarBstrCmp (bstrLeft="lsm.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.877] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.877] GetLastError () returned 0x0 [0123.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0f4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.878] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.878] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.878] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.878] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.878] GetLastError () returned 0x0 [0123.878] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.878] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.879] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.879] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.879] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.879] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.879] GetLastError () returned 0x0 [0123.879] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.879] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.880] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.880] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.880] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.880] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.880] GetLastError () returned 0x0 [0123.880] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.880] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0f4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.881] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.881] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.881] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.881] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.881] GetLastError () returned 0x0 [0123.881] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.881] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.882] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.882] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.882] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.882] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0123.882] GetLastError () returned 0x0 [0123.882] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="audiodg.exe") returned 260 [0123.882] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.883] CharLowerBuffW (in: lpsz="audiodg.exe", cchLength=0xc | out: lpsz="audiodg.exe") returned 0xc [0123.883] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.883] VarBstrCmp (bstrLeft="audiodg.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.883] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.883] GetLastError () returned 0x0 [0123.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0f4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.884] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.884] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.884] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.884] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.884] GetLastError () returned 0x0 [0123.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.885] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.885] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.885] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.885] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0123.885] GetLastError () returned 0x0 [0123.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="dwm.exe") returned 260 [0123.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.886] CharLowerBuffW (in: lpsz="dwm.exe", cchLength=0x8 | out: lpsz="dwm.exe") returned 0x8 [0123.886] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.886] VarBstrCmp (bstrLeft="dwm.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.886] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0123.886] GetLastError () returned 0x0 [0123.886] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="explorer.exe") returned 260 [0123.886] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0f4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.886] CharLowerBuffW (in: lpsz="explorer.exe", cchLength=0xd | out: lpsz="explorer.exe") returned 0xd [0123.887] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.887] VarBstrCmp (bstrLeft="xplorer.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.887] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0123.887] GetLastError () returned 0x0 [0123.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="spoolsv.exe") returned 260 [0123.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.887] CharLowerBuffW (in: lpsz="spoolsv.exe", cchLength=0xc | out: lpsz="spoolsv.exe") returned 0xc [0123.887] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.887] VarBstrCmp (bstrLeft="spoolsv.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.888] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.888] GetLastError () returned 0x0 [0123.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.888] CharLowerBuffW (in: lpsz="svchost.exe", cchLength=0xc | out: lpsz="svchost.exe") returned 0xc [0123.888] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.888] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.888] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.889] GetLastError () returned 0x0 [0123.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0f4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.889] CharLowerBuffW (in: lpsz="taskhost.exe", cchLength=0xd | out: lpsz="taskhost.exe") returned 0xd [0123.889] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.889] VarBstrCmp (bstrLeft="askhost.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.889] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0123.890] GetLastError () returned 0x0 [0123.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskeng.exe") returned 260 [0123.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.890] CharLowerBuffW (in: lpsz="taskeng.exe", cchLength=0xc | out: lpsz="taskeng.exe") returned 0xc [0123.890] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.890] VarBstrCmp (bstrLeft="taskeng.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.890] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0123.890] GetLastError () returned 0x0 [0123.891] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0123.891] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd054, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.891] CharLowerBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xd | out: lpsz="wmiprvse.exe") returned 0xd [0123.891] CharLowerBuffW (in: lpsz="sqlceip.exe", cchLength=0xc | out: lpsz="sqlceip.exe") returned 0xc [0123.891] VarBstrCmp (bstrLeft="miprvse.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.891] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0123.891] GetLastError () returned 0x0 [0123.891] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0123.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e74c, cbMultiByte=1, lpWideCharStr=0x2fd0f4, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0123.892] CharLowerBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xd | out: lpsz="wmiprvse.exe") returned 0xd [0123.892] VarBstrCmp (bstrLeft="miprvse.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.892] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.892] GetLastError () returned 0x0 [0123.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.892] VarBstrCmp (bstrLeft="askhost.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.892] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zhang.exe")) returned 1 [0123.893] GetLastError () returned 0x0 [0123.893] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="zhang.exe") returned 260 [0123.893] VarBstrCmp (bstrLeft="zhang.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.893] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0123.893] GetLastError () returned 0x0 [0123.893] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="dllhost.exe") returned 260 [0123.893] VarBstrCmp (bstrLeft="dllhost.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.893] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0123.894] GetLastError () returned 0x0 [0123.894] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="VSSVC.exe") returned 260 [0123.894] VarBstrCmp (bstrLeft="vssvc.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.894] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.894] GetLastError () returned 0x0 [0123.894] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.894] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.894] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.895] GetLastError () returned 0x0 [0123.895] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.895] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.895] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.895] GetLastError () returned 0x0 [0123.895] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.895] VarBstrCmp (bstrLeft="askhost.exe", bstrRight="sqlceip.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.895] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0123.895] GetLastError () returned 0x12 [0123.896] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.896] CloseHandle (hObject=0x22c) returned 1 [0123.896] GetLastError () returned 0x0 [0123.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eae8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0123.896] GetVersionExA (in: lpVersionInformation=0x18ead4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18ead4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0123.896] GetLastError () returned 0x0 [0123.896] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18eae8, cbMultiByte=128, lpWideCharStr=0x18eb88, cchWideChar=128 | out: lpWideCharStr="Service Pack 1") returned 128 [0123.896] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9f0) returned 0x22c [0123.898] GetLastError () returned 0x0 [0123.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=260, lpMultiByteStr=0x18e8e4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 260 [0123.898] Process32First (in: hSnapshot=0x22c, lppe=0x18e8c0 | out: lppe=0x18e8c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.898] GetLastError () returned 0x0 [0123.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e8e4, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="[System Process]") returned 260 [0123.898] VarBstrCmp (bstrLeft="tem process]", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.898] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0123.899] GetLastError () returned 0x0 [0123.899] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="System") returned 260 [0123.899] VarBstrCmp (bstrLeft="system", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.899] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0123.899] GetLastError () returned 0x0 [0123.899] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="smss.exe") returned 260 [0123.899] VarBstrCmp (bstrLeft="smss.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.899] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.899] GetLastError () returned 0x0 [0123.899] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0123.899] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.899] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0123.900] GetLastError () returned 0x0 [0123.900] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="wininit.exe") returned 260 [0123.900] VarBstrCmp (bstrLeft="wininit.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.900] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.901] GetLastError () returned 0x0 [0123.901] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0123.901] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.901] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0123.902] GetLastError () returned 0x0 [0123.902] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="winlogon.exe") returned 260 [0123.902] VarBstrCmp (bstrLeft="winlogon.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.902] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0123.902] GetLastError () returned 0x0 [0123.902] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="services.exe") returned 260 [0123.902] VarBstrCmp (bstrLeft="services.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.902] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0123.903] GetLastError () returned 0x0 [0123.903] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="lsass.exe") returned 260 [0123.903] VarBstrCmp (bstrLeft="lsass.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.903] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0123.903] GetLastError () returned 0x0 [0123.903] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="lsm.exe") returned 260 [0123.903] VarBstrCmp (bstrLeft="lsm.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.903] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.904] GetLastError () returned 0x0 [0123.904] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.904] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.904] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.904] GetLastError () returned 0x0 [0123.904] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.904] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.904] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.905] GetLastError () returned 0x0 [0123.905] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.905] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.905] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.905] GetLastError () returned 0x0 [0123.905] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.905] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.906] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.906] GetLastError () returned 0x0 [0123.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.906] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.906] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0123.906] GetLastError () returned 0x0 [0123.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="audiodg.exe") returned 260 [0123.906] VarBstrCmp (bstrLeft="audiodg.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.906] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.907] GetLastError () returned 0x0 [0123.907] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.907] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.907] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.907] GetLastError () returned 0x0 [0123.907] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.907] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.907] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0123.908] GetLastError () returned 0x0 [0123.908] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="dwm.exe") returned 260 [0123.908] VarBstrCmp (bstrLeft="dwm.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.908] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0123.908] GetLastError () returned 0x0 [0123.908] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="explorer.exe") returned 260 [0123.908] VarBstrCmp (bstrLeft="explorer.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.908] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0123.908] GetLastError () returned 0x0 [0123.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="spoolsv.exe") returned 260 [0123.909] VarBstrCmp (bstrLeft="spoolsv.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.909] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.909] GetLastError () returned 0x0 [0123.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.909] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.909] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.909] GetLastError () returned 0x0 [0123.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.909] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.910] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0123.910] GetLastError () returned 0x0 [0123.910] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskeng.exe") returned 260 [0123.910] VarBstrCmp (bstrLeft="taskeng.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.910] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0123.910] GetLastError () returned 0x0 [0123.910] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0123.910] VarBstrCmp (bstrLeft="wmiprvse.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.910] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0123.911] GetLastError () returned 0x0 [0123.911] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0123.911] VarBstrCmp (bstrLeft="wmiprvse.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.911] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.911] GetLastError () returned 0x0 [0123.911] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.911] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.911] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zhang.exe")) returned 1 [0123.911] GetLastError () returned 0x0 [0123.911] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="zhang.exe") returned 260 [0123.912] VarBstrCmp (bstrLeft="zhang.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.912] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0123.912] GetLastError () returned 0x0 [0123.912] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="dllhost.exe") returned 260 [0123.912] VarBstrCmp (bstrLeft="dllhost.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.912] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0123.912] GetLastError () returned 0x0 [0123.912] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="VSSVC.exe") returned 260 [0123.912] VarBstrCmp (bstrLeft="vssvc.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.912] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.913] GetLastError () returned 0x0 [0123.913] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.913] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.913] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.913] GetLastError () returned 0x0 [0123.913] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.913] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.913] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.914] GetLastError () returned 0x0 [0123.914] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.914] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="tiworker.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.914] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0123.914] GetLastError () returned 0x12 [0123.914] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.914] CloseHandle (hObject=0x22c) returned 1 [0123.914] GetLastError () returned 0x0 [0123.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eae8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0123.915] GetVersionExA (in: lpVersionInformation=0x18ead4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18ead4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0123.915] GetLastError () returned 0x0 [0123.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18eae8, cbMultiByte=128, lpWideCharStr=0x18eb88, cchWideChar=128 | out: lpWideCharStr="Service Pack 1") returned 128 [0123.915] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9f0) returned 0x22c [0123.917] GetLastError () returned 0x0 [0123.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=260, lpMultiByteStr=0x18e8e4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 260 [0123.917] Process32First (in: hSnapshot=0x22c, lppe=0x18e8c0 | out: lppe=0x18e8c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.917] GetLastError () returned 0x0 [0123.917] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e8e4, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="[System Process]") returned 260 [0123.917] VarBstrCmp (bstrLeft="stem process]", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.917] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0123.917] GetLastError () returned 0x0 [0123.917] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="System") returned 260 [0123.918] VarBstrCmp (bstrLeft="system", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.918] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0123.918] GetLastError () returned 0x0 [0123.918] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="smss.exe") returned 260 [0123.918] VarBstrCmp (bstrLeft="smss.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.918] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.918] GetLastError () returned 0x0 [0123.918] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0123.918] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.918] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0123.919] GetLastError () returned 0x0 [0123.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="wininit.exe") returned 260 [0123.919] VarBstrCmp (bstrLeft="wininit.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.919] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.919] GetLastError () returned 0x0 [0123.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0123.919] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.919] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0123.919] GetLastError () returned 0x0 [0123.920] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="winlogon.exe") returned 260 [0123.920] VarBstrCmp (bstrLeft="winlogon.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.920] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0123.920] GetLastError () returned 0x0 [0123.920] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="services.exe") returned 260 [0123.920] VarBstrCmp (bstrLeft="services.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.920] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0123.920] GetLastError () returned 0x0 [0123.920] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="lsass.exe") returned 260 [0123.920] VarBstrCmp (bstrLeft="lsass.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.920] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0123.921] GetLastError () returned 0x0 [0123.921] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="lsm.exe") returned 260 [0123.921] VarBstrCmp (bstrLeft="lsm.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.921] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.921] GetLastError () returned 0x0 [0123.921] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.921] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.921] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.922] GetLastError () returned 0x0 [0123.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.922] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.922] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.922] GetLastError () returned 0x0 [0123.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.922] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.922] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.922] GetLastError () returned 0x0 [0123.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.922] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.923] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.923] GetLastError () returned 0x0 [0123.923] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.923] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.923] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0123.923] GetLastError () returned 0x0 [0123.923] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="audiodg.exe") returned 260 [0123.923] VarBstrCmp (bstrLeft="audiodg.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.923] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.924] GetLastError () returned 0x0 [0123.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.924] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.924] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.924] GetLastError () returned 0x0 [0123.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.924] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.924] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0123.925] GetLastError () returned 0x0 [0123.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="dwm.exe") returned 260 [0123.925] VarBstrCmp (bstrLeft="dwm.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.925] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0123.925] GetLastError () returned 0x0 [0123.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="explorer.exe") returned 260 [0123.925] VarBstrCmp (bstrLeft="explorer.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.925] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0123.925] GetLastError () returned 0x0 [0123.926] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="spoolsv.exe") returned 260 [0123.926] VarBstrCmp (bstrLeft="spoolsv.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.926] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.926] GetLastError () returned 0x0 [0123.926] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.926] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.926] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.926] GetLastError () returned 0x0 [0123.926] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.926] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.927] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0123.927] GetLastError () returned 0x0 [0123.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskeng.exe") returned 260 [0123.927] VarBstrCmp (bstrLeft="taskeng.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.927] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0123.927] GetLastError () returned 0x0 [0123.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0123.927] VarBstrCmp (bstrLeft="wmiprvse.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.927] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0123.928] GetLastError () returned 0x0 [0123.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="WmiPrvSE.exe") returned 260 [0123.928] VarBstrCmp (bstrLeft="wmiprvse.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.928] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.928] GetLastError () returned 0x0 [0123.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.928] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.928] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zhang.exe")) returned 1 [0123.929] GetLastError () returned 0x0 [0123.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="zhang.exe") returned 260 [0123.929] VarBstrCmp (bstrLeft="zhang.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.929] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0123.929] GetLastError () returned 0x0 [0123.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="dllhost.exe") returned 260 [0123.929] VarBstrCmp (bstrLeft="dllhost.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.929] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0123.929] GetLastError () returned 0x0 [0123.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="VSSVC.exe") returned 260 [0123.929] VarBstrCmp (bstrLeft="vssvc.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.930] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.930] GetLastError () returned 0x0 [0123.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.930] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.930] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.930] GetLastError () returned 0x0 [0123.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.930] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.930] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.931] GetLastError () returned 0x0 [0123.931] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.931] VarBstrCmp (bstrLeft="taskhost.exe", bstrRight="mcbuilder.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.931] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0123.931] GetLastError () returned 0x12 [0123.931] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="taskhost.exe") returned 260 [0123.932] CloseHandle (hObject=0x22c) returned 1 [0123.932] GetLastError () returned 0x0 [0123.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" ", cchWideChar=128, lpMultiByteStr=0x18eae8, cbMultiByte=128, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ", lpUsedDefaultChar=0x0) returned 128 [0123.933] GetVersionExA (in: lpVersionInformation=0x18ead4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18ead4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0123.933] GetLastError () returned 0x0 [0123.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18eae8, cbMultiByte=128, lpWideCharStr=0x18eb88, cchWideChar=128 | out: lpWideCharStr="Service Pack 1") returned 128 [0123.933] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9f0) returned 0x22c [0123.935] GetLastError () returned 0x0 [0123.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=260, lpMultiByteStr=0x18e8e4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 260 [0123.936] Process32First (in: hSnapshot=0x22c, lppe=0x18e8c0 | out: lppe=0x18e8c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.936] GetLastError () returned 0x0 [0123.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e8e4, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="[System Process]") returned 260 [0123.937] VarBstrCmp (bstrLeft="em process]", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.937] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0123.937] GetLastError () returned 0x0 [0123.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="System") returned 260 [0123.937] VarBstrCmp (bstrLeft="system", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.937] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0123.938] GetLastError () returned 0x0 [0123.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="smss.exe") returned 260 [0123.938] VarBstrCmp (bstrLeft="smss.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.938] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.938] GetLastError () returned 0x0 [0123.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0123.938] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.938] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0123.939] GetLastError () returned 0x0 [0123.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="wininit.exe") returned 260 [0123.939] VarBstrCmp (bstrLeft="wininit.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.939] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.939] GetLastError () returned 0x0 [0123.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="csrss.exe") returned 260 [0123.939] VarBstrCmp (bstrLeft="csrss.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.940] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0123.940] GetLastError () returned 0x0 [0123.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="winlogon.exe") returned 260 [0123.940] VarBstrCmp (bstrLeft="inlogon.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.940] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0123.941] GetLastError () returned 0x0 [0123.941] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="services.exe") returned 260 [0123.941] VarBstrCmp (bstrLeft="ervices.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.941] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0123.941] GetLastError () returned 0x0 [0123.941] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="lsass.exe") returned 260 [0123.941] VarBstrCmp (bstrLeft="lsass.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.941] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0123.942] GetLastError () returned 0x0 [0123.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="lsm.exe") returned 260 [0123.942] VarBstrCmp (bstrLeft="lsm.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.942] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.942] GetLastError () returned 0x0 [0123.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.942] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.943] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.943] GetLastError () returned 0x0 [0123.943] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.943] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.943] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.944] GetLastError () returned 0x0 [0123.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.944] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.944] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.944] GetLastError () returned 0x0 [0123.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.945] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.945] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.945] GetLastError () returned 0x0 [0123.945] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.945] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.945] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0123.946] GetLastError () returned 0x0 [0123.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="audiodg.exe") returned 260 [0123.946] VarBstrCmp (bstrLeft="audiodg.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.946] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.946] GetLastError () returned 0x0 [0123.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.946] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.946] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.947] GetLastError () returned 0x0 [0123.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.947] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.947] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0123.947] GetLastError () returned 0x0 [0123.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="dwm.exe") returned 260 [0123.947] VarBstrCmp (bstrLeft="dwm.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.947] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0123.947] GetLastError () returned 0x0 [0123.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="explorer.exe") returned 260 [0123.948] VarBstrCmp (bstrLeft="xplorer.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.948] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0123.948] GetLastError () returned 0x0 [0123.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="spoolsv.exe") returned 260 [0123.948] VarBstrCmp (bstrLeft="spoolsv.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.948] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.948] GetLastError () returned 0x0 [0123.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e7bc, cbMultiByte=260, lpWideCharStr=0x18ea64, cchWideChar=260 | out: lpWideCharStr="svchost.exe") returned 260 [0123.949] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.949] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.949] VarBstrCmp (bstrLeft="askhost.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.949] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0123.949] VarBstrCmp (bstrLeft="taskeng.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.949] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0123.950] VarBstrCmp (bstrLeft="miprvse.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.950] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0123.950] VarBstrCmp (bstrLeft="miprvse.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.950] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.950] VarBstrCmp (bstrLeft="askhost.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.950] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa9c, pcPriClassBase=8, dwFlags=0x0, szExeFile="zhang.exe")) returned 1 [0123.951] VarBstrCmp (bstrLeft="zhang.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.951] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0123.951] VarBstrCmp (bstrLeft="dllhost.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.951] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0123.951] VarBstrCmp (bstrLeft="vssvc.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.951] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.963] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.963] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.963] VarBstrCmp (bstrLeft="svchost.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.963] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.964] VarBstrCmp (bstrLeft="askhost.exe", bstrRight="jenkins.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.964] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0123.965] GetVersionExA (in: lpVersionInformation=0x18ead4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion=" ") | out: lpVersionInformation=0x18ead4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0123.965] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x18e9f0) returned 0x22c [0123.967] Process32First (in: hSnapshot=0x22c, lppe=0x18e8c0 | out: lppe=0x18e8c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.967] VarBstrCmp (bstrLeft="process]", bstrRight="java.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.967] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0123.968] VarBstrCmp (bstrLeft="system", bstrRight="java.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.968] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0123.969] VarBstrCmp (bstrLeft="smss.exe", bstrRight="java.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.969] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.969] VarBstrCmp (bstrLeft="srss.exe", bstrRight="java.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.969] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0123.969] VarBstrCmp (bstrLeft="init.exe", bstrRight="java.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.969] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.970] VarBstrCmp (bstrLeft="srss.exe", bstrRight="java.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.970] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0123.970] VarBstrCmp (bstrLeft="ogon.exe", bstrRight="java.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.970] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0123.970] VarBstrCmp (bstrLeft="ices.exe", bstrRight="java.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.970] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0123.971] VarBstrCmp (bstrLeft="sass.exe", bstrRight="java.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.971] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0123.971] VarBstrCmp (bstrLeft="lsm.exe", bstrRight="java.exe", lcid=0x0, dwFlags=0x30001) returned 0x2 [0123.971] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.971] VarBstrCmp (bstrLeft="host.exe", bstrRight="java.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.971] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.972] VarBstrCmp (bstrLeft="host.exe", bstrRight="java.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.972] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.972] VarBstrCmp (bstrLeft="host.exe", bstrRight="java.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.972] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.972] VarBstrCmp (bstrLeft="host.exe", bstrRight="java.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.972] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.973] VarBstrCmp (bstrLeft="host.exe", bstrRight="java.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.973] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0123.973] VarBstrCmp (bstrLeft="iodg.exe", bstrRight="java.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.973] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.973] VarBstrCmp (bstrLeft="host.exe", bstrRight="java.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.973] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.974] VarBstrCmp (bstrLeft="host.exe", bstrRight="java.exe", lcid=0x0, dwFlags=0x30001) returned 0x0 [0123.974] Process32Next (in: hSnapshot=0x22c, lppe=0x18e798 | out: lppe=0x18e798*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0123.977] ShellExecuteA (hwnd=0x5026a, lpOperation="open", lpFile="taskkill.exe", lpParameters="/F /IM MSExchange*", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0123.977] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0125.571] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0125.572] ShellExecuteA (hwnd=0x5026a, lpOperation="open", lpFile="taskkill.exe", lpParameters="/F /IM Microsoft*", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0125.572] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0126.385] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0126.385] ShellExecuteA (hwnd=0x5026a, lpOperation="open", lpFile="taskkill.exe", lpParameters="/F /IM ora*", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0126.386] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0126.414] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0126.415] ShellExecuteA (hwnd=0x5026a, lpOperation="open", lpFile="taskkill.exe", lpParameters="/F /IM tns*", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0126.415] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0126.443] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0126.443] ShellExecuteA (hwnd=0x5026a, lpOperation="open", lpFile="taskkill.exe", lpParameters="/F /IM mysql*", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0126.444] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0126.470] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0126.471] ShellExecuteA (hwnd=0x5026a, lpOperation="open", lpFile="taskkill.exe", lpParameters="/F /IM sql*", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0126.471] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0126.679] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0126.680] ShellExecuteA (hwnd=0x5026a, lpOperation="open", lpFile="taskkill.exe", lpParameters="/F /IM postgres*", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0126.680] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0126.711] NtdllDefWindowProc_A (hWnd=0x4015c, Msg=0x4e, wParam=0x0, lParam=0x18eb60) returned 0x0 [0126.711] CreateBindCtx (in: reserved=0x0, ppbc=0x18ec40 | out: ppbc=0x18ec40*=0x4fed370) returned 0x0 [0126.712] MkParseDisplayName (in: pbc=0x4fed370, szUserName="winmgmts:", pchEaten=0x18ec3c, ppmk=0x18ec44 | out: pchEaten=0x18ec3c, ppmk=0x18ec44*=0x50148f8) returned 0x0 [0126.713] DllGetClassObject (in: rclsid=0x342cac*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x7666f084*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb94 | out: ppv=0x18eb94*=0x0) returned 0x80004002 [0126.713] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeb500 [0126.713] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0126.713] DllGetClassObject (in: rclsid=0x342cac*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x7666ee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ea18 | out: ppv=0x18ea18*=0x4aeb500) returned 0x0 [0126.713] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeb500 [0126.714] WinMGMTS:IClassFactory:CreateInstance (in: This=0x4aeb500, pUnkOuter=0x0, riid=0x7666f084*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9c4 | out: ppvObject=0x18e9c4*=0x4ae0810) returned 0x0 [0126.714] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0810 [0126.714] WinMGMTS:IUnknown:Release (This=0x4aeb500) returned 0x0 [0126.714] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0126.714] WinMGMTS:IParseDisplayName:ParseDisplayName (in: This=0x4ae0810, pbc=0x4fed370, pszDisplayName="winmgmts:", pchEaten=0x18ebdc, ppmkOut=0x18ebe0 | out: pchEaten=0x18ebdc*=0x9, ppmkOut=0x18ebe0*=0x50148f8) returned 0x0 [0126.714] _wcsnicmp (_String1="winmgmts:", _String2="WINMGMTS:", _MaxCount=0x9) returned 0 [0126.714] IBindCtx:GetObjectParam (in: This=0x4fed370, pszKey="WmiObject", ppunk=0x18eae4 | out: ppunk=0x18eae4*=0x0) returned 0x80004005 [0126.714] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece58 [0126.714] _wcsnicmp (_String1="", _String2="{", _MaxCount=0x1) returned -123 [0126.714] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aecdc0 [0126.714] CoCreateInstance (in: rclsid=0x753e42b0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x753e42a0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x4aecdd8 | out: ppv=0x4aecdd8*=0x4aece28) returned 0x0 [0126.715] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0850 [0126.715] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae08b8 [0126.715] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeced8 [0126.715] GetCurrentThreadId () returned 0xa94 [0126.715] _wcsnicmp (_String1="", _String2="[", _MaxCount=0x1) returned -91 [0126.715] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0126.715] GetCurrentThreadId () returned 0xa94 [0126.715] CoCreateInstance (in: rclsid=0x753e53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x753e50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x18ea00 | out: ppv=0x18ea00*=0x4ae0918) returned 0x0 [0126.716] SysStringLen (param_1=".") returned 0x1 [0126.716] WbemDefPath:IWbemPath:SetServer (This=0x4ae0918, Name=".") returned 0x0 [0126.716] CoCreateInstance (in: rclsid=0x753e53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x753e50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x18e9b8 | out: ppv=0x18e9b8*=0x4ae09b0) returned 0x0 [0126.716] CoCreateInstance (in: rclsid=0x753e53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x753e50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x18e95c | out: ppv=0x18e95c*=0x4ae0a48) returned 0x0 [0126.716] WbemDefPath:IWbemPath:SetText (This=0x4ae0a48, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0126.716] WbemDefPath:IUnknown:Release (This=0x4ae0a48) returned 0x0 [0126.717] SysStringLen (param_1="root\\cimv2") returned 0xa [0126.717] WbemDefPath:IWbemPath:SetText (This=0x4ae09b0, uMode=0xc, pszPath="root\\cimv2") returned 0x0 [0126.717] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4ae09b0, puCount=0x18e9c8 | out: puCount=0x18e9c8*=0x2) returned 0x0 [0126.717] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x4ae0918) returned 0x0 [0126.717] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4ae09b0, uIndex=0x0, puNameBufLength=0x18e990*=0x0, pName=0x0 | out: puNameBufLength=0x18e990*=0x5, pName=0x0) returned 0x0 [0126.717] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeb458 [0126.717] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4ae09b0, uIndex=0x0, puNameBufLength=0x18e990*=0x5, pName="\x02" | out: puNameBufLength=0x18e990*=0x5, pName="root") returned 0x0 [0126.717] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0126.717] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4ae0918, uIndex=0x0, pszName="root") returned 0x0 [0126.717] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4ae09b0, uIndex=0x1, puNameBufLength=0x18e990*=0x0, pName=0x0 | out: puNameBufLength=0x18e990*=0x6, pName=0x0) returned 0x0 [0126.717] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeb518 [0126.717] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4ae09b0, uIndex=0x1, puNameBufLength=0x18e990*=0x6, pName="\x08" | out: puNameBufLength=0x18e990*=0x6, pName="cimv2") returned 0x0 [0126.717] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0126.717] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4ae0918, uIndex=0x1, pszName="cimv2") returned 0x0 [0126.717] WbemDefPath:IUnknown:Release (This=0x4ae09b0) returned 0x0 [0126.718] WbemDefPath:IWbemPath:GetText (in: This=0x4ae0918, lFlags=4, puBuffLength=0x18e9e4*=0x0, pszText=0x0 | out: puBuffLength=0x18e9e4*=0xf, pszText=0x0) returned 0x0 [0126.718] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0b38 [0126.718] WbemDefPath:IWbemPath:GetText (in: This=0x4ae0918, lFlags=4, puBuffLength=0x18e9e4*=0xf, pszText="রҮநҮ2" | out: puBuffLength=0x18e9e4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.718] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0126.718] WbemDefPath:IUnknown:Release (This=0x4ae0918) returned 0x0 [0126.718] WbemLocator:IWbemLocator:ConnectServer (in: This=0x4aece28, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x18ea6c | out: ppNamespace=0x18ea6c*=0x4ae09dc) returned 0x0 [0126.720] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0126.720] GetCurrentThreadId () returned 0xa94 [0126.720] GetCurrentThreadId () returned 0xa94 [0126.720] GetCurrentThreadId () returned 0xa94 [0126.720] PeekMessageA (in: lpMsg=0x18d538, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d538) returned 0 [0126.721] PeekMessageA (in: lpMsg=0x18d538, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d538) returned 0 [0126.721] PeekMessageA (in: lpMsg=0x18d538, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d538) returned 1 [0126.721] PeekMessageA (in: lpMsg=0x18d538, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d538) returned 1 [0126.721] PeekMessageA (in: lpMsg=0x18d538, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d538) returned 0 [0126.731] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x10, dwPendingType=0x1) returned 0x2 [0126.731] GetCurrentThreadId () returned 0xa94 [0126.731] GetCurrentThreadId () returned 0xa94 [0126.731] GetCurrentThreadId () returned 0xa94 [0126.731] PeekMessageA (in: lpMsg=0x18d538, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18d538) returned 0 [0126.731] PeekMessageA (in: lpMsg=0x18d538, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18d538) returned 0 [0126.732] PeekMessageA (in: lpMsg=0x18d538, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d538) returned 1 [0126.732] PeekMessageA (in: lpMsg=0x18d538, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18d538) returned 0 [0126.839] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0126.839] GetCurrentThreadId () returned 0xa94 [0126.840] GetCurrentThreadId () returned 0xa94 [0126.840] GetCurrentThreadId () returned 0xa94 [0126.840] PeekMessageA (in: lpMsg=0x18df58, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18df58) returned 0 [0126.840] PeekMessageA (in: lpMsg=0x18df58, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18df58) returned 0 [0126.840] PeekMessageA (in: lpMsg=0x18df58, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18df58) returned 1 [0126.840] PeekMessageA (in: lpMsg=0x18df58, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18df58) returned 0 [0126.878] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0126.878] GetCurrentThreadId () returned 0xa94 [0126.878] GetCurrentThreadId () returned 0xa94 [0126.878] GetCurrentThreadId () returned 0xa94 [0126.879] PeekMessageA (in: lpMsg=0x18e0a8, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e0a8) returned 0 [0126.879] PeekMessageA (in: lpMsg=0x18e0a8, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e0a8) returned 0 [0126.879] PeekMessageA (in: lpMsg=0x18e0a8, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e0a8) returned 0 [0126.924] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0126.924] GetCurrentThreadId () returned 0xa94 [0126.925] GetCurrentThreadId () returned 0xa94 [0126.925] GetCurrentThreadId () returned 0xa94 [0126.925] PeekMessageA (in: lpMsg=0x18e118, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e118) returned 0 [0126.925] PeekMessageA (in: lpMsg=0x18e118, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e118) returned 0 [0126.925] PeekMessageA (in: lpMsg=0x18e118, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e118) returned 0 [0126.927] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0126.927] GetCurrentThreadId () returned 0xa94 [0126.927] GetCurrentThreadId () returned 0xa94 [0126.927] GetCurrentThreadId () returned 0xa94 [0126.927] PeekMessageA (in: lpMsg=0x18e110, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e110) returned 0 [0126.927] PeekMessageA (in: lpMsg=0x18e110, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e110) returned 0 [0126.928] PeekMessageA (in: lpMsg=0x18e110, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e110) returned 0 [0126.935] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0918 [0126.935] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae09f0 [0126.935] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ae0a50 [0126.935] WbemLocator:IUnknown:QueryInterface (in: This=0x4ae09dc, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e93c | out: ppvObject=0x18e93c*=0x5007754) returned 0x0 [0126.936] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5007754, pProxy=0x4ae09dc, pAuthnSvc=0x18e92c, pAuthzSvc=0x18e930, pServerPrincName=0x0, pAuthnLevel=0x18e958, pImpLevel=0x18e954, pAuthInfo=0x0, pCapabilites=0x18e944 | out: pAuthnSvc=0x18e92c*=0xa, pAuthzSvc=0x18e930*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18e958*=0x6, pImpLevel=0x18e954*=0x2, pAuthInfo=0x0, pCapabilites=0x18e944*=0x1) returned 0x0 [0126.936] WbemLocator:IUnknown:Release (This=0x5007754) returned 0x1 [0126.936] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0126.936] GetCurrentThreadId () returned 0xa94 [0126.936] WbemLocator:IUnknown:QueryInterface (in: This=0x4ae09dc, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e96c | out: ppvObject=0x18e96c*=0x5007754) returned 0x0 [0126.936] WbemLocator:IClientSecurity:CopyProxy (in: This=0x5007754, pProxy=0x4ae09dc, ppCopy=0x18e970 | out: ppCopy=0x18e970*=0x4ae0b4c) returned 0x0 [0126.936] WbemLocator:IUnknown:QueryInterface (in: This=0x4ae0b4c, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e888 | out: ppvObject=0x18e888*=0x5007754) returned 0x0 [0126.936] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5007754, pProxy=0x4ae0b4c, pAuthnSvc=0x18e8ac, pAuthzSvc=0x18e89c, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x18e8ac*=0xa, pAuthzSvc=0x18e89c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0126.936] WbemLocator:IUnknown:Release (This=0x5007754) returned 0x3 [0126.936] WbemLocator:IUnknown:QueryInterface (in: This=0x4ae0b4c, riid=0x753e34f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e860 | out: ppvObject=0x18e860*=0x5007774) returned 0x0 [0126.937] WbemLocator:IUnknown:QueryInterface (in: This=0x4ae0b4c, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e864 | out: ppvObject=0x18e864*=0x5007754) returned 0x0 [0126.937] WbemLocator:IClientSecurity:SetBlanket (This=0x5007754, pProxy=0x4ae0b4c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0126.937] WbemLocator:IUnknown:Release (This=0x5007754) returned 0x4 [0126.937] WbemLocator:IUnknown:Release (This=0x5007774) returned 0x3 [0126.937] WbemLocator:IUnknown:Release (This=0x5007754) returned 0x2 [0126.937] WbemLocator:IUnknown:AddRef (This=0x4ae0b4c) returned 0x3 [0126.937] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeda40 [0126.937] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aeceb8 [0126.937] WbemLocator:IUnknown:Release (This=0x4ae09dc) returned 0x2 [0126.937] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0126.938] GetCurrentThreadId () returned 0xa94 [0126.938] GetCurrentThreadId () returned 0xa94 [0126.938] WbemLocator:IUnknown:QueryInterface (in: This=0x4ae0b4c, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea30 | out: ppvObject=0x18ea30*=0x5007754) returned 0x0 [0126.938] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5007754, pProxy=0x4ae0b4c, pAuthnSvc=0x18ea20, pAuthzSvc=0x18ea24, pServerPrincName=0x0, pAuthnLevel=0x18ea50, pImpLevel=0x18ea54, pAuthInfo=0x0, pCapabilites=0x18ea38 | out: pAuthnSvc=0x18ea20*=0xa, pAuthzSvc=0x18ea24*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18ea50*=0x6, pImpLevel=0x18ea54*=0x3, pAuthInfo=0x0, pCapabilites=0x18ea38*=0x20) returned 0x0 [0126.938] WbemLocator:IUnknown:Release (This=0x5007754) returned 0x2 [0126.938] CreatePointerMoniker (in: punk=0x4ae0918, ppmk=0x18ebe0 | out: ppmk=0x18ebe0*=0x50148f8) returned 0x0 [0126.938] IUnknown:AddRef (This=0x4ae0918) returned 0x2 [0126.938] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0126.939] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0126.939] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0126.939] WbemLocator:IUnknown:Release (This=0x4aece28) returned 0x0 [0126.939] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0126.939] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0126.939] WinMGMTS:IUnknown:Release (This=0x4ae0810) returned 0x0 [0126.939] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0126.939] IUnknown:Release (This=0x4fed370) returned 0x0 [0126.939] BindMoniker (in: pmk=0x50148f8, grfOpt=0x0, iidResult=0x7295a460*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvResult=0x18ec58 | out: ppvResult=0x18ec58*=0x4ae0918) returned 0x0 [0126.939] IUnknown:QueryInterface (in: This=0x4ae0918, riid=0x7295a460*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec58 | out: ppvObject=0x18ec58*=0x4ae0918) returned 0x0 [0126.940] IUnknown:Release (This=0x50148f8) returned 0x0 [0126.940] IUnknown:Release (This=0x4ae0918) returned 0x1 [0126.940] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18eb8c*=0x0 | out: pptlib=0x18eb8c*=0x5196740) returned 0x0 [0126.944] ITypeLib:GetTypeInfoOfGuid (in: This=0x5196740, GUID=0x4ae094c*(Data1=0xd2f68443, Data2=0x85dc, Data3=0x427e, Data4=([0]=0x91, [1]=0xd8, [2]=0x36, [3]=0x65, [4]=0x54, [5]=0xcc, [6]=0x75, [7]=0x4c)), ppTInfo=0x4ae0940 | out: ppTInfo=0x4ae0940*=0x5194c2c) returned 0x0 [0126.944] IUnknown:Release (This=0x5196740) returned 0x1 [0126.944] IUnknown:AddRef (This=0x5194c2c) returned 0x2 [0126.944] DispGetIDsOfNames (in: ptinfo=0x5194c2c, rgszNames=0x18ebe8*="ExecQuery", cNames=0x1, rgdispid=0x18ebec | out: rgdispid=0x18ebec*=9) returned 0x0 [0126.945] IUnknown:Release (This=0x5194c2c) returned 0x1 [0126.945] IUnknown:AddRef (This=0x5194c2c) returned 0x2 [0126.945] ITypeInfo:LocalInvoke (This=0x5194c2c) returned 0x0 [0126.945] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0126.945] GetCurrentThreadId () returned 0xa94 [0126.945] WbemLocator:IUnknown:AddRef (This=0x4ae0b4c) returned 0x3 [0126.946] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0126.946] GetCurrentThreadId () returned 0xa94 [0126.946] IWbemServices:ExecQuery (in: This=0x4ae0b4c, strQueryLanguage="WQL", strQuery="SELECT Name FROM Win32_Process WHERE Name='w3wp.exe'", lFlags=272, pCtx=0x0, ppEnum=0x18e95c | out: ppEnum=0x18e95c*=0x4ae08dc) returned 0x0 [0126.946] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0126.946] GetCurrentThreadId () returned 0xa94 [0126.946] GetCurrentThreadId () returned 0xa94 [0126.947] GetCurrentThreadId () returned 0xa94 [0126.947] PeekMessageA (in: lpMsg=0x18e15c, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e15c) returned 0 [0126.947] PeekMessageA (in: lpMsg=0x18e15c, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e15c) returned 0 [0126.947] PeekMessageA (in: lpMsg=0x18e15c, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e15c) returned 0 [0126.947] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xf, dwPendingType=0x1) returned 0x2 [0126.947] GetCurrentThreadId () returned 0xa94 [0126.947] GetCurrentThreadId () returned 0xa94 [0126.947] GetCurrentThreadId () returned 0xa94 [0126.948] PeekMessageA (in: lpMsg=0x18e15c, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e15c) returned 0 [0126.948] PeekMessageA (in: lpMsg=0x18e15c, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e15c) returned 0 [0126.948] PeekMessageA (in: lpMsg=0x18e15c, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e15c) returned 1 [0126.948] PeekMessageA (in: lpMsg=0x18e15c, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e15c) returned 0 [0126.961] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aecdc0 [0126.961] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aedaa0 [0126.961] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aedb00 [0126.961] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aece58 [0126.962] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4aedb60 [0126.962] IUnknown:QueryInterface (in: This=0x4ae08dc, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e874 | out: ppvObject=0x18e874*=0x4ae08e0) returned 0x0 [0126.962] IClientSecurity:QueryBlanket (in: This=0x4ae08e0, pProxy=0x4ae08dc, pAuthnSvc=0x18e864, pAuthzSvc=0x18e868, pServerPrincName=0x0, pAuthnLevel=0x18e890, pImpLevel=0x18e88c, pAuthInfo=0x0, pCapabilites=0x18e87c | out: pAuthnSvc=0x18e864*=0xa, pAuthzSvc=0x18e868*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18e890*=0x6, pImpLevel=0x18e88c*=0x2, pAuthInfo=0x0, pCapabilites=0x18e87c*=0x1) returned 0x0 [0126.962] IUnknown:Release (This=0x4ae08e0) returned 0x1 [0126.962] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0126.962] GetCurrentThreadId () returned 0xa94 [0126.962] WbemLocator:IUnknown:QueryInterface (in: This=0x4ae0b4c, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e858 | out: ppvObject=0x18e858*=0x5007754) returned 0x0 [0126.963] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5007754, pProxy=0x4ae0b4c, pAuthnSvc=0x18e848, pAuthzSvc=0x18e84c, pServerPrincName=0x0, pAuthnLevel=0x18e878, pImpLevel=0x18e87c, pAuthInfo=0x0, pCapabilites=0x18e860 | out: pAuthnSvc=0x18e848*=0xa, pAuthzSvc=0x18e84c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18e878*=0x6, pImpLevel=0x18e87c*=0x3, pAuthInfo=0x0, pCapabilites=0x18e860*=0x20) returned 0x0 [0126.963] WbemLocator:IUnknown:Release (This=0x5007754) returned 0x3 [0126.963] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0126.963] GetCurrentThreadId () returned 0xa94 [0126.963] WbemLocator:IUnknown:QueryInterface (in: This=0x4ae0b4c, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e858 | out: ppvObject=0x18e858*=0x5007754) returned 0x0 [0126.963] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5007754, pProxy=0x4ae0b4c, pAuthnSvc=0x18e848, pAuthzSvc=0x18e84c, pServerPrincName=0x0, pAuthnLevel=0x18e87c, pImpLevel=0x18e878, pAuthInfo=0x0, pCapabilites=0x18e860 | out: pAuthnSvc=0x18e848*=0xa, pAuthzSvc=0x18e84c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18e87c*=0x6, pImpLevel=0x18e878*=0x3, pAuthInfo=0x0, pCapabilites=0x18e860*=0x20) returned 0x0 [0126.963] WbemLocator:IUnknown:Release (This=0x5007754) returned 0x3 [0126.963] IUnknown:QueryInterface (in: This=0x4ae08dc, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e8a4 | out: ppvObject=0x18e8a4*=0x4ae08e0) returned 0x0 [0126.964] IClientSecurity:CopyProxy (in: This=0x4ae08e0, pProxy=0x4ae08dc, ppCopy=0x18e8a8 | out: ppCopy=0x18e8a8*=0x4aedca4) returned 0x0 [0126.964] IUnknown:QueryInterface (in: This=0x4aedca4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e7c0 | out: ppvObject=0x18e7c0*=0x4aedca8) returned 0x0 [0126.964] IClientSecurity:QueryBlanket (in: This=0x4aedca8, pProxy=0x4aedca4, pAuthnSvc=0x18e7e4, pAuthzSvc=0x18e7d4, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x18e7e4*=0xa, pAuthzSvc=0x18e7d4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0126.964] IUnknown:Release (This=0x4aedca8) returned 0x3 [0126.964] IUnknown:QueryInterface (in: This=0x4aedca4, riid=0x753e34f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e798 | out: ppvObject=0x18e798*=0x4fefe7c) returned 0x0 [0126.964] IUnknown:QueryInterface (in: This=0x4aedca4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e79c | out: ppvObject=0x18e79c*=0x4aedca8) returned 0x0 [0126.964] IClientSecurity:SetBlanket (This=0x4aedca8, pProxy=0x4aedca4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0126.965] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0126.965] GetCurrentThreadId () returned 0xa94 [0126.965] GetCurrentThreadId () returned 0xa94 [0126.965] GetCurrentThreadId () returned 0xa94 [0126.965] PeekMessageA (in: lpMsg=0x18de08, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18de08) returned 0 [0126.965] PeekMessageA (in: lpMsg=0x18de08, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18de08) returned 0 [0126.965] PeekMessageA (in: lpMsg=0x18de08, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18de08) returned 0 [0126.967] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0126.967] GetCurrentThreadId () returned 0xa94 [0126.967] GetCurrentThreadId () returned 0xa94 [0126.967] GetCurrentThreadId () returned 0xa94 [0126.967] PeekMessageA (in: lpMsg=0x18df54, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18df54) returned 0 [0126.967] PeekMessageA (in: lpMsg=0x18df54, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18df54) returned 0 [0126.967] PeekMessageA (in: lpMsg=0x18df54, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18df54) returned 0 [0126.968] IUnknown:Release (This=0x4aedca8) returned 0x4 [0126.969] WbemLocator:IUnknown:Release (This=0x4fefe7c) returned 0x3 [0126.969] IUnknown:Release (This=0x4ae08e0) returned 0x2 [0126.969] IUnknown:AddRef (This=0x4aedca4) returned 0x3 [0126.969] IUnknown:Release (This=0x4ae08dc) returned 0x2 [0126.969] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x18e914 | out: pperrinfo=0x18e914*=0x0) returned 0x1 [0126.969] WbemLocator:IUnknown:Release (This=0x4ae0b4c) returned 0x2 [0126.969] IUnknown:Release (This=0x5194c2c) returned 0x1 [0126.969] LoadRegTypeLib (in: rguid=0x753e364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x18eba4*=0x0 | out: pptlib=0x18eba4*=0x5196740) returned 0x0 [0126.971] ITypeLib:GetTypeInfoOfGuid (in: This=0x5196740, GUID=0x4aecde8*(Data1=0x76a6415f, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x4aecddc | out: ppTInfo=0x4aecddc*=0x5194cdc) returned 0x0 [0126.971] IUnknown:Release (This=0x5196740) returned 0x2 [0126.971] IUnknown:AddRef (This=0x5194cdc) returned 0x2 [0126.972] DispGetIDsOfNames (in: ptinfo=0x5194cdc, rgszNames=0x18ec00*="Count", cNames=0x1, rgdispid=0x18ec04 | out: rgdispid=0x18ec04*=1) returned 0x0 [0126.972] IUnknown:Release (This=0x5194cdc) returned 0x1 [0126.972] IUnknown:AddRef (This=0x5194cdc) returned 0x2 [0126.972] ITypeInfo:LocalInvoke (This=0x5194cdc) returned 0x0 [0126.972] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0126.972] GetCurrentThreadId () returned 0xa94 [0126.972] IUnknown:AddRef (This=0x4aedca4) returned 0x3 [0126.972] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0126.972] GetCurrentThreadId () returned 0xa94 [0126.972] IEnumWbemClassObject:Clone (in: This=0x4aedca4, ppEnum=0x18ea2c | out: ppEnum=0x18ea2c*=0x4aedd6c) returned 0x0 [0126.973] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0126.973] GetCurrentThreadId () returned 0xa94 [0126.973] GetCurrentThreadId () returned 0xa94 [0126.973] GetCurrentThreadId () returned 0xa94 [0126.973] PeekMessageA (in: lpMsg=0x18e260, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e260) returned 0 [0126.974] PeekMessageA (in: lpMsg=0x18e260, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e260) returned 0 [0126.974] PeekMessageA (in: lpMsg=0x18e260, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e260) returned 0 [0126.975] IUnknown:QueryInterface (in: This=0x4aedca4, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9e4 | out: ppvObject=0x18e9e4*=0x4aedca8) returned 0x0 [0126.975] IClientSecurity:QueryBlanket (in: This=0x4aedca8, pProxy=0x4aedca4, pAuthnSvc=0x18e9d4, pAuthzSvc=0x18e9d8, pServerPrincName=0x0, pAuthnLevel=0x18e9f4, pImpLevel=0x18e9f8, pAuthInfo=0x0, pCapabilites=0x18e9ec | out: pAuthnSvc=0x18e9d4*=0xa, pAuthzSvc=0x18e9d8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x18e9f4*=0x6, pImpLevel=0x18e9f8*=0x3, pAuthInfo=0x0, pCapabilites=0x18e9ec*=0x20) returned 0x0 [0126.975] IUnknown:Release (This=0x4aedca8) returned 0x3 [0126.975] IUnknown:QueryInterface (in: This=0x4aedd6c, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e930 | out: ppvObject=0x18e930*=0x4aedd70) returned 0x0 [0126.976] IClientSecurity:QueryBlanket (in: This=0x4aedd70, pProxy=0x4aedd6c, pAuthnSvc=0x18e954, pAuthzSvc=0x18e944, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x18e954*=0xa, pAuthzSvc=0x18e944*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0126.976] IUnknown:Release (This=0x4aedd70) returned 0x1 [0126.976] IUnknown:QueryInterface (in: This=0x4aedd6c, riid=0x753e34f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e908 | out: ppvObject=0x18e908*=0x50003fc) returned 0x0 [0126.976] IUnknown:QueryInterface (in: This=0x4aedd6c, riid=0x753e31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e90c | out: ppvObject=0x18e90c*=0x4aedd70) returned 0x0 [0126.976] IClientSecurity:SetBlanket (This=0x4aedd70, pProxy=0x4aedd6c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0126.976] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0126.976] GetCurrentThreadId () returned 0xa94 [0126.976] GetCurrentThreadId () returned 0xa94 [0126.976] GetCurrentThreadId () returned 0xa94 [0126.977] PeekMessageA (in: lpMsg=0x18df78, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18df78) returned 0 [0126.977] PeekMessageA (in: lpMsg=0x18df78, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18df78) returned 0 [0126.977] PeekMessageA (in: lpMsg=0x18df78, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18df78) returned 0 [0126.978] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0126.978] GetCurrentThreadId () returned 0xa94 [0126.978] GetCurrentThreadId () returned 0xa94 [0126.978] GetCurrentThreadId () returned 0xa94 [0126.979] PeekMessageA (in: lpMsg=0x18e0c4, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e0c4) returned 0 [0126.979] PeekMessageA (in: lpMsg=0x18e0c4, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e0c4) returned 0 [0126.979] PeekMessageA (in: lpMsg=0x18e0c4, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e0c4) returned 0 [0126.980] IUnknown:Release (This=0x4aedd70) returned 0x2 [0126.980] WbemLocator:IUnknown:Release (This=0x50003fc) returned 0x1 [0126.980] IEnumWbemClassObject:Reset (This=0x4aedd6c) returned 0x0 [0126.980] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0126.980] GetCurrentThreadId () returned 0xa94 [0126.980] GetCurrentThreadId () returned 0xa94 [0126.981] GetCurrentThreadId () returned 0xa94 [0126.981] PeekMessageA (in: lpMsg=0x18e268, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e268) returned 0 [0126.981] PeekMessageA (in: lpMsg=0x18e268, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e268) returned 0 [0126.981] PeekMessageA (in: lpMsg=0x18e268, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e268) returned 0 [0126.982] IEnumWbemClassObject:Next (in: This=0x4aedd6c, lTimeout=-1, uCount=0x1, apObjects=0x18ea1c, puReturned=0x18ea20 | out: apObjects=0x18ea1c*=0x0, puReturned=0x18ea20*=0x0) returned 0x1 [0126.982] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x0, dwPendingType=0x1) returned 0x2 [0126.982] GetCurrentThreadId () returned 0xa94 [0126.982] GetCurrentThreadId () returned 0xa94 [0126.982] GetCurrentThreadId () returned 0xa94 [0126.982] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0126.982] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0126.982] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.041] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x3e, dwPendingType=0x1) returned 0x2 [0127.041] GetCurrentThreadId () returned 0xa94 [0127.041] GetCurrentThreadId () returned 0xa94 [0127.041] GetCurrentThreadId () returned 0xa94 [0127.041] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.041] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.041] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 1 [0127.041] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.056] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x4e, dwPendingType=0x1) returned 0x2 [0127.056] GetCurrentThreadId () returned 0xa94 [0127.057] GetCurrentThreadId () returned 0xa94 [0127.057] GetCurrentThreadId () returned 0xa94 [0127.057] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.057] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.057] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 1 [0127.057] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.166] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0xbb, dwPendingType=0x1) returned 0x2 [0127.166] GetCurrentThreadId () returned 0xa94 [0127.167] GetCurrentThreadId () returned 0xa94 [0127.167] GetCurrentThreadId () returned 0xa94 [0127.167] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.167] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.167] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 1 [0127.167] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.275] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x128, dwPendingType=0x1) returned 0x2 [0127.275] GetCurrentThreadId () returned 0xa94 [0127.275] GetCurrentThreadId () returned 0xa94 [0127.275] GetCurrentThreadId () returned 0xa94 [0127.275] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.275] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.275] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 1 [0127.275] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.362] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x176, dwPendingType=0x1) returned 0x2 [0127.362] GetCurrentThreadId () returned 0xa94 [0127.362] GetCurrentThreadId () returned 0xa94 [0127.362] GetCurrentThreadId () returned 0xa94 [0127.362] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.362] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.362] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 1 [0127.362] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.384] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x195, dwPendingType=0x1) returned 0x2 [0127.384] GetCurrentThreadId () returned 0xa94 [0127.384] GetCurrentThreadId () returned 0xa94 [0127.384] GetCurrentThreadId () returned 0xa94 [0127.384] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.385] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.385] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 1 [0127.385] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.560] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x202, dwPendingType=0x1) returned 0x2 [0127.560] GetCurrentThreadId () returned 0xa94 [0127.560] GetCurrentThreadId () returned 0xa94 [0127.561] GetCurrentThreadId () returned 0xa94 [0127.561] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.561] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.561] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 1 [0127.561] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.688] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x270, dwPendingType=0x1) returned 0x2 [0127.688] GetCurrentThreadId () returned 0xa94 [0127.689] GetCurrentThreadId () returned 0xa94 [0127.689] GetCurrentThreadId () returned 0xa94 [0127.689] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.689] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.689] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 1 [0127.689] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.743] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2ae, dwPendingType=0x1) returned 0x2 [0127.743] GetCurrentThreadId () returned 0xa94 [0127.743] GetCurrentThreadId () returned 0xa94 [0127.744] GetCurrentThreadId () returned 0xa94 [0127.744] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.744] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.744] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 1 [0127.744] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.790] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x2dd, dwPendingType=0x1) returned 0x2 [0127.790] GetCurrentThreadId () returned 0xa94 [0127.790] GetCurrentThreadId () returned 0xa94 [0127.790] GetCurrentThreadId () returned 0xa94 [0127.790] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.791] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.791] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 1 [0127.791] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.899] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x34a, dwPendingType=0x1) returned 0x2 [0127.899] GetCurrentThreadId () returned 0xa94 [0127.899] GetCurrentThreadId () returned 0xa94 [0127.899] GetCurrentThreadId () returned 0xa94 [0127.900] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.900] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0127.900] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 1 [0127.900] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0128.008] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x3b7, dwPendingType=0x1) returned 0x2 [0128.008] GetCurrentThreadId () returned 0xa94 [0128.008] GetCurrentThreadId () returned 0xa94 [0128.008] GetCurrentThreadId () returned 0xa94 [0128.008] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0128.008] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0128.008] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 1 [0128.008] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0128.055] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x3e6, dwPendingType=0x1) returned 0x2 [0128.055] GetCurrentThreadId () returned 0xa94 [0128.055] GetCurrentThreadId () returned 0xa94 [0128.055] GetCurrentThreadId () returned 0xa94 [0128.055] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0128.055] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0128.055] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 1 [0128.055] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0128.117] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x424, dwPendingType=0x1) returned 0x2 [0128.117] GetCurrentThreadId () returned 0xa94 [0128.117] GetCurrentThreadId () returned 0xa94 [0128.117] GetCurrentThreadId () returned 0xa94 [0128.117] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0128.118] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0128.118] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 1 [0128.118] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0128.227] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x492, dwPendingType=0x1) returned 0x2 [0128.227] GetCurrentThreadId () returned 0xa94 [0128.227] GetCurrentThreadId () returned 0xa94 [0128.227] GetCurrentThreadId () returned 0xa94 [0128.228] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0128.228] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0128.228] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 1 [0128.228] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0128.336] IMessageFilter:MessagePending (This=0x1662054, htaskCallee=0x0, dwTickCount=0x4ff, dwPendingType=0x1) returned 0x2 [0128.336] GetCurrentThreadId () returned 0xa94 [0128.336] GetCurrentThreadId () returned 0xa94 [0128.336] GetCurrentThreadId () returned 0xa94 [0128.337] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xa0, wMsgFilterMax=0xa0, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0128.337] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0xf, wMsgFilterMax=0xf, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0128.337] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 1 [0128.337] PeekMessageA (in: lpMsg=0x18e214, hWnd=0x0, wMsgFilterMin=0x113, wMsgFilterMax=0x113, wRemoveMsg=0x3 | out: lpMsg=0x18e214) returned 0 [0128.340] IUnknown:Release (This=0x4aedd6c) returned 0x0 [0128.341] IUnknown:Release (This=0x4aedca4) returned 0x2 [0128.342] IUnknown:Release (This=0x5194cdc) returned 0x1 [0128.342] WbemLocator:IUnknown:Release (This=0x4ae0b4c) returned 0x1 [0128.343] WbemLocator:IUnknown:Release (This=0x4ae0b4c) returned 0x0 [0128.344] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0128.344] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0128.344] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0128.344] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0128.344] IUnknown:Release (This=0x5194c2c) returned 0x0 [0128.344] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0128.345] IUnknown:Release (This=0x4aedca4) returned 0x1 [0128.345] IUnknown:Release (This=0x4aedca4) returned 0x0 [0128.347] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0128.347] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0128.347] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0128.347] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0128.347] IUnknown:Release (This=0x5194cdc) returned 0x0 [0128.348] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0128.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ebbc, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.349] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.349] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.349] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0a4, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.349] SysReAllocStringLen (in: pbstr=0x18ec4c*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ec4c*="C:") returned 1 [0128.349] VarCat (in: pvarLeft=0x18ecd4, pvarRight=0x18eca4, pvarResult=0x18ecc4 | out: pvarResult=0x18ecc4) returned 0x0 [0128.350] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0128.350] IMalloc:Alloc (This=0x767666bc, cb=0x68) returned 0x4fe84b8 [0128.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\inetpub\\Logs\\*.*", cchWideChar=-1, lpMultiByteStr=0x18e5d0, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\inetpub\\Logs\\*.*", lpUsedDefaultChar=0x0) returned 20 [0128.351] GetFullPathNameA (in: lpFileName="C:\\inetpub\\Logs\\*.*", nBufferLength=0x104, lpBuffer=0x18e80c, lpFilePart=0x18e5c8 | out: lpBuffer="C:\\inetpub\\Logs\\*.*", lpFilePart=0x18e5c8*="*.*") returned 0x13 [0128.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\inetpub\\Logs\\*.*", cchWideChar=-1, lpMultiByteStr=0x18ea58, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\inetpub\\Logs\\*.*", lpUsedDefaultChar=0x0) returned 20 [0128.351] FindFirstFileA (in: lpFileName="C:\\inetpub\\Logs\\*.*", lpFindFileData=0x18e5a8 | out: lpFindFileData=0x18e5a8*(dwFileAttributes=0x18e5c8, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18ec34, ftLastAccessTime.dwLowDateTime=0x18e6d8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18e80c, nFileSizeHigh=0x18e5d0, nFileSizeLow=0x18e81c, dwReserved0=0x1, dwReserved1=0x695c3a43, cFileName="netpub\\Logs\\*.*", cAlternateFileName="lê\x18")) returned 0xffffffff [0128.352] GetLastError () returned 0x3 [0128.352] GetLastError () returned 0x3 [0128.352] SetLastError (dwErrCode=0x3) [0128.352] GetLastError () returned 0x3 [0128.352] SetLastError (dwErrCode=0x3) [0128.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\inetpub\\Logs", cchWideChar=-1, lpMultiByteStr=0x18e94c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\inetpub\\Logs", lpUsedDefaultChar=0x0) returned 16 [0128.352] GetFullPathNameA (in: lpFileName="C:\\inetpub\\Logs", nBufferLength=0x104, lpBuffer=0x18ea80, lpFilePart=0x18e944 | out: lpBuffer="C:\\inetpub\\Logs", lpFilePart=0x18e944*="Logs") returned 0xf [0128.352] SetFileAttributesA (lpFileName="C:\\inetpub\\Logs", dwFileAttributes=0x80) returned 0 [0128.353] GetLastError () returned 0x3 [0128.353] GetLastError () returned 0x3 [0128.353] GetLastError () returned 0x3 [0128.353] GetLastError () returned 0x3 [0128.353] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0128.354] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x2e604c, cchWideChar=5 | out: lpWideCharStr="xyno") returned 5 [0128.354] RaiseException (dwExceptionCode=0xc000008f, dwExceptionFlags=0x1, nNumberOfArguments=0x2, lpArguments=0x18ea40) [0128.355] RtlUnwind (TargetFrame=0x18ec58, TargetIp=0x72a43caf, ExceptionRecord=0x0, ReturnValue=0x0) [0128.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\inetpub\\Logs", cchWideChar=-1, lpMultiByteStr=0x18ea78, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\inetpub\\Logs", lpUsedDefaultChar=0x0) returned 16 [0128.355] RemoveDirectoryA (lpPathName="C:\\inetpub\\Logs" (normalized: "c:\\inetpub\\logs")) returned 0 [0128.355] GetLastError () returned 0x3 [0128.355] GetLastError () returned 0x3 [0128.355] SetLastError (dwErrCode=0x3) [0128.355] GetLastError () returned 0x3 [0128.355] SetLastError (dwErrCode=0x3) [0128.355] GetLastError () returned 0x3 [0128.356] SetLastError (dwErrCode=0x3) [0128.356] GetLastError () returned 0x3 [0128.356] SetLastError (dwErrCode=0x3) [0128.356] GetLastError () returned 0x3 [0128.356] SetLastError (dwErrCode=0x3) [0128.356] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0128.356] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x2e604c, cchWideChar=5 | out: lpWideCharStr="xyno") returned 5 [0128.356] RaiseException (dwExceptionCode=0xc000008f, dwExceptionFlags=0x1, nNumberOfArguments=0x2, lpArguments=0x18ea34) [0128.357] RtlUnwind (TargetFrame=0x18ec58, TargetIp=0x72a43caf, ExceptionRecord=0x0, ReturnValue=0x0) [0128.357] IMalloc:Free (This=0x767666bc, pv=0x4fe84b8) [0128.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ebbc, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.358] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.358] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.358] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.358] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0f4, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.358] SysReAllocStringLen (in: pbstr=0x18ec4c*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ec4c*="C:") returned 1 [0128.358] VarCat (in: pvarLeft=0x18ecd4, pvarRight=0x18eca4, pvarResult=0x18ecc4 | out: pvarResult=0x18ecc4) returned 0x0 [0128.359] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0128.359] IMalloc:Alloc (This=0x767666bc, cb=0x68) returned 0x4fe84b8 [0128.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\inetpub\\temp\\*.*", cchWideChar=-1, lpMultiByteStr=0x18e5d0, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\inetpub\\temp\\*.*", lpUsedDefaultChar=0x0) returned 20 [0128.360] GetFullPathNameA (in: lpFileName="C:\\inetpub\\temp\\*.*", nBufferLength=0x104, lpBuffer=0x18e80c, lpFilePart=0x18e5c8 | out: lpBuffer="C:\\inetpub\\temp\\*.*", lpFilePart=0x18e5c8*="*.*") returned 0x13 [0128.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\inetpub\\temp\\*.*", cchWideChar=-1, lpMultiByteStr=0x18ea58, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\inetpub\\temp\\*.*", lpUsedDefaultChar=0x0) returned 20 [0128.360] FindFirstFileA (in: lpFileName="C:\\inetpub\\temp\\*.*", lpFindFileData=0x18e5a8 | out: lpFindFileData=0x18e5a8*(dwFileAttributes=0x18e5c8, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18ec34, ftLastAccessTime.dwLowDateTime=0x18e6d8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18e80c, nFileSizeHigh=0x18e5d0, nFileSizeLow=0x18e81c, dwReserved0=0x1, dwReserved1=0x695c3a43, cFileName="netpub\\temp\\*.*", cAlternateFileName="lê\x18")) returned 0xffffffff [0128.360] GetLastError () returned 0x3 [0128.360] GetLastError () returned 0x3 [0128.360] SetLastError (dwErrCode=0x3) [0128.361] GetLastError () returned 0x3 [0128.361] SetLastError (dwErrCode=0x3) [0128.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\inetpub\\temp", cchWideChar=-1, lpMultiByteStr=0x18e94c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\inetpub\\temp", lpUsedDefaultChar=0x0) returned 16 [0128.361] GetFullPathNameA (in: lpFileName="C:\\inetpub\\temp", nBufferLength=0x104, lpBuffer=0x18ea80, lpFilePart=0x18e944 | out: lpBuffer="C:\\inetpub\\temp", lpFilePart=0x18e944*="temp") returned 0xf [0128.361] SetFileAttributesA (lpFileName="C:\\inetpub\\temp", dwFileAttributes=0x80) returned 0 [0128.361] GetLastError () returned 0x3 [0128.362] GetLastError () returned 0x3 [0128.362] GetLastError () returned 0x3 [0128.362] GetLastError () returned 0x3 [0128.362] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0128.362] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x501577c, cchWideChar=5 | out: lpWideCharStr="xyno") returned 5 [0128.363] RaiseException (dwExceptionCode=0xc000008f, dwExceptionFlags=0x1, nNumberOfArguments=0x2, lpArguments=0x18ea40) [0128.363] RtlUnwind (TargetFrame=0x18ec58, TargetIp=0x72a43caf, ExceptionRecord=0x0, ReturnValue=0x0) [0128.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\inetpub\\temp", cchWideChar=-1, lpMultiByteStr=0x18ea78, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\inetpub\\temp", lpUsedDefaultChar=0x0) returned 16 [0128.363] RemoveDirectoryA (lpPathName="C:\\inetpub\\temp" (normalized: "c:\\inetpub\\temp")) returned 0 [0128.364] GetLastError () returned 0x3 [0128.364] GetLastError () returned 0x3 [0128.364] SetLastError (dwErrCode=0x3) [0128.364] GetLastError () returned 0x3 [0128.364] SetLastError (dwErrCode=0x3) [0128.364] GetLastError () returned 0x3 [0128.365] SetLastError (dwErrCode=0x3) [0128.365] GetLastError () returned 0x3 [0128.365] SetLastError (dwErrCode=0x3) [0128.365] GetLastError () returned 0x3 [0128.365] SetLastError (dwErrCode=0x3) [0128.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0128.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x501577c, cchWideChar=5 | out: lpWideCharStr="xyno") returned 5 [0128.366] RaiseException (dwExceptionCode=0xc000008f, dwExceptionFlags=0x1, nNumberOfArguments=0x2, lpArguments=0x18ea34) [0128.366] RtlUnwind (TargetFrame=0x18ec58, TargetIp=0x72a43caf, ExceptionRecord=0x0, ReturnValue=0x0) [0128.367] IMalloc:Free (This=0x767666bc, pv=0x4fe84b8) [0128.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ebbc, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.368] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.368] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.369] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.369] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd054, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.369] SysReAllocStringLen (in: pbstr=0x18ec4c*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ec4c*="C:") returned 1 [0128.369] VarCat (in: pvarLeft=0x18ecd4, pvarRight=0x18eca4, pvarResult=0x18ecc4 | out: pvarResult=0x18ecc4) returned 0x0 [0128.369] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0128.369] IMalloc:Alloc (This=0x767666bc, cb=0x68) returned 0x4fe84b8 [0128.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\inetpub\\history\\*.*", cchWideChar=-1, lpMultiByteStr=0x18e5d0, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\inetpub\\history\\*.*", lpUsedDefaultChar=0x0) returned 23 [0128.370] GetFullPathNameA (in: lpFileName="C:\\inetpub\\history\\*.*", nBufferLength=0x104, lpBuffer=0x18e80c, lpFilePart=0x18e5c8 | out: lpBuffer="C:\\inetpub\\history\\*.*", lpFilePart=0x18e5c8*="*.*") returned 0x16 [0128.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\inetpub\\history\\*.*", cchWideChar=-1, lpMultiByteStr=0x18ea58, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\inetpub\\history\\*.*", lpUsedDefaultChar=0x0) returned 23 [0128.370] FindFirstFileA (in: lpFileName="C:\\inetpub\\history\\*.*", lpFindFileData=0x18e5a8 | out: lpFindFileData=0x18e5a8*(dwFileAttributes=0x18e5c8, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18ec34, ftLastAccessTime.dwLowDateTime=0x18e6d8, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18e80c, nFileSizeHigh=0x18e5d0, nFileSizeLow=0x18e81f, dwReserved0=0x1, dwReserved1=0x695c3a43, cFileName="netpub\\history\\*.*", cAlternateFileName="oê\x18")) returned 0xffffffff [0128.371] GetLastError () returned 0x3 [0128.371] GetLastError () returned 0x3 [0128.371] SetLastError (dwErrCode=0x3) [0128.371] GetLastError () returned 0x3 [0128.371] SetLastError (dwErrCode=0x3) [0128.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\inetpub\\history", cchWideChar=-1, lpMultiByteStr=0x18e94c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\inetpub\\history", lpUsedDefaultChar=0x0) returned 19 [0128.371] GetFullPathNameA (in: lpFileName="C:\\inetpub\\history", nBufferLength=0x104, lpBuffer=0x18ea80, lpFilePart=0x18e944 | out: lpBuffer="C:\\inetpub\\history", lpFilePart=0x18e944*="history") returned 0x12 [0128.372] SetFileAttributesA (lpFileName="C:\\inetpub\\history", dwFileAttributes=0x80) returned 0 [0128.372] GetLastError () returned 0x3 [0128.372] GetLastError () returned 0x3 [0128.372] GetLastError () returned 0x3 [0128.372] GetLastError () returned 0x3 [0128.372] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0128.373] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x5015764, cchWideChar=5 | out: lpWideCharStr="xyno") returned 5 [0128.373] RaiseException (dwExceptionCode=0xc000008f, dwExceptionFlags=0x1, nNumberOfArguments=0x2, lpArguments=0x18ea40) [0128.373] RtlUnwind (TargetFrame=0x18ec58, TargetIp=0x72a43caf, ExceptionRecord=0x0, ReturnValue=0x0) [0128.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\inetpub\\history", cchWideChar=-1, lpMultiByteStr=0x18ea78, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\inetpub\\history", lpUsedDefaultChar=0x0) returned 19 [0128.374] RemoveDirectoryA (lpPathName="C:\\inetpub\\history" (normalized: "c:\\inetpub\\history")) returned 0 [0128.374] GetLastError () returned 0x3 [0128.374] GetLastError () returned 0x3 [0128.374] SetLastError (dwErrCode=0x3) [0128.374] GetLastError () returned 0x3 [0128.374] SetLastError (dwErrCode=0x3) [0128.374] GetLastError () returned 0x3 [0128.375] SetLastError (dwErrCode=0x3) [0128.375] GetLastError () returned 0x3 [0128.375] SetLastError (dwErrCode=0x3) [0128.375] GetLastError () returned 0x3 [0128.375] SetLastError (dwErrCode=0x3) [0128.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0128.376] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x40810c, cbMultiByte=-1, lpWideCharStr=0x5015764, cchWideChar=5 | out: lpWideCharStr="xyno") returned 5 [0128.376] RaiseException (dwExceptionCode=0xc000008f, dwExceptionFlags=0x1, nNumberOfArguments=0x2, lpArguments=0x18ea34) [0128.376] RtlUnwind (TargetFrame=0x18ec58, TargetIp=0x72a43caf, ExceptionRecord=0x0, ReturnValue=0x0) [0128.377] IMalloc:Free (This=0x767666bc, pv=0x4fe84b8) [0128.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec38, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.378] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.378] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.378] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.378] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd07c, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.378] SysReAllocStringLen (in: pbstr=0x18ecc8*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ecc8*="C:") returned 1 [0128.379] VarCat (in: pvarLeft=0x18ee00, pvarRight=0x18edb0, pvarResult=0x18edf0 | out: pvarResult=0x18edf0) returned 0x0 [0128.397] SysStringLen (param_1="C:\\ProgramData\\") returned 0xf [0128.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\", cchWideChar=16, lpMultiByteStr=0x2e3274, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\", lpUsedDefaultChar=0x0) returned 16 [0128.397] lstrlenA (lpString="C:\\ProgramData\\") returned 15 [0128.397] lstrlenA (lpString="C:\\ProgramData\\") returned 15 [0128.398] lstrcpyA (in: lpString1=0x18ea18, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0128.398] lstrlenA (lpString="C:") returned 2 [0128.398] lstrlenA (lpString="\\ProgramData\\") returned 13 [0128.398] lstrcatA (in: lpString1="C:", lpString2="\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0128.398] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x26 [0128.398] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x26) returned 0x167bbd0 [0128.399] GetCurrentDirectoryA (in: nBufferLength=0x26, lpBuffer=0x167bbd0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0128.399] SetCurrentDirectoryA (lpPathName="C:\\" (normalized: "c:")) returned 1 [0128.399] SetCurrentDirectoryA (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0128.399] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167bbd0 | out: hHeap=0x1660000) returned 1 [0128.400] IsCharAlphaA (ch=67) returned 1 [0128.402] lstrlenA (lpString="C:\\ProgramData") returned 14 [0128.402] GetFileAttributesA (lpFileName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 0x2012 [0128.402] lstrcpyA (in: lpString1=0x18eb44, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0128.402] lstrcmpA (lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpString2="C:\\ProgramData") returned 1 [0128.402] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xf) returned 0x1672bd8 [0128.403] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167bba0 | out: hHeap=0x1660000) returned 1 [0128.403] lstrcpyA (in: lpString1=0x18e7d0, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0128.403] GetShortPathNameA (in: lpszLongPath="C:\\ProgramData", lpszShortPath=0x18e8d8, cchBuffer=0x105 | out: lpszShortPath="C:\\PROGRA~3") returned 0xb [0128.403] lstrlenA (lpString="C:\\PROGRA~3") returned 11 [0128.404] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0xb, wParam=0x0, lParam=0x0) returned 0x0 [0128.404] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x184, wParam=0x0, lParam=0x0) returned 0x0 [0128.404] lstrcpyA (in: lpString1=0x18e8e4, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0128.404] FindFirstFileA (in: lpFileName="C:\\PROGRA~3\\*.*", lpFindFileData=0x18e9e0 | out: lpFindFileData=0x18e9e0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1dffc400, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x1dffc400, ftLastWriteTime.dwHighDateTime=0x1d68e85, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x184, cFileName=".", cAlternateFileName="")) returned 0x4fed370 [0128.405] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18e9e0 | out: lpFindFileData=0x18e9e0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1dffc400, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x1dffc400, ftLastWriteTime.dwHighDateTime=0x1d68e85, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x184, cFileName="..", cAlternateFileName="")) returned 1 [0128.405] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18e9e0 | out: lpFindFileData=0x18e9e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x184, cFileName="Adobe", cAlternateFileName="")) returned 1 [0128.405] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18e9e0 | out: lpFindFileData=0x18e9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x184, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0128.405] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18e9e0 | out: lpFindFileData=0x18e9e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dfb0140, ftCreationTime.dwHighDateTime=0x1d68e85, ftLastAccessTime.dwLowDateTime=0x1dfb0140, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x1dfb0140, ftLastWriteTime.dwHighDateTime=0x1d68e85, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x184, cFileName="chk.dat", cAlternateFileName="")) returned 1 [0128.405] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18ea0c) returned 0x0 [0128.405] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18ea0c) returned 0x0 [0128.406] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18e9e0 | out: lpFindFileData=0x18e9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e5f4, cFileName="Desktop", cAlternateFileName="")) returned 1 [0128.406] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18e9e0 | out: lpFindFileData=0x18e9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e5f4, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0128.406] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18e9e0 | out: lpFindFileData=0x18e9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e5f4, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0128.406] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18e9e0 | out: lpFindFileData=0x18e9e0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e5f4, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0128.406] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18e9e0 | out: lpFindFileData=0x18e9e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e5f4, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0128.406] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18e9e0 | out: lpFindFileData=0x18e9e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e5f4, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0128.407] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18e9e0 | out: lpFindFileData=0x18e9e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dffc400, ftCreationTime.dwHighDateTime=0x1d68e85, ftLastAccessTime.dwLowDateTime=0x1dffc400, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x1ebbd0a0, ftLastWriteTime.dwHighDateTime=0x1d68e85, nFileSizeHigh=0x0, nFileSizeLow=0x1a730, dwReserved0=0xa0000003, dwReserved1=0x18e5f4, cFileName="MSWINSCK.OCX", cAlternateFileName="")) returned 1 [0128.407] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18ea0c) returned 0x1 [0128.407] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18ea0c) returned 0x1 [0128.407] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18e9e0 | out: lpFindFileData=0x18e9e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x18e5f4, cFileName="Oracle", cAlternateFileName="")) returned 1 [0128.407] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18e9e0 | out: lpFindFileData=0x18e9e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x18e5f4, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0128.407] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18e9e0 | out: lpFindFileData=0x18e9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e5f4, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0128.407] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18e9e0 | out: lpFindFileData=0x18e9e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e5f4, cFileName="Sun", cAlternateFileName="")) returned 1 [0128.408] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18e9e0 | out: lpFindFileData=0x18e9e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e5f4, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0128.408] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18e9e0 | out: lpFindFileData=0x18e9e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a26500, ftCreationTime.dwHighDateTime=0x1d68e85, ftLastAccessTime.dwLowDateTime=0x2a26500, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x79d1fc00, ftLastWriteTime.dwHighDateTime=0x1d68e79, nFileSizeHigh=0x0, nFileSizeLow=0x71be00, dwReserved0=0xa0000003, dwReserved1=0x18e5f4, cFileName="zhang.exe", cAlternateFileName="")) returned 1 [0128.408] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18ea0c) returned 0x2 [0128.408] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18ea0c) returned 0x2 [0128.408] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18e9e0 | out: lpFindFileData=0x18e9e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a26500, ftCreationTime.dwHighDateTime=0x1d68e85, ftLastAccessTime.dwLowDateTime=0x2a26500, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x79d1fc00, ftLastWriteTime.dwHighDateTime=0x1d68e79, nFileSizeHigh=0x0, nFileSizeLow=0x71be00, dwReserved0=0xa0000003, dwReserved1=0x18e5f4, cFileName="zhang.exe", cAlternateFileName="")) returned 0 [0128.408] FindClose (in: hFindFile=0x4fed370 | out: hFindFile=0x4fed370) returned 1 [0128.409] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0xb, wParam=0x1, lParam=0x0) returned 0x0 [0128.410] InvalidateRect (hWnd=0x5011e, lpRect=0x0, bErase=1) returned 1 [0128.411] InvalidateRect (hWnd=0x5011e, lpRect=0x0, bErase=1) returned 1 [0128.411] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x18e, wParam=0x0, lParam=0x0) returned 0x0 [0128.411] lstrcpyA (in: lpString1=0x18e84c, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0128.411] GetShortPathNameA (in: lpszLongPath="C:\\ProgramData", lpszShortPath=0x18e954, cchBuffer=0x105 | out: lpszShortPath="C:\\PROGRA~3") returned 0xb [0128.412] lstrlenA (lpString="C:\\PROGRA~3") returned 11 [0128.412] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0xb, wParam=0x0, lParam=0x0) returned 0x0 [0128.412] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x184, wParam=0x0, lParam=0x0) returned 0x0 [0128.412] lstrcpyA (in: lpString1=0x18e960, lpString2="*.*" | out: lpString1="*.*") returned="*.*" [0128.413] FindFirstFileA (in: lpFileName="C:\\PROGRA~3\\*.*", lpFindFileData=0x18ea5c | out: lpFindFileData=0x18ea5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1dffc400, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x1dffc400, ftLastWriteTime.dwHighDateTime=0x1d68e85, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x184, cFileName=".", cAlternateFileName="")) returned 0x4fed370 [0128.413] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18ea5c | out: lpFindFileData=0x18ea5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1dffc400, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x1dffc400, ftLastWriteTime.dwHighDateTime=0x1d68e85, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x184, cFileName="..", cAlternateFileName="")) returned 1 [0128.413] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18ea5c | out: lpFindFileData=0x18ea5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x184, cFileName="Adobe", cAlternateFileName="")) returned 1 [0128.413] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18ea5c | out: lpFindFileData=0x18ea5c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x184, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0128.413] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18ea5c | out: lpFindFileData=0x18ea5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dfb0140, ftCreationTime.dwHighDateTime=0x1d68e85, ftLastAccessTime.dwLowDateTime=0x1dfb0140, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x1dfb0140, ftLastWriteTime.dwHighDateTime=0x1d68e85, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x184, cFileName="chk.dat", cAlternateFileName="")) returned 1 [0128.414] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18ea88) returned 0x0 [0128.414] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18ea88) returned 0x0 [0128.414] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18ea5c | out: lpFindFileData=0x18ea5c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e670, cFileName="Desktop", cAlternateFileName="")) returned 1 [0128.414] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18ea5c | out: lpFindFileData=0x18ea5c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e670, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0128.414] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18ea5c | out: lpFindFileData=0x18ea5c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e670, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0128.414] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18ea5c | out: lpFindFileData=0x18ea5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e670, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0128.414] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18ea5c | out: lpFindFileData=0x18ea5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e670, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0128.415] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18ea5c | out: lpFindFileData=0x18ea5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e670, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0128.415] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18ea5c | out: lpFindFileData=0x18ea5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dffc400, ftCreationTime.dwHighDateTime=0x1d68e85, ftLastAccessTime.dwLowDateTime=0x1dffc400, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x1ebbd0a0, ftLastWriteTime.dwHighDateTime=0x1d68e85, nFileSizeHigh=0x0, nFileSizeLow=0x1a730, dwReserved0=0xa0000003, dwReserved1=0x18e670, cFileName="MSWINSCK.OCX", cAlternateFileName="")) returned 1 [0128.415] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18ea88) returned 0x1 [0128.415] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18ea88) returned 0x1 [0128.415] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18ea5c | out: lpFindFileData=0x18ea5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x18e670, cFileName="Oracle", cAlternateFileName="")) returned 1 [0128.415] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18ea5c | out: lpFindFileData=0x18ea5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x18e670, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0128.415] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18ea5c | out: lpFindFileData=0x18ea5c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e670, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0128.416] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18ea5c | out: lpFindFileData=0x18ea5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e670, cFileName="Sun", cAlternateFileName="")) returned 1 [0128.416] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18ea5c | out: lpFindFileData=0x18ea5c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e670, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0128.416] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18ea5c | out: lpFindFileData=0x18ea5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a26500, ftCreationTime.dwHighDateTime=0x1d68e85, ftLastAccessTime.dwLowDateTime=0x2a26500, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x79d1fc00, ftLastWriteTime.dwHighDateTime=0x1d68e79, nFileSizeHigh=0x0, nFileSizeLow=0x71be00, dwReserved0=0xa0000003, dwReserved1=0x18e670, cFileName="zhang.exe", cAlternateFileName="")) returned 1 [0128.416] SendMessageA (hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18ea88) returned 0x2 [0128.416] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x180, wParam=0x0, lParam=0x18ea88) returned 0x2 [0128.416] FindNextFileA (in: hFindFile=0x4fed370, lpFindFileData=0x18ea5c | out: lpFindFileData=0x18ea5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a26500, ftCreationTime.dwHighDateTime=0x1d68e85, ftLastAccessTime.dwLowDateTime=0x2a26500, ftLastAccessTime.dwHighDateTime=0x1d68e85, ftLastWriteTime.dwLowDateTime=0x79d1fc00, ftLastWriteTime.dwHighDateTime=0x1d68e79, nFileSizeHigh=0x0, nFileSizeLow=0x71be00, dwReserved0=0xa0000003, dwReserved1=0x18e670, cFileName="zhang.exe", cAlternateFileName="")) returned 0 [0128.416] FindClose (in: hFindFile=0x4fed370 | out: hFindFile=0x4fed370) returned 1 [0128.416] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0xb, wParam=0x1, lParam=0x0) returned 0x0 [0128.417] InvalidateRect (hWnd=0x5011e, lpRect=0x0, bErase=1) returned 1 [0128.417] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x197, wParam=0x0, lParam=0x0) returned 0x0 [0128.417] UpdateWindow (hWnd=0x5011e) returned 1 [0128.417] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x18b, wParam=0x0, lParam=0x0) returned 0x3 [0128.417] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x18a, wParam=0x0, lParam=0x0) returned 0x7 [0128.417] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x8) returned 0x1677628 [0128.417] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x189, wParam=0x0, lParam=0x1677628) returned 0x7 [0128.417] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0128.417] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x2e604c, cchWideChar=8 | out: lpWideCharStr="chk.dat") returned 8 [0128.418] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1677628 | out: hHeap=0x1660000) returned 1 [0128.418] CharLowerBuffW (in: lpsz=".dat", cchLength=0x5 | out: lpsz=".dat") returned 0x5 [0128.418] VarCmp (pvarLeft=0x18edf0, pvarRight=0x18edc0, lcid=0x0, dwFlags=0x30001) returned 0x0 [0128.418] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x18a, wParam=0x1, lParam=0x0) returned 0xc [0128.419] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xd) returned 0x1672bf0 [0128.419] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x189, wParam=0x1, lParam=0x1672bf0) returned 0xc [0128.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1672bf0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0128.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1672bf0, cbMultiByte=-1, lpWideCharStr=0x2e604c, cchWideChar=13 | out: lpWideCharStr="MSWINSCK.OCX") returned 13 [0128.419] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bf0 | out: hHeap=0x1660000) returned 1 [0128.420] CharLowerBuffW (in: lpsz=".OCX", cchLength=0x5 | out: lpsz=".ocx") returned 0x5 [0128.420] VarCmp (pvarLeft=0x18edf0, pvarRight=0x18edc0, lcid=0x0, dwFlags=0x30001) returned 0x2 [0128.420] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x18a, wParam=0x2, lParam=0x0) returned 0x9 [0128.420] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xa) returned 0x1672bf0 [0128.420] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x189, wParam=0x2, lParam=0x1672bf0) returned 0x9 [0128.420] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1672bf0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0128.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1672bf0, cbMultiByte=-1, lpWideCharStr=0x2e604c, cchWideChar=10 | out: lpWideCharStr="zhang.exe") returned 10 [0128.421] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bf0 | out: hHeap=0x1660000) returned 1 [0128.421] CharLowerBuffW (in: lpsz=".exe", cchLength=0x5 | out: lpsz=".exe") returned 0x5 [0128.421] VarCmp (pvarLeft=0x18edf0, pvarRight=0x18edc0, lcid=0x0, dwFlags=0x30001) returned 0x1 [0128.421] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x18a, wParam=0x2, lParam=0x0) returned 0x9 [0128.421] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xa) returned 0x1672bf0 [0128.422] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x189, wParam=0x2, lParam=0x1672bf0) returned 0x9 [0128.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1672bf0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0128.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1672bf0, cbMultiByte=-1, lpWideCharStr=0x2e604c, cchWideChar=10 | out: lpWideCharStr="zhang.exe") returned 10 [0128.422] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bf0 | out: hHeap=0x1660000) returned 1 [0128.422] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18eb5c, nSize=0x104 | out: lpFilename="C:\\ProgramData\\zhang.exe" (normalized: "c:\\programdata\\zhang.exe")) returned 0x18 [0128.422] lstrcpynA (in: lpString1=0x18ea48, lpString2="C:\\ProgramData\\zhang.exe", iMaxLength=260 | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0128.422] lstrlenA (lpString="C:\\ProgramData\\zhang.exe") returned 24 [0128.422] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c610 [0128.422] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x19) returned 0x167c638 [0128.422] lstrcpyA (in: lpString1=0x167c610, lpString2="C:\\ProgramData\\zhang.exe" | out: lpString1="C:\\ProgramData\\zhang.exe") returned="C:\\ProgramData\\zhang.exe" [0128.423] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x6) returned 0x1677628 [0128.423] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167c638 | out: hHeap=0x1660000) returned 1 [0128.423] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x167c610 | out: hHeap=0x1660000) returned 1 [0128.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0128.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x501577c, cchWideChar=6 | out: lpWideCharStr="zhang") returned 6 [0128.423] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1677628 | out: hHeap=0x1660000) returned 1 [0128.423] VarBstrCmp (bstrLeft="zhang.exe", bstrRight="zhang.exe", lcid=0x0, dwFlags=0x30001) returned 0x1 [0128.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec94, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.424] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.424] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.424] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.425] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.425] SysReAllocStringLen (in: pbstr=0x18ed24*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ed24*="C:") returned 1 [0128.425] VarCat (in: pvarLeft=0x18ee04, pvarRight=0x18eda4, pvarResult=0x18edf4 | out: pvarResult=0x18edf4) returned 0x0 [0128.425] VarCat (in: pvarLeft=0x18edf4, pvarRight=0x18ed94, pvarResult=0x18ede4 | out: pvarResult=0x18ede4) returned 0x0 [0128.425] VarCat (in: pvarLeft=0x18ede4, pvarRight=0x18ed84, pvarResult=0x18edd4 | out: pvarResult=0x18edd4) returned 0x0 [0128.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL5.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18e794, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL5.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 67 [0128.426] GetFullPathNameA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL5.SQLEXPRESS\\MSSQL\\Log\\", nBufferLength=0x104, lpBuffer=0x18e9d0, lpFilePart=0x18e78c | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\MSSQL5.SQLEXPRESS\\MSSQL\\Log\\", lpFilePart=0x18e78c*=0x0) returned 0x42 [0128.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL5.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18ec1c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL5.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 67 [0128.426] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL5.SQLEXPRESS\\MSSQL\\Log\\*.*", lpFindFileData=0x18e76c | out: lpFindFileData=0x18e76c*(dwFileAttributes=0x18e78c, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18edd4, ftLastAccessTime.dwLowDateTime=0x18e89c, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18e9d0, nFileSizeHigh=0x18e794, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x505c3a43, cFileName="rogram Files\\Microsoft SQL Server\\MSSQL5.SQLEXPRESS\\MSSQL\\Log\\", cAlternateFileName="_ì\x18")) returned 0xffffffff [0128.427] GetLastError () returned 0x3 [0128.427] GetLastError () returned 0x3 [0128.427] SetLastError (dwErrCode=0x3) [0128.427] GetLastError () returned 0x3 [0128.427] SetLastError (dwErrCode=0x3) [0128.428] VarCmp (pvarLeft=0x18ee24, pvarRight=0x18edb4, lcid=0x0, dwFlags=0x30001) returned 0x1 [0128.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec94, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.428] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.429] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.429] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.429] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.429] SysReAllocStringLen (in: pbstr=0x18ed24*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ed24*="C:") returned 1 [0128.429] VarCat (in: pvarLeft=0x18ee04, pvarRight=0x18eda4, pvarResult=0x18edf4 | out: pvarResult=0x18edf4) returned 0x0 [0128.429] VarCat (in: pvarLeft=0x18edf4, pvarRight=0x18ed94, pvarResult=0x18ede4 | out: pvarResult=0x18ede4) returned 0x0 [0128.429] VarCat (in: pvarLeft=0x18ede4, pvarRight=0x18ed84, pvarResult=0x18edd4 | out: pvarResult=0x18edd4) returned 0x0 [0128.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL6.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18e794, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL6.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 67 [0128.430] GetFullPathNameA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL6.SQLEXPRESS\\MSSQL\\Log\\", nBufferLength=0x104, lpBuffer=0x18e9d0, lpFilePart=0x18e78c | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\MSSQL6.SQLEXPRESS\\MSSQL\\Log\\", lpFilePart=0x18e78c*=0x0) returned 0x42 [0128.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL6.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18ec1c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL6.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 67 [0128.430] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL6.SQLEXPRESS\\MSSQL\\Log\\*.*", lpFindFileData=0x18e76c | out: lpFindFileData=0x18e76c*(dwFileAttributes=0x18e78c, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18edd4, ftLastAccessTime.dwLowDateTime=0x18e89c, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18e9d0, nFileSizeHigh=0x18e794, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x505c3a43, cFileName="rogram Files\\Microsoft SQL Server\\MSSQL6.SQLEXPRESS\\MSSQL\\Log\\", cAlternateFileName="_ì\x18")) returned 0xffffffff [0128.430] GetLastError () returned 0x3 [0128.430] GetLastError () returned 0x3 [0128.430] SetLastError (dwErrCode=0x3) [0128.430] GetLastError () returned 0x3 [0128.431] SetLastError (dwErrCode=0x3) [0128.431] VarCmp (pvarLeft=0x18ee24, pvarRight=0x18edb4, lcid=0x0, dwFlags=0x30001) returned 0x1 [0128.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec94, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.432] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.432] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.432] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.432] SysReAllocStringLen (in: pbstr=0x18ed24*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ed24*="C:") returned 1 [0128.432] VarCat (in: pvarLeft=0x18ee04, pvarRight=0x18eda4, pvarResult=0x18edf4 | out: pvarResult=0x18edf4) returned 0x0 [0128.432] VarCat (in: pvarLeft=0x18edf4, pvarRight=0x18ed94, pvarResult=0x18ede4 | out: pvarResult=0x18ede4) returned 0x0 [0128.432] VarCat (in: pvarLeft=0x18ede4, pvarRight=0x18ed84, pvarResult=0x18edd4 | out: pvarResult=0x18edd4) returned 0x0 [0128.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL7.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18e794, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL7.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 67 [0128.433] GetFullPathNameA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL7.SQLEXPRESS\\MSSQL\\Log\\", nBufferLength=0x104, lpBuffer=0x18e9d0, lpFilePart=0x18e78c | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\MSSQL7.SQLEXPRESS\\MSSQL\\Log\\", lpFilePart=0x18e78c*=0x0) returned 0x42 [0128.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL7.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18ec1c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL7.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 67 [0128.433] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL7.SQLEXPRESS\\MSSQL\\Log\\*.*", lpFindFileData=0x18e76c | out: lpFindFileData=0x18e76c*(dwFileAttributes=0x18e78c, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18edd4, ftLastAccessTime.dwLowDateTime=0x18e89c, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18e9d0, nFileSizeHigh=0x18e794, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x505c3a43, cFileName="rogram Files\\Microsoft SQL Server\\MSSQL7.SQLEXPRESS\\MSSQL\\Log\\", cAlternateFileName="_ì\x18")) returned 0xffffffff [0128.433] GetLastError () returned 0x3 [0128.433] GetLastError () returned 0x3 [0128.433] SetLastError (dwErrCode=0x3) [0128.433] GetLastError () returned 0x3 [0128.433] SetLastError (dwErrCode=0x3) [0128.434] VarCmp (pvarLeft=0x18ee24, pvarRight=0x18edb4, lcid=0x0, dwFlags=0x30001) returned 0x1 [0128.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec94, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.434] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.434] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.435] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.435] SysReAllocStringLen (in: pbstr=0x18ed24*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ed24*="C:") returned 1 [0128.435] VarCat (in: pvarLeft=0x18ee04, pvarRight=0x18eda4, pvarResult=0x18edf4 | out: pvarResult=0x18edf4) returned 0x0 [0128.435] VarCat (in: pvarLeft=0x18edf4, pvarRight=0x18ed94, pvarResult=0x18ede4 | out: pvarResult=0x18ede4) returned 0x0 [0128.435] VarCat (in: pvarLeft=0x18ede4, pvarRight=0x18ed84, pvarResult=0x18edd4 | out: pvarResult=0x18edd4) returned 0x0 [0128.435] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL8.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18e794, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL8.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 67 [0128.436] GetFullPathNameA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL8.SQLEXPRESS\\MSSQL\\Log\\", nBufferLength=0x104, lpBuffer=0x18e9d0, lpFilePart=0x18e78c | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\MSSQL8.SQLEXPRESS\\MSSQL\\Log\\", lpFilePart=0x18e78c*=0x0) returned 0x42 [0128.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL8.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18ec1c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL8.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 67 [0128.436] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL8.SQLEXPRESS\\MSSQL\\Log\\*.*", lpFindFileData=0x18e76c | out: lpFindFileData=0x18e76c*(dwFileAttributes=0x18e78c, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18edd4, ftLastAccessTime.dwLowDateTime=0x18e89c, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18e9d0, nFileSizeHigh=0x18e794, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x505c3a43, cFileName="rogram Files\\Microsoft SQL Server\\MSSQL8.SQLEXPRESS\\MSSQL\\Log\\", cAlternateFileName="_ì\x18")) returned 0xffffffff [0128.436] GetLastError () returned 0x3 [0128.436] GetLastError () returned 0x3 [0128.436] SetLastError (dwErrCode=0x3) [0128.436] GetLastError () returned 0x3 [0128.436] SetLastError (dwErrCode=0x3) [0128.437] VarCmp (pvarLeft=0x18ee24, pvarRight=0x18edb4, lcid=0x0, dwFlags=0x30001) returned 0x1 [0128.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec94, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.437] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.438] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.438] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.438] SysReAllocStringLen (in: pbstr=0x18ed24*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ed24*="C:") returned 1 [0128.438] VarCat (in: pvarLeft=0x18ee04, pvarRight=0x18eda4, pvarResult=0x18edf4 | out: pvarResult=0x18edf4) returned 0x0 [0128.438] VarCat (in: pvarLeft=0x18edf4, pvarRight=0x18ed94, pvarResult=0x18ede4 | out: pvarResult=0x18ede4) returned 0x0 [0128.438] VarCat (in: pvarLeft=0x18ede4, pvarRight=0x18ed84, pvarResult=0x18edd4 | out: pvarResult=0x18edd4) returned 0x0 [0128.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL9.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18e794, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL9.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 67 [0128.439] GetFullPathNameA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL9.SQLEXPRESS\\MSSQL\\Log\\", nBufferLength=0x104, lpBuffer=0x18e9d0, lpFilePart=0x18e78c | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\MSSQL9.SQLEXPRESS\\MSSQL\\Log\\", lpFilePart=0x18e78c*=0x0) returned 0x42 [0128.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL9.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18ec1c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL9.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 67 [0128.439] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL9.SQLEXPRESS\\MSSQL\\Log\\*.*", lpFindFileData=0x18e76c | out: lpFindFileData=0x18e76c*(dwFileAttributes=0x18e78c, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18edd4, ftLastAccessTime.dwLowDateTime=0x18e89c, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18e9d0, nFileSizeHigh=0x18e794, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x505c3a43, cFileName="rogram Files\\Microsoft SQL Server\\MSSQL9.SQLEXPRESS\\MSSQL\\Log\\", cAlternateFileName="_ì\x18")) returned 0xffffffff [0128.439] GetLastError () returned 0x3 [0128.439] GetLastError () returned 0x3 [0128.439] SetLastError (dwErrCode=0x3) [0128.440] GetLastError () returned 0x3 [0128.440] SetLastError (dwErrCode=0x3) [0128.440] VarCmp (pvarLeft=0x18ee24, pvarRight=0x18edb4, lcid=0x0, dwFlags=0x30001) returned 0x1 [0128.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec94, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.441] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.441] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.441] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.441] SysReAllocStringLen (in: pbstr=0x18ed24*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ed24*="C:") returned 1 [0128.441] VarCat (in: pvarLeft=0x18ee04, pvarRight=0x18eda4, pvarResult=0x18edf4 | out: pvarResult=0x18edf4) returned 0x0 [0128.441] VarCat (in: pvarLeft=0x18edf4, pvarRight=0x18ed94, pvarResult=0x18ede4 | out: pvarResult=0x18ede4) returned 0x0 [0128.441] VarCat (in: pvarLeft=0x18ede4, pvarRight=0x18ed84, pvarResult=0x18edd4 | out: pvarResult=0x18edd4) returned 0x0 [0128.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18e794, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.442] GetFullPathNameA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Log\\", nBufferLength=0x104, lpBuffer=0x18e9d0, lpFilePart=0x18e78c | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Log\\", lpFilePart=0x18e78c*=0x0) returned 0x43 [0128.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18ec1c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.442] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Log\\*.*", lpFindFileData=0x18e76c | out: lpFindFileData=0x18e76c*(dwFileAttributes=0x18e78c, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18edd4, ftLastAccessTime.dwLowDateTime=0x18e89c, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18e9d0, nFileSizeHigh=0x18e794, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x505c3a43, cFileName="rogram Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Log\\", cAlternateFileName="`ì\x18")) returned 0xffffffff [0128.442] GetLastError () returned 0x3 [0128.442] GetLastError () returned 0x3 [0128.443] SetLastError (dwErrCode=0x3) [0128.443] GetLastError () returned 0x3 [0128.443] SetLastError (dwErrCode=0x3) [0128.443] VarCmp (pvarLeft=0x18ee24, pvarRight=0x18edb4, lcid=0x0, dwFlags=0x30001) returned 0x1 [0128.444] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec94, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.444] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.444] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.444] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.444] SysReAllocStringLen (in: pbstr=0x18ed24*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ed24*="C:") returned 1 [0128.445] VarCat (in: pvarLeft=0x18ee04, pvarRight=0x18eda4, pvarResult=0x18edf4 | out: pvarResult=0x18edf4) returned 0x0 [0128.445] VarCat (in: pvarLeft=0x18edf4, pvarRight=0x18ed94, pvarResult=0x18ede4 | out: pvarResult=0x18ede4) returned 0x0 [0128.445] VarCat (in: pvarLeft=0x18ede4, pvarRight=0x18ed84, pvarResult=0x18edd4 | out: pvarResult=0x18edd4) returned 0x0 [0128.445] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL11.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18e794, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL11.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.445] GetFullPathNameA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL11.SQLEXPRESS\\MSSQL\\Log\\", nBufferLength=0x104, lpBuffer=0x18e9d0, lpFilePart=0x18e78c | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\MSSQL11.SQLEXPRESS\\MSSQL\\Log\\", lpFilePart=0x18e78c*=0x0) returned 0x43 [0128.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL11.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18ec1c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL11.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.446] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL11.SQLEXPRESS\\MSSQL\\Log\\*.*", lpFindFileData=0x18e76c | out: lpFindFileData=0x18e76c*(dwFileAttributes=0x18e78c, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18edd4, ftLastAccessTime.dwLowDateTime=0x18e89c, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18e9d0, nFileSizeHigh=0x18e794, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x505c3a43, cFileName="rogram Files\\Microsoft SQL Server\\MSSQL11.SQLEXPRESS\\MSSQL\\Log\\", cAlternateFileName="`ì\x18")) returned 0xffffffff [0128.446] GetLastError () returned 0x3 [0128.446] GetLastError () returned 0x3 [0128.446] SetLastError (dwErrCode=0x3) [0128.446] GetLastError () returned 0x3 [0128.446] SetLastError (dwErrCode=0x3) [0128.447] VarCmp (pvarLeft=0x18ee24, pvarRight=0x18edb4, lcid=0x0, dwFlags=0x30001) returned 0x1 [0128.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec94, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.447] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.447] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.448] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.448] SysReAllocStringLen (in: pbstr=0x18ed24*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ed24*="C:") returned 1 [0128.448] VarCat (in: pvarLeft=0x18ee04, pvarRight=0x18eda4, pvarResult=0x18edf4 | out: pvarResult=0x18edf4) returned 0x0 [0128.448] VarCat (in: pvarLeft=0x18edf4, pvarRight=0x18ed94, pvarResult=0x18ede4 | out: pvarResult=0x18ede4) returned 0x0 [0128.448] VarCat (in: pvarLeft=0x18ede4, pvarRight=0x18ed84, pvarResult=0x18edd4 | out: pvarResult=0x18edd4) returned 0x0 [0128.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL12.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18e794, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL12.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.449] GetFullPathNameA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL12.SQLEXPRESS\\MSSQL\\Log\\", nBufferLength=0x104, lpBuffer=0x18e9d0, lpFilePart=0x18e78c | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\MSSQL12.SQLEXPRESS\\MSSQL\\Log\\", lpFilePart=0x18e78c*=0x0) returned 0x43 [0128.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL12.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18ec1c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL12.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.449] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL12.SQLEXPRESS\\MSSQL\\Log\\*.*", lpFindFileData=0x18e76c | out: lpFindFileData=0x18e76c*(dwFileAttributes=0x18e78c, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18edd4, ftLastAccessTime.dwLowDateTime=0x18e89c, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18e9d0, nFileSizeHigh=0x18e794, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x505c3a43, cFileName="rogram Files\\Microsoft SQL Server\\MSSQL12.SQLEXPRESS\\MSSQL\\Log\\", cAlternateFileName="`ì\x18")) returned 0xffffffff [0128.449] GetLastError () returned 0x3 [0128.449] GetLastError () returned 0x3 [0128.449] SetLastError (dwErrCode=0x3) [0128.449] GetLastError () returned 0x3 [0128.450] SetLastError (dwErrCode=0x3) [0128.450] VarCmp (pvarLeft=0x18ee24, pvarRight=0x18edb4, lcid=0x0, dwFlags=0x30001) returned 0x1 [0128.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec94, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.450] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.451] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.451] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.451] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.451] SysReAllocStringLen (in: pbstr=0x18ed24*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ed24*="C:") returned 1 [0128.451] VarCat (in: pvarLeft=0x18ee04, pvarRight=0x18eda4, pvarResult=0x18edf4 | out: pvarResult=0x18edf4) returned 0x0 [0128.451] VarCat (in: pvarLeft=0x18edf4, pvarRight=0x18ed94, pvarResult=0x18ede4 | out: pvarResult=0x18ede4) returned 0x0 [0128.451] VarCat (in: pvarLeft=0x18ede4, pvarRight=0x18ed84, pvarResult=0x18edd4 | out: pvarResult=0x18edd4) returned 0x0 [0128.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL13.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18e794, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL13.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.452] GetFullPathNameA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL13.SQLEXPRESS\\MSSQL\\Log\\", nBufferLength=0x104, lpBuffer=0x18e9d0, lpFilePart=0x18e78c | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\MSSQL13.SQLEXPRESS\\MSSQL\\Log\\", lpFilePart=0x18e78c*=0x0) returned 0x43 [0128.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL13.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18ec1c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL13.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.452] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL13.SQLEXPRESS\\MSSQL\\Log\\*.*", lpFindFileData=0x18e76c | out: lpFindFileData=0x18e76c*(dwFileAttributes=0x18e78c, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18edd4, ftLastAccessTime.dwLowDateTime=0x18e89c, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18e9d0, nFileSizeHigh=0x18e794, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x505c3a43, cFileName="rogram Files\\Microsoft SQL Server\\MSSQL13.SQLEXPRESS\\MSSQL\\Log\\", cAlternateFileName="`ì\x18")) returned 0xffffffff [0128.452] GetLastError () returned 0x3 [0128.452] GetLastError () returned 0x3 [0128.452] SetLastError (dwErrCode=0x3) [0128.452] GetLastError () returned 0x3 [0128.452] SetLastError (dwErrCode=0x3) [0128.452] VarCmp (pvarLeft=0x18ee24, pvarRight=0x18edb4, lcid=0x0, dwFlags=0x30001) returned 0x1 [0128.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec94, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.453] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.453] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.453] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.453] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.453] SysReAllocStringLen (in: pbstr=0x18ed24*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ed24*="C:") returned 1 [0128.453] VarCat (in: pvarLeft=0x18ee04, pvarRight=0x18eda4, pvarResult=0x18edf4 | out: pvarResult=0x18edf4) returned 0x0 [0128.453] VarCat (in: pvarLeft=0x18edf4, pvarRight=0x18ed94, pvarResult=0x18ede4 | out: pvarResult=0x18ede4) returned 0x0 [0128.453] VarCat (in: pvarLeft=0x18ede4, pvarRight=0x18ed84, pvarResult=0x18edd4 | out: pvarResult=0x18edd4) returned 0x0 [0128.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL14.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18e794, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL14.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.453] GetFullPathNameA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL14.SQLEXPRESS\\MSSQL\\Log\\", nBufferLength=0x104, lpBuffer=0x18e9d0, lpFilePart=0x18e78c | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\MSSQL14.SQLEXPRESS\\MSSQL\\Log\\", lpFilePart=0x18e78c*=0x0) returned 0x43 [0128.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL14.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18ec1c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL14.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.453] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL14.SQLEXPRESS\\MSSQL\\Log\\*.*", lpFindFileData=0x18e76c | out: lpFindFileData=0x18e76c*(dwFileAttributes=0x18e78c, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18edd4, ftLastAccessTime.dwLowDateTime=0x18e89c, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18e9d0, nFileSizeHigh=0x18e794, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x505c3a43, cFileName="rogram Files\\Microsoft SQL Server\\MSSQL14.SQLEXPRESS\\MSSQL\\Log\\", cAlternateFileName="`ì\x18")) returned 0xffffffff [0128.454] GetLastError () returned 0x3 [0128.454] GetLastError () returned 0x3 [0128.454] SetLastError (dwErrCode=0x3) [0128.454] GetLastError () returned 0x3 [0128.454] SetLastError (dwErrCode=0x3) [0128.454] VarCmp (pvarLeft=0x18ee24, pvarRight=0x18edb4, lcid=0x0, dwFlags=0x30001) returned 0x1 [0128.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec94, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.454] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.455] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.455] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.455] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.455] SysReAllocStringLen (in: pbstr=0x18ed24*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ed24*="C:") returned 1 [0128.455] VarCat (in: pvarLeft=0x18ee04, pvarRight=0x18eda4, pvarResult=0x18edf4 | out: pvarResult=0x18edf4) returned 0x0 [0128.455] VarCat (in: pvarLeft=0x18edf4, pvarRight=0x18ed94, pvarResult=0x18ede4 | out: pvarResult=0x18ede4) returned 0x0 [0128.455] VarCat (in: pvarLeft=0x18ede4, pvarRight=0x18ed84, pvarResult=0x18edd4 | out: pvarResult=0x18edd4) returned 0x0 [0128.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL15.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18e794, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL15.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.455] GetFullPathNameA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL15.SQLEXPRESS\\MSSQL\\Log\\", nBufferLength=0x104, lpBuffer=0x18e9d0, lpFilePart=0x18e78c | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\MSSQL15.SQLEXPRESS\\MSSQL\\Log\\", lpFilePart=0x18e78c*=0x0) returned 0x43 [0128.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL15.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18ec1c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL15.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.455] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL15.SQLEXPRESS\\MSSQL\\Log\\*.*", lpFindFileData=0x18e76c | out: lpFindFileData=0x18e76c*(dwFileAttributes=0x18e78c, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18edd4, ftLastAccessTime.dwLowDateTime=0x18e89c, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18e9d0, nFileSizeHigh=0x18e794, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x505c3a43, cFileName="rogram Files\\Microsoft SQL Server\\MSSQL15.SQLEXPRESS\\MSSQL\\Log\\", cAlternateFileName="`ì\x18")) returned 0xffffffff [0128.456] GetLastError () returned 0x3 [0128.456] GetLastError () returned 0x3 [0128.456] SetLastError (dwErrCode=0x3) [0128.456] GetLastError () returned 0x3 [0128.456] SetLastError (dwErrCode=0x3) [0128.456] VarCmp (pvarLeft=0x18ee24, pvarRight=0x18edb4, lcid=0x0, dwFlags=0x30001) returned 0x1 [0128.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec94, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.457] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.457] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.457] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.457] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.457] SysReAllocStringLen (in: pbstr=0x18ed24*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ed24*="C:") returned 1 [0128.457] VarCat (in: pvarLeft=0x18ee04, pvarRight=0x18eda4, pvarResult=0x18edf4 | out: pvarResult=0x18edf4) returned 0x0 [0128.457] VarCat (in: pvarLeft=0x18edf4, pvarRight=0x18ed94, pvarResult=0x18ede4 | out: pvarResult=0x18ede4) returned 0x0 [0128.457] VarCat (in: pvarLeft=0x18ede4, pvarRight=0x18ed84, pvarResult=0x18edd4 | out: pvarResult=0x18edd4) returned 0x0 [0128.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL16.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18e794, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL16.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.457] GetFullPathNameA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL16.SQLEXPRESS\\MSSQL\\Log\\", nBufferLength=0x104, lpBuffer=0x18e9d0, lpFilePart=0x18e78c | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\MSSQL16.SQLEXPRESS\\MSSQL\\Log\\", lpFilePart=0x18e78c*=0x0) returned 0x43 [0128.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL16.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18ec1c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL16.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.457] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL16.SQLEXPRESS\\MSSQL\\Log\\*.*", lpFindFileData=0x18e76c | out: lpFindFileData=0x18e76c*(dwFileAttributes=0x18e78c, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18edd4, ftLastAccessTime.dwLowDateTime=0x18e89c, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18e9d0, nFileSizeHigh=0x18e794, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x505c3a43, cFileName="rogram Files\\Microsoft SQL Server\\MSSQL16.SQLEXPRESS\\MSSQL\\Log\\", cAlternateFileName="`ì\x18")) returned 0xffffffff [0128.457] GetLastError () returned 0x3 [0128.458] GetLastError () returned 0x3 [0128.458] SetLastError (dwErrCode=0x3) [0128.458] GetLastError () returned 0x3 [0128.458] SetLastError (dwErrCode=0x3) [0128.458] VarCmp (pvarLeft=0x18ee24, pvarRight=0x18edb4, lcid=0x0, dwFlags=0x30001) returned 0x1 [0128.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec94, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.458] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.458] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.458] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.458] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.458] SysReAllocStringLen (in: pbstr=0x18ed24*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ed24*="C:") returned 1 [0128.458] VarCat (in: pvarLeft=0x18ee04, pvarRight=0x18eda4, pvarResult=0x18edf4 | out: pvarResult=0x18edf4) returned 0x0 [0128.458] VarCat (in: pvarLeft=0x18edf4, pvarRight=0x18ed94, pvarResult=0x18ede4 | out: pvarResult=0x18ede4) returned 0x0 [0128.458] VarCat (in: pvarLeft=0x18ede4, pvarRight=0x18ed84, pvarResult=0x18edd4 | out: pvarResult=0x18edd4) returned 0x0 [0128.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL17.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18e794, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL17.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.459] GetFullPathNameA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL17.SQLEXPRESS\\MSSQL\\Log\\", nBufferLength=0x104, lpBuffer=0x18e9d0, lpFilePart=0x18e78c | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\MSSQL17.SQLEXPRESS\\MSSQL\\Log\\", lpFilePart=0x18e78c*=0x0) returned 0x43 [0128.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL17.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18ec1c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL17.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.459] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL17.SQLEXPRESS\\MSSQL\\Log\\*.*", lpFindFileData=0x18e76c | out: lpFindFileData=0x18e76c*(dwFileAttributes=0x18e78c, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18edd4, ftLastAccessTime.dwLowDateTime=0x18e89c, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18e9d0, nFileSizeHigh=0x18e794, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x505c3a43, cFileName="rogram Files\\Microsoft SQL Server\\MSSQL17.SQLEXPRESS\\MSSQL\\Log\\", cAlternateFileName="`ì\x18")) returned 0xffffffff [0128.459] GetLastError () returned 0x3 [0128.459] GetLastError () returned 0x3 [0128.459] SetLastError (dwErrCode=0x3) [0128.459] GetLastError () returned 0x3 [0128.459] SetLastError (dwErrCode=0x3) [0128.459] VarCmp (pvarLeft=0x18ee24, pvarRight=0x18edb4, lcid=0x0, dwFlags=0x30001) returned 0x1 [0128.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec94, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.459] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.459] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.460] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.460] SysReAllocStringLen (in: pbstr=0x18ed24*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ed24*="C:") returned 1 [0128.460] VarCat (in: pvarLeft=0x18ee04, pvarRight=0x18eda4, pvarResult=0x18edf4 | out: pvarResult=0x18edf4) returned 0x0 [0128.460] VarCat (in: pvarLeft=0x18edf4, pvarRight=0x18ed94, pvarResult=0x18ede4 | out: pvarResult=0x18ede4) returned 0x0 [0128.460] VarCat (in: pvarLeft=0x18ede4, pvarRight=0x18ed84, pvarResult=0x18edd4 | out: pvarResult=0x18edd4) returned 0x0 [0128.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL18.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18e794, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL18.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.461] GetFullPathNameA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL18.SQLEXPRESS\\MSSQL\\Log\\", nBufferLength=0x104, lpBuffer=0x18e9d0, lpFilePart=0x18e78c | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\MSSQL18.SQLEXPRESS\\MSSQL\\Log\\", lpFilePart=0x18e78c*=0x0) returned 0x43 [0128.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL18.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18ec1c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL18.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.461] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL18.SQLEXPRESS\\MSSQL\\Log\\*.*", lpFindFileData=0x18e76c | out: lpFindFileData=0x18e76c*(dwFileAttributes=0x18e78c, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18edd4, ftLastAccessTime.dwLowDateTime=0x18e89c, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18e9d0, nFileSizeHigh=0x18e794, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x505c3a43, cFileName="rogram Files\\Microsoft SQL Server\\MSSQL18.SQLEXPRESS\\MSSQL\\Log\\", cAlternateFileName="`ì\x18")) returned 0xffffffff [0128.461] GetLastError () returned 0x3 [0128.461] GetLastError () returned 0x3 [0128.461] SetLastError (dwErrCode=0x3) [0128.461] GetLastError () returned 0x3 [0128.461] SetLastError (dwErrCode=0x3) [0128.461] VarCmp (pvarLeft=0x18ee24, pvarRight=0x18edb4, lcid=0x0, dwFlags=0x30001) returned 0x1 [0128.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec94, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.461] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.461] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.462] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.462] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.462] SysReAllocStringLen (in: pbstr=0x18ed24*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ed24*="C:") returned 1 [0128.462] VarCat (in: pvarLeft=0x18ee04, pvarRight=0x18eda4, pvarResult=0x18edf4 | out: pvarResult=0x18edf4) returned 0x0 [0128.462] VarCat (in: pvarLeft=0x18edf4, pvarRight=0x18ed94, pvarResult=0x18ede4 | out: pvarResult=0x18ede4) returned 0x0 [0128.462] VarCat (in: pvarLeft=0x18ede4, pvarRight=0x18ed84, pvarResult=0x18edd4 | out: pvarResult=0x18edd4) returned 0x0 [0128.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL19.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18e794, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL19.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.462] GetFullPathNameA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL19.SQLEXPRESS\\MSSQL\\Log\\", nBufferLength=0x104, lpBuffer=0x18e9d0, lpFilePart=0x18e78c | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\MSSQL19.SQLEXPRESS\\MSSQL\\Log\\", lpFilePart=0x18e78c*=0x0) returned 0x43 [0128.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL19.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18ec1c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL19.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.462] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL19.SQLEXPRESS\\MSSQL\\Log\\*.*", lpFindFileData=0x18e76c | out: lpFindFileData=0x18e76c*(dwFileAttributes=0x18e78c, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18edd4, ftLastAccessTime.dwLowDateTime=0x18e89c, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18e9d0, nFileSizeHigh=0x18e794, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x505c3a43, cFileName="rogram Files\\Microsoft SQL Server\\MSSQL19.SQLEXPRESS\\MSSQL\\Log\\", cAlternateFileName="`ì\x18")) returned 0xffffffff [0128.462] GetLastError () returned 0x3 [0128.462] GetLastError () returned 0x3 [0128.462] SetLastError (dwErrCode=0x3) [0128.462] GetLastError () returned 0x3 [0128.462] SetLastError (dwErrCode=0x3) [0128.463] VarCmp (pvarLeft=0x18ee24, pvarRight=0x18edb4, lcid=0x0, dwFlags=0x30001) returned 0x1 [0128.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive", cchWideChar=12, lpMultiByteStr=0x18ec94, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive", lpUsedDefaultChar=0x0) returned 12 [0128.463] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="LOGONSERVER=\\\\XDUWTFONO", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.463] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="ProgramData=C:\\ProgramData", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 1 [0128.463] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="SystemDrive=C:", cchCount1=11, lpString2="SystemDrive", cchCount2=11) returned 2 [0128.463] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd076c, cbMultiByte=3, lpWideCharStr=0x2fd0cc, cchWideChar=6 | out: lpWideCharStr="C:") returned 3 [0128.463] SysReAllocStringLen (in: pbstr=0x18ed24*="C:", psz=0x0, len=0x2 | out: pbstr=0x18ed24*="C:") returned 1 [0128.463] VarCat (in: pvarLeft=0x18ee04, pvarRight=0x18eda4, pvarResult=0x18edf4 | out: pvarResult=0x18edf4) returned 0x0 [0128.463] VarCat (in: pvarLeft=0x18edf4, pvarRight=0x18ed94, pvarResult=0x18ede4 | out: pvarResult=0x18ede4) returned 0x0 [0128.463] VarCat (in: pvarLeft=0x18ede4, pvarRight=0x18ed84, pvarResult=0x18edd4 | out: pvarResult=0x18edd4) returned 0x0 [0128.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL20.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18e794, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL20.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.463] GetFullPathNameA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL20.SQLEXPRESS\\MSSQL\\Log\\", nBufferLength=0x104, lpBuffer=0x18e9d0, lpFilePart=0x18e78c | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\MSSQL20.SQLEXPRESS\\MSSQL\\Log\\", lpFilePart=0x18e78c*=0x0) returned 0x43 [0128.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL20.SQLEXPRESS\\MSSQL\\Log\\", cchWideChar=-1, lpMultiByteStr=0x18ec1c, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft SQL Server\\MSSQL20.SQLEXPRESS\\MSSQL\\Log\\", lpUsedDefaultChar=0x0) returned 68 [0128.463] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\MSSQL20.SQLEXPRESS\\MSSQL\\Log\\*.*", lpFindFileData=0x18e76c | out: lpFindFileData=0x18e76c*(dwFileAttributes=0x18e78c, ftCreationTime.dwLowDateTime=0x2d9ab8, ftCreationTime.dwHighDateTime=0x18edd4, ftLastAccessTime.dwLowDateTime=0x18e89c, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x72a16647, ftLastWriteTime.dwHighDateTime=0x18e9d0, nFileSizeHigh=0x18e794, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x505c3a43, cFileName="rogram Files\\Microsoft SQL Server\\MSSQL20.SQLEXPRESS\\MSSQL\\Log\\", cAlternateFileName="`ì\x18")) returned 0xffffffff [0128.463] GetLastError () returned 0x3 [0128.463] GetLastError () returned 0x3 [0128.463] SetLastError (dwErrCode=0x3) [0128.464] GetLastError () returned 0x3 [0128.464] SetLastError (dwErrCode=0x3) [0128.464] VarCmp (pvarLeft=0x18ee24, pvarRight=0x18edb4, lcid=0x0, dwFlags=0x30001) returned 0x1 [0128.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18eca4, cbMultiByte=1, lpWideCharStr=0x501577c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0128.464] SysStringLen (param_1="") returned 0xff [0128.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=255, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 255 [0128.464] SysStringLen (param_1="") returned 0xff [0128.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=256, lpMultiByteStr=0x354044, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 256 [0128.465] SetErrorMode (uMode=0x8001) returned 0x8001 [0128.465] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0128.465] SetErrorMode (uMode=0x8001) returned 0x8001 [0128.465] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalDriveStringsA") returned 0x76d4e4dc [0128.465] GetLogicalDriveStringsA (in: nBufferLength=0xff, lpBuffer=0x354044 | out: lpBuffer="C:\\") returned 0x4 [0128.465] GetLastError () returned 0x0 [0128.465] SysStringByteLen (bstr="㩃\\") returned 0xff [0128.465] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x354044, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0128.466] SysStringByteLen (bstr="㩃\\") returned 0xff [0128.466] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x354044, cbMultiByte=256, lpWideCharStr=0x2e5144, cchWideChar=511 | out: lpWideCharStr="C:\\") returned 256 [0128.466] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18ec9c, cbMultiByte=1, lpWideCharStr=0x501577c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0128.466] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18eca0, cbMultiByte=1, lpWideCharStr=0x5015644, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0128.466] VarBstrCmp (bstrLeft="C:\\", bstrRight="", lcid=0x0, dwFlags=0x30001) returned 0x2 [0128.466] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18eca4, cbMultiByte=1, lpWideCharStr=0x501577c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0128.466] SysStringLen (param_1="C:") returned 0x2 [0128.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:", cchWideChar=3, lpMultiByteStr=0x5015644, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:", lpUsedDefaultChar=0x0) returned 3 [0128.466] IsWindowVisible (hWnd=0x60114) returned 0 [0128.466] lstrlenA (lpString="C:") returned 2 [0128.466] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x188, wParam=0x0, lParam=0x0) returned 0xffffffff [0128.466] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x18e, wParam=0x0, lParam=0x0) returned 0x0 [0128.466] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x180, wParam=0x0, lParam=0x5015644) returned 0x0 [0128.466] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x197, wParam=0x0, lParam=0x0) returned 0x0 [0128.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18ec9c, cbMultiByte=1, lpWideCharStr=0x5015644, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0128.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18ec9c, cbMultiByte=1, lpWideCharStr=0x5015644, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0128.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18eca0, cbMultiByte=1, lpWideCharStr=0x2e604c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0128.467] VarBstrCmp (bstrLeft="", bstrRight="", lcid=0x0, dwFlags=0x30001) returned 0x1 [0128.467] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x18b, wParam=0x0, lParam=0x0) returned 0x1 [0128.467] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x18a, wParam=0x0, lParam=0x0) returned 0x2 [0128.467] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0x3) returned 0x1677628 [0128.467] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x189, wParam=0x0, lParam=0x1677628) returned 0x2 [0128.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0128.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1677628, cbMultiByte=-1, lpWideCharStr=0x5015644, cchWideChar=3 | out: lpWideCharStr="C:") returned 3 [0128.467] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1677628 | out: hHeap=0x1660000) returned 1 [0128.468] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e93a, cbMultiByte=1, lpWideCharStr=0x18e928, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0128.468] SetErrorMode (uMode=0x8001) returned 0x8001 [0128.468] LoadLibraryA (lpLibFileName="Kernel32.dll") returned 0x76d30000 [0128.468] SetErrorMode (uMode=0x8001) returned 0x8001 [0128.468] GetProcAddress (hModule=0x76d30000, lpProcName="GetVolumeInformationW") returned 0x76d5c860 [0128.468] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18e99c, lpFileSystemNameBuffer=0x2e5144, nFileSystemNameSize=0x105 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18e99c*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0128.469] GetLastError () returned 0x0 [0128.469] VarBstrCmp (bstrLeft="NTFS", bstrRight="NTFS", lcid=0x1, dwFlags=0x30001) returned 0x1 [0128.469] SetErrorMode (uMode=0x8001) returned 0x8001 [0128.469] LoadLibraryA (lpLibFileName="Kernel32.dll") returned 0x76d30000 [0128.469] SetErrorMode (uMode=0x8001) returned 0x8001 [0128.469] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileW") returned 0x76d43f5c [0128.470] CreateFileW (lpFileName="\\\\.\\C:" (normalized: "c:"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0128.470] GetLastError () returned 0x0 [0128.470] SetErrorMode (uMode=0x8001) returned 0x8001 [0128.470] LoadLibraryA (lpLibFileName="msvbvm60.dll") returned 0x72940000 [0128.470] SetErrorMode (uMode=0x8001) returned 0x8001 [0128.471] GetProcAddress (hModule=0x72940000, lpProcName="VarPtr") returned 0x72a1de99 [0128.471] GetLastError () returned 0x0 [0128.471] SetErrorMode (uMode=0x8001) returned 0x8001 [0128.471] LoadLibraryA (lpLibFileName="msvbvm60.dll") returned 0x72940000 [0128.471] SetErrorMode (uMode=0x8001) returned 0x8001 [0128.472] GetProcAddress (hModule=0x72940000, lpProcName="GetMem4") returned 0x72a35e23 [0128.472] GetLastError () returned 0x0 [0128.472] GetLastError () returned 0x0 [0128.472] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x18ed84 | out: ppsaOut=0x18ed84) returned 0x0 [0128.500] GetCurrentProcessId () returned 0xa90 [0128.500] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x8, Size=0x18) returned 0x1671850 [0128.500] RtlAllocateHeap (HeapHandle=0x1660000, Flags=0x0, Size=0xc) returned 0x1672bf0 [0128.501] PeekMessageA (in: lpMsg=0x18e97c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18e97c) returned 1 [0128.501] IsWindow (hWnd=0x60116) returned 1 [0128.501] GetWindowLongA (hWnd=0x60116, nIndex=-16) returned 1409351809 [0128.501] IsIconic (hWnd=0x5026a) returned 0 [0128.501] GetParent (hWnd=0x60116) returned 0x5026a [0128.501] TranslateMessage (lpMsg=0x18e97c) returned 0 [0128.502] DispatchMessageA (lpMsg=0x18e97c) returned 0x0 [0128.502] GetWindowLongA (hWnd=0x60116, nIndex=-16) returned 1409351809 [0128.502] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60116, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0128.502] PeekMessageA (in: lpMsg=0x18e8f8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18e8f8) returned 1 [0128.502] PeekMessageA (in: lpMsg=0x18e97c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18e97c) returned 1 [0128.502] IsWindow (hWnd=0x5011e) returned 1 [0128.502] GetWindowLongA (hWnd=0x5011e, nIndex=-16) returned 1419837443 [0128.503] IsIconic (hWnd=0x5026a) returned 0 [0128.503] GetParent (hWnd=0x5011e) returned 0x5026a [0128.503] TranslateMessage (lpMsg=0x18e97c) returned 0 [0128.503] DispatchMessageA (lpMsg=0x18e97c) returned 0x0 [0128.503] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x5011e, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0128.503] PeekMessageA (in: lpMsg=0x18e8f8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18e8f8) returned 1 [0128.503] PeekMessageA (in: lpMsg=0x18e97c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18e97c) returned 1 [0128.504] IsWindow (hWnd=0x60114) returned 1 [0128.504] GetWindowLongA (hWnd=0x60114, nIndex=-16) returned 1409351809 [0128.504] IsIconic (hWnd=0x5026a) returned 0 [0128.504] GetParent (hWnd=0x60114) returned 0x5026a [0128.504] TranslateMessage (lpMsg=0x18e97c) returned 0 [0128.505] DispatchMessageA (lpMsg=0x18e97c) returned 0x0 [0128.505] GetWindowLongA (hWnd=0x60114, nIndex=-16) returned 1409351809 [0128.505] CallWindowProcA (lpPrevWndFunc=0x77cbabe9, hWnd=0x60114, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0128.505] PeekMessageA (in: lpMsg=0x18e8f8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18e8f8) returned 1 [0128.505] PeekMessageA (in: lpMsg=0x18e97c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18e97c) returned 1 [0128.506] IsWindow (hWnd=0x20264) returned 1 [0128.506] GetWindowLongA (hWnd=0x20264, nIndex=-16) returned -1946157056 [0128.506] GetParent (hWnd=0x20264) returned 0x6015a [0128.506] TranslateMessage (lpMsg=0x18e97c) returned 0 [0128.506] DispatchMessageA (lpMsg=0x18e97c) returned 0x0 [0128.507] PeekMessageA (in: lpMsg=0x18e8f8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18e8f8) returned 1 [0128.507] PeekMessageA (in: lpMsg=0x18e97c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18e97c) returned 1 [0128.507] IsWindow (hWnd=0x20262) returned 1 [0128.507] GetWindowLongA (hWnd=0x20262, nIndex=-16) returned -1946157056 [0128.507] GetParent (hWnd=0x20262) returned 0x0 [0128.507] TranslateMessage (lpMsg=0x18e97c) returned 0 [0128.507] DispatchMessageA (lpMsg=0x18e97c) returned 0x0 [0128.508] PeekMessageA (in: lpMsg=0x18e8f8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18e8f8) returned 0 [0128.508] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1672bf0 | out: hHeap=0x1660000) returned 1 [0128.508] HeapFree (in: hHeap=0x1660000, dwFlags=0x0, lpMem=0x1671850 | out: hHeap=0x1660000) returned 1 [0128.508] GetTickCount () returned 0x11531f9 [0128.509] IsWindowVisible (hWnd=0x5026a) returned 0 [0128.509] Sleep (dwMilliseconds=0x0) [0128.521] SetErrorMode (uMode=0x8001) returned 0x8001 [0128.521] LoadLibraryA (lpLibFileName="Kernel32.dll") returned 0x76d30000 [0128.525] SetErrorMode (uMode=0x8001) returned 0x8001 [0128.525] GetProcAddress (hModule=0x76d30000, lpProcName="DeviceIoControl") returned 0x76d4322f [0128.525] DeviceIoControl (hDevice=0x2f0, dwIoControlCode=0x900b3, lpInBuffer=0x18ed50, nInBufferSize=0x18, lpOutBuffer=0x5390020, nOutBufferSize=0x500000, lpBytesReturned=0x18ed7c, lpOverlapped=0x0) Thread: id = 3 os_tid = 0xa0c Thread: id = 4 os_tid = 0x618 [0059.576] GetCurrentThreadId () returned 0x618 Thread: id = 5 os_tid = 0xb0 [0059.742] GetCurrentThreadId () returned 0xb0 Thread: id = 6 os_tid = 0xa80 [0059.749] GetCurrentThreadId () returned 0xa80 Thread: id = 252 os_tid = 0x838 [0125.083] GetCurrentThreadId () returned 0x838 Process: id = "3" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x971d000" os_pid = "0x370" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d057" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 7 os_tid = 0x138 Thread: id = 8 os_tid = 0x410 Thread: id = 9 os_tid = 0x418 Thread: id = 10 os_tid = 0x484 Thread: id = 11 os_tid = 0x7e8 Thread: id = 12 os_tid = 0x320 Thread: id = 13 os_tid = 0x6cc Thread: id = 14 os_tid = 0x42c Thread: id = 15 os_tid = 0x1e4 Thread: id = 16 os_tid = 0x760 Thread: id = 17 os_tid = 0x75c Thread: id = 18 os_tid = 0x74c Thread: id = 19 os_tid = 0x710 Thread: id = 20 os_tid = 0x6e8 Thread: id = 21 os_tid = 0x6e0 Thread: id = 22 os_tid = 0x6d0 Thread: id = 23 os_tid = 0x6bc Thread: id = 24 os_tid = 0x6b8 Thread: id = 25 os_tid = 0x6b0 Thread: id = 26 os_tid = 0x6a8 Thread: id = 27 os_tid = 0x69c Thread: id = 28 os_tid = 0x698 Thread: id = 29 os_tid = 0x684 Thread: id = 30 os_tid = 0x678 Thread: id = 31 os_tid = 0x4a8 Thread: id = 32 os_tid = 0x46c Thread: id = 33 os_tid = 0x44c Thread: id = 34 os_tid = 0x424 Thread: id = 35 os_tid = 0x420 Thread: id = 36 os_tid = 0x41c Thread: id = 37 os_tid = 0x404 Thread: id = 38 os_tid = 0x14c Thread: id = 39 os_tid = 0x158 Thread: id = 40 os_tid = 0x3fc Thread: id = 41 os_tid = 0x3f4 Thread: id = 42 os_tid = 0x3e8 Thread: id = 43 os_tid = 0x39c Thread: id = 44 os_tid = 0x390 Thread: id = 45 os_tid = 0x38c Thread: id = 46 os_tid = 0x388 Thread: id = 47 os_tid = 0x37c Thread: id = 48 os_tid = 0x374 Thread: id = 49 os_tid = 0x1c4 Thread: id = 50 os_tid = 0x5f4 Thread: id = 51 os_tid = 0x5e4 Thread: id = 52 os_tid = 0xabc Thread: id = 53 os_tid = 0xa00 Thread: id = 54 os_tid = 0xbc0 Thread: id = 72 os_tid = 0x568 Thread: id = 73 os_tid = 0x6f4 Thread: id = 74 os_tid = 0x6fc Thread: id = 75 os_tid = 0x7b8 Thread: id = 76 os_tid = 0x90 Thread: id = 77 os_tid = 0x32c Thread: id = 78 os_tid = 0x6a4 Thread: id = 80 os_tid = 0x78c Thread: id = 81 os_tid = 0x560 Thread: id = 245 os_tid = 0x804 Thread: id = 246 os_tid = 0x818 Thread: id = 247 os_tid = 0x8e0 Thread: id = 248 os_tid = 0x814 Thread: id = 249 os_tid = 0x8d0 Thread: id = 250 os_tid = 0x828 Thread: id = 288 os_tid = 0x9b4 Thread: id = 289 os_tid = 0xbcc Thread: id = 292 os_tid = 0x9d4 Thread: id = 293 os_tid = 0x9e8 Thread: id = 294 os_tid = 0xadc Thread: id = 295 os_tid = 0x7e8 Thread: id = 296 os_tid = 0xaac Thread: id = 297 os_tid = 0xa98 Thread: id = 298 os_tid = 0x314 Thread: id = 316 os_tid = 0xb40 Thread: id = 337 os_tid = 0xc0 Thread: id = 338 os_tid = 0x780 Process: id = "4" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x60669000" os_pid = "0xa44" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00042ede" [0xc000000f] Thread: id = 55 os_tid = 0xa70 Thread: id = 56 os_tid = 0xa64 Thread: id = 57 os_tid = 0xa60 Thread: id = 58 os_tid = 0xa5c Thread: id = 59 os_tid = 0xa58 Thread: id = 60 os_tid = 0xa54 Thread: id = 61 os_tid = 0xa50 Thread: id = 62 os_tid = 0xa4c Thread: id = 63 os_tid = 0xa48 Thread: id = 79 os_tid = 0x730 Thread: id = 251 os_tid = 0x824 Thread: id = 290 os_tid = 0x9c4 Thread: id = 291 os_tid = 0x9d8 Thread: id = 343 os_tid = 0xcc Process: id = "5" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x61664000" os_pid = "0xa10" os_integrity_level = "0x4000" os_privileges = "0xe60b1e990" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d057" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 64 os_tid = 0xa30 Thread: id = 65 os_tid = 0xa2c Thread: id = 66 os_tid = 0xa28 Thread: id = 67 os_tid = 0xa24 Thread: id = 68 os_tid = 0xa20 Thread: id = 69 os_tid = 0xa1c Thread: id = 70 os_tid = 0xa18 Thread: id = 71 os_tid = 0xa14 Thread: id = 82 os_tid = 0x364 Thread: id = 342 os_tid = 0x15c Thread: id = 351 os_tid = 0x7d4 Process: id = "6" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x136a6000" os_pid = "0x7a0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 83 os_tid = 0x774 Thread: id = 84 os_tid = 0x7c8 Thread: id = 85 os_tid = 0x3b4 Thread: id = 86 os_tid = 0x5ac Thread: id = 87 os_tid = 0x48c Thread: id = 88 os_tid = 0x414 Thread: id = 89 os_tid = 0x5dc Thread: id = 90 os_tid = 0x7f4 Thread: id = 119 os_tid = 0x80c Thread: id = 120 os_tid = 0x81c Thread: id = 121 os_tid = 0x82c Thread: id = 122 os_tid = 0x83c Thread: id = 123 os_tid = 0x85c Thread: id = 124 os_tid = 0x86c Thread: id = 125 os_tid = 0x88c Thread: id = 126 os_tid = 0x8ac Thread: id = 127 os_tid = 0x8cc Thread: id = 128 os_tid = 0x8dc Thread: id = 129 os_tid = 0x91c Thread: id = 130 os_tid = 0x94c Thread: id = 131 os_tid = 0x99c Thread: id = 132 os_tid = 0x9ac Thread: id = 133 os_tid = 0x9cc Thread: id = 134 os_tid = 0x9dc Thread: id = 135 os_tid = 0x9f0 Thread: id = 136 os_tid = 0x9fc Thread: id = 137 os_tid = 0x360 Thread: id = 138 os_tid = 0xaa4 Thread: id = 139 os_tid = 0x358 Thread: id = 140 os_tid = 0xab4 Thread: id = 141 os_tid = 0xae0 Thread: id = 142 os_tid = 0xb64 Thread: id = 143 os_tid = 0xb50 Thread: id = 144 os_tid = 0xaec Thread: id = 145 os_tid = 0xb5c Thread: id = 146 os_tid = 0xb04 Thread: id = 147 os_tid = 0x34c Thread: id = 148 os_tid = 0xadc Thread: id = 149 os_tid = 0x270 Thread: id = 150 os_tid = 0x324 Thread: id = 151 os_tid = 0xaf0 Thread: id = 152 os_tid = 0x314 Thread: id = 153 os_tid = 0xb40 Thread: id = 154 os_tid = 0xb44 Thread: id = 155 os_tid = 0xb3c Thread: id = 156 os_tid = 0xa9c Thread: id = 157 os_tid = 0xb34 Thread: id = 158 os_tid = 0xa34 Thread: id = 159 os_tid = 0xb84 Thread: id = 160 os_tid = 0xc0 Thread: id = 161 os_tid = 0x57c Thread: id = 162 os_tid = 0x7a8 Thread: id = 163 os_tid = 0x700 Thread: id = 166 os_tid = 0x10c Thread: id = 167 os_tid = 0x79c Thread: id = 168 os_tid = 0x15c Thread: id = 169 os_tid = 0x20c Thread: id = 170 os_tid = 0x7c0 Thread: id = 171 os_tid = 0x5d4 Thread: id = 172 os_tid = 0x240 Thread: id = 173 os_tid = 0x788 Thread: id = 174 os_tid = 0x5d8 Thread: id = 175 os_tid = 0xa6c Thread: id = 176 os_tid = 0x798 Thread: id = 177 os_tid = 0x308 Thread: id = 178 os_tid = 0x7fc Thread: id = 179 os_tid = 0x40c Thread: id = 180 os_tid = 0x244 Thread: id = 181 os_tid = 0x634 Thread: id = 182 os_tid = 0x5cc Thread: id = 183 os_tid = 0x64 Thread: id = 184 os_tid = 0xa40 Thread: id = 185 os_tid = 0x7bc Thread: id = 186 os_tid = 0x54c Thread: id = 187 os_tid = 0x9f4 Thread: id = 188 os_tid = 0x5bc Thread: id = 189 os_tid = 0x7e0 Thread: id = 190 os_tid = 0x9f8 Thread: id = 191 os_tid = 0x570 Thread: id = 192 os_tid = 0x598 Thread: id = 193 os_tid = 0xa04 Thread: id = 194 os_tid = 0x5c4 Thread: id = 195 os_tid = 0xa08 Thread: id = 196 os_tid = 0x704 Thread: id = 197 os_tid = 0x318 Thread: id = 198 os_tid = 0x7d4 Thread: id = 199 os_tid = 0x9e0 Thread: id = 200 os_tid = 0x694 Thread: id = 201 os_tid = 0x9d0 Thread: id = 202 os_tid = 0x5a8 Thread: id = 203 os_tid = 0x7e4 Thread: id = 204 os_tid = 0x754 Thread: id = 205 os_tid = 0x9c0 Thread: id = 206 os_tid = 0x664 Thread: id = 207 os_tid = 0x31c Thread: id = 208 os_tid = 0x9b0 Thread: id = 209 os_tid = 0x4fc Thread: id = 210 os_tid = 0x9a0 Thread: id = 211 os_tid = 0x408 Thread: id = 212 os_tid = 0x544 Thread: id = 213 os_tid = 0x534 Thread: id = 214 os_tid = 0x990 Thread: id = 215 os_tid = 0x670 Thread: id = 216 os_tid = 0x980 Thread: id = 217 os_tid = 0x25c Thread: id = 218 os_tid = 0x7b0 Thread: id = 219 os_tid = 0x2c4 Thread: id = 220 os_tid = 0x970 Thread: id = 221 os_tid = 0x208 Thread: id = 222 os_tid = 0x960 Thread: id = 223 os_tid = 0x488 Thread: id = 224 os_tid = 0x790 Thread: id = 225 os_tid = 0x7cc Thread: id = 226 os_tid = 0x950 Thread: id = 227 os_tid = 0x304 Thread: id = 228 os_tid = 0x940 Thread: id = 229 os_tid = 0x7ec Thread: id = 230 os_tid = 0x4e4 Thread: id = 231 os_tid = 0x7dc Thread: id = 232 os_tid = 0x930 Thread: id = 233 os_tid = 0x6c0 Thread: id = 234 os_tid = 0x540 Thread: id = 235 os_tid = 0x920 Thread: id = 236 os_tid = 0x124 Thread: id = 237 os_tid = 0x174 Thread: id = 238 os_tid = 0x910 Thread: id = 239 os_tid = 0x604 Thread: id = 240 os_tid = 0x688 Thread: id = 241 os_tid = 0x900 Thread: id = 242 os_tid = 0x55c Thread: id = 243 os_tid = 0x8f0 Thread: id = 244 os_tid = 0x808 Process: id = "7" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x14017000" os_pid = "0x248" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005a70c" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 91 os_tid = 0x3d4 Thread: id = 92 os_tid = 0x620 [0077.147] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xf7d5e0 | out: lpSystemTimeAsFileTime=0xf7d5e0*(dwLowDateTime=0x23776c80, dwHighDateTime=0x1d68e85)) [0077.147] GetCurrentProcessId () returned 0x248 [0077.147] GetCurrentThreadId () returned 0x620 [0077.147] GetTickCount () returned 0x11494d1 [0077.147] QueryPerformanceCounter (in: lpPerformanceCount=0xf7d5e8 | out: lpPerformanceCount=0xf7d5e8*=19772199776) returned 1 [0077.149] malloc (_Size=0x100) returned 0x3d8e80 [0141.960] free (_Block=0x3d8e80) Thread: id = 93 os_tid = 0x738 Thread: id = 94 os_tid = 0x7d0 Thread: id = 95 os_tid = 0x6dc Thread: id = 96 os_tid = 0x7b4 Thread: id = 97 os_tid = 0x70c Thread: id = 112 os_tid = 0x734 Thread: id = 344 os_tid = 0x20c Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x972d000" os_pid = "0xc8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "7" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dde1" [0xc000000f], "LOCAL" [0x7] Thread: id = 98 os_tid = 0xa88 Thread: id = 99 os_tid = 0x6f0 Thread: id = 100 os_tid = 0x768 Thread: id = 101 os_tid = 0x764 Thread: id = 102 os_tid = 0x758 Thread: id = 103 os_tid = 0x724 Thread: id = 104 os_tid = 0x718 Thread: id = 105 os_tid = 0x714 Thread: id = 106 os_tid = 0x630 Thread: id = 107 os_tid = 0x154 Thread: id = 108 os_tid = 0x150 Thread: id = 109 os_tid = 0x120 Thread: id = 110 os_tid = 0x118 Thread: id = 111 os_tid = 0xf0 Thread: id = 164 os_tid = 0x60c Thread: id = 299 os_tid = 0x330 Thread: id = 340 os_tid = 0x10c Thread: id = 348 os_tid = 0x308 Process: id = "9" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x1391c000" os_pid = "0x6ec" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "7" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005aadc" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 113 os_tid = 0x518 Thread: id = 114 os_tid = 0xc4 Thread: id = 115 os_tid = 0x490 Thread: id = 116 os_tid = 0x7c4 Thread: id = 117 os_tid = 0x51c Thread: id = 118 os_tid = 0x7ac Thread: id = 165 os_tid = 0x1c0 Thread: id = 345 os_tid = 0xd0 Process: id = "10" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x12db5000" os_pid = "0x8c0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa90" cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /F /IM MSExchange*" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 253 os_tid = 0x834 Thread: id = 262 os_tid = 0xbf4 Thread: id = 269 os_tid = 0x944 Thread: id = 278 os_tid = 0x974 Thread: id = 279 os_tid = 0x988 Process: id = "11" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x12cbc000" os_pid = "0x8b0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa90" cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /F /IM Microsoft*" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 254 os_tid = 0x848 Thread: id = 266 os_tid = 0x934 Thread: id = 273 os_tid = 0x968 Thread: id = 286 os_tid = 0x9b8 Thread: id = 287 os_tid = 0xbd0 Process: id = "12" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x5aec1000" os_pid = "0x844" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa90" cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /F /IM ora*" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 255 os_tid = 0x858 Thread: id = 264 os_tid = 0xbf0 Thread: id = 271 os_tid = 0x958 Thread: id = 282 os_tid = 0xbd8 Thread: id = 283 os_tid = 0x994 Process: id = "13" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x5acc6000" os_pid = "0x8a0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa90" cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /F /IM tns*" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 256 os_tid = 0x854 Thread: id = 263 os_tid = 0x924 Thread: id = 270 os_tid = 0xbe8 Thread: id = 280 os_tid = 0x984 Thread: id = 281 os_tid = 0x998 Process: id = "14" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x26bcb000" os_pid = "0x890" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa90" cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /F /IM mysql*" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 257 os_tid = 0x868 Thread: id = 260 os_tid = 0x914 Thread: id = 268 os_tid = 0xbec Thread: id = 274 os_tid = 0xbe4 Thread: id = 275 os_tid = 0x964 Process: id = "15" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x1c7d0000" os_pid = "0x870" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa90" cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /F /IM sql*" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 258 os_tid = 0x888 Thread: id = 261 os_tid = 0x928 Thread: id = 267 os_tid = 0x948 Thread: id = 276 os_tid = 0xbe0 Thread: id = 277 os_tid = 0x978 Process: id = "16" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x271d5000" os_pid = "0x884" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa90" cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /F /IM postgres*" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 259 os_tid = 0x898 Thread: id = 265 os_tid = 0x938 Thread: id = 272 os_tid = 0x954 Thread: id = 284 os_tid = 0x9a8 Thread: id = 285 os_tid = 0x9a4 Process: id = "17" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x9236000" os_pid = "0x11c" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "8" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e33a" [0xc000000f], "LOCAL" [0x7] Thread: id = 300 os_tid = 0x348 Thread: id = 301 os_tid = 0xa7c Thread: id = 302 os_tid = 0x440 Thread: id = 303 os_tid = 0x548 Thread: id = 304 os_tid = 0x750 Thread: id = 305 os_tid = 0x6a0 Thread: id = 306 os_tid = 0x68c Thread: id = 307 os_tid = 0x680 Thread: id = 308 os_tid = 0x66c Thread: id = 309 os_tid = 0x5fc Thread: id = 310 os_tid = 0x188 Thread: id = 311 os_tid = 0x140 Thread: id = 312 os_tid = 0x128 Thread: id = 313 os_tid = 0x2b0 Thread: id = 314 os_tid = 0x218 Thread: id = 315 os_tid = 0x1cc Thread: id = 341 os_tid = 0x284 Thread: id = 346 os_tid = 0x7c0 Thread: id = 347 os_tid = 0x788 Thread: id = 349 os_tid = 0x7bc Process: id = "18" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xad16000" os_pid = "0x338" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000bc99" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 317 os_tid = 0x7a4 Thread: id = 318 os_tid = 0x638 Thread: id = 319 os_tid = 0x554 Thread: id = 320 os_tid = 0x720 Thread: id = 321 os_tid = 0x668 Thread: id = 322 os_tid = 0x65c Thread: id = 323 os_tid = 0x144 Thread: id = 324 os_tid = 0x110 Thread: id = 325 os_tid = 0x3f0 Thread: id = 326 os_tid = 0x3ec Thread: id = 327 os_tid = 0x3e4 Thread: id = 328 os_tid = 0x3e0 Thread: id = 329 os_tid = 0x3d0 Thread: id = 330 os_tid = 0x3cc Thread: id = 331 os_tid = 0x398 Thread: id = 332 os_tid = 0x394 Thread: id = 333 os_tid = 0x384 Thread: id = 334 os_tid = 0x380 Thread: id = 335 os_tid = 0x350 Thread: id = 336 os_tid = 0x33c Thread: id = 339 os_tid = 0x700 Thread: id = 350 os_tid = 0x9f4